Original GrapheneOS responses to WIRED fact checker

GrapheneOS responds to a WIRED article, accusing it of relying on fabricated history from James Donaldson and clarifying the project's non-profit success and independent growth.

WIRED has published an article about GrapheneOS with a history of the project nearly entirely based on fabrications from James Donaldson. Donaldson has spent the past 8 years trying to destroy GrapheneOS and the life of the project's founder, Daniel Micay. Donaldson has heavily engaged in fabrications with an ever changing story about the history of the project. Copperhead was forced to drop nearly all of their claims in the ongoing lawsuit. Copperhead was also forced to discontinue their closed source fork of GrapheneOS and is a zombie company with no significant operations or revenue. Copperhead lacks any serious basis for the remaining claims in their lawsuit and it isn't a major concern for us anymore. Their claims have been thoroughly debunked at this point and are primarily an issue in the form of an extreme level of fabrications and harassment they started which is carried on without them. James Donaldson has been thoroughly proven to be a serial fabricator, scammer and thief. Despite this, WIRED listened to his tall tales and presented it as a history of GrapheneOS. We weren't given an opportunity to provide an actual history of the project based in fact as we were led to believe it wasn't a major part of the article and were barely asked about it.

Copperhead was propped up by the open source project and heavily held it back. After the split with the company, the project quickly gained a lot more funding via donations and has become highly successful. Instead of having a single full time developer barely being paid anything, GrapheneOS now has around 10 full time developers and is in the process of expanding by hiring several more. It's entirely funded by donations and is far more than simply being sustainable that way. Donaldson believes that his past ties to the project he burned down and then spent years trying to destroy entitle him to getting rich from it. That's why he continues misleading people about his involvement and doubled down on a failed lawsuit. He continues causing harm to GrapheneOS and Daniel Micay to this day.

GrapheneOS Foundation is a non-profit and no one is getting rich from it. Daniel solely gets his income via GitHub Sponsors and hasn't paid himself anything from the GrapheneOS Foundation. Donaldson has only ever cared about money. He spent years manipulating and exploiting Daniel with the goal of enriching himself. He eventually decided Daniel was a barrier to him getting rich due to his values and tried to coerce him into handing over ownership and control of his open source project with no basis for it.

As part of the split between the open source project and Copperhead back in 2018, Donaldson stole a large amount of donations from the project. He ultimately ended up stealing around $300,000 worth of Bitcoin donations made to the open source project. Prior to his theft of the donations followed by years of repeatedly forking our project to sell it while falsely claiming to have created it, Donaldson heavily depended on income created by the open source project. Donaldson never funded or supported the project as he claims but rather it was entirely the other way around. He depended on a massive amount of work done by Daniel Micay to provide him with income for a tiny amount of work he was doing himself. He received as much money from device sales and donations as Daniel Micay for a tiny amount of work in comparison. His work was unsuccessful in getting any substantial funding. It didn't make any sense for the open source project to remain tied to a company holding it back. It was entirely the prerogative of the open source project to move on without it. Donaldson could not accept it continuing as an open source project.

Donaldson's claims can be proven false by interviewing numerous people who were around at the time. WIRED made no attempt to verify if anything he said was true prior to publishing it. Copperhead was a company founded by 3 people, not 2, and WIRED could have interviewed Dan McGrady who was the 3rd co-founder. There were many other people around back then they could have interviewed including many people who can confirm they had their donations stolen by James Donaldson. Donaldson serially fabricates things about himself and others. Giving him such a huge platform to mislead people is extremely irresponsible. He has very little to do with the overall history of GrapheneOS. His involvement was as someone leeching off the project for years while failing to deliver what he repeatedly promised. He isn't a hacker as he claims but rather is largely non-technical. GrapheneOS has been enormously successful through entirely funding the project with donations. It was entirely possible to create a successful business based around it but Donaldson was never the right person to do it.

Our community manager @spring-onion (Dave Wilson) handled nearly all of the communications with WIRED over months. He isn't a developer and clearly isn't the same person as Daniel Micay but yet the article makes a completely unsubstantiated claim that it could be the same person. @spring-onion knows languages Daniel doesn't speak including German, has a completely different writing style and a different voice. @spring-onion spent a massive amount of time communicating with them including multiple interviews focused on the GrapheneOS feature set and much more. WIRED repeatedly told us the article would barely cover the history of the project and wouldn't focus on Daniel Micay. Due to this, we weren't given an opportunity to provide them with information and address the claims made by James Donaldson. Despite this, it ended up being the primary focus of the article. We were only given an opportunity to respond to the vast majority of it after the article was already fully written and therefore our response to Donaldson's stories was nearly entirely omitted from the article.

The content below are the questions we were asked by a WIRED fact checker with the original responses we provided to them with no modifications. This is what WIRED received in response to us and should have much more heavily incorporated into the article.

Do you live in Canada?

Daniel Micay lives in Canada.

Did you meet James Donaldson between 2011 and 2013, when you joined Toronto Crypto?

Micay met Donaldson in late 2014 through Dan McGrady. McGrady knew Micay from his security work on Arch Linux and projects in Rust; McGrady and Micay initially connected via IRC.

Micay was not a member of Toronto Crypto. He did join the Toronto Crypto IRC channel while considering attending events, but did not attend any meetings before beginning the work that later became GrapheneOS.

At the time, were you a security researcher studying techniques used to protect banks and governments?

At that time, Micay was an open-source developer, security engineer, and security researcher; his work did not involve studying techniques used to protect banks or governments.

At the time, did you use your free time to experiment with applying the techniques you were studying to the fast-growing mobile space?

The idea of a hardened mobile OS was not novel; several projects existed or were being discussed. Micay chose to invest his free time in his own open-source implementation after discussions with McGrady. McGrady had a minor, short-lived involvement, but Micay built the initial project alone. This all occurred before Donaldson became involved.

Is it accurate that on one occasion, a troll infiltrated Toronto Crypto’s group chat and gave it what they called an “impossible” task of decrypting a series of messages? Did you eagerly accept the challenge and decrypt them with ease?

Micay has no recollection of that event / was not personally involved.