It is possible for open source hardware to be securable hardware. Of course, someone has to design it, manufacture it and distribute it and eventually it will be unsecurable because new vulnerabilities and capabilities are developed every day, so that someone will have to design, manufacture and distribute a successor and the old hardware will have to be deprecated.

All that costs money and the people who care about security are a super small group so graphene chooses hardware that is “accidentally” securable. The reference implementation pixel phones are a great example. Google doesn’t care about security or graphene. But they built a phone intended to do the hard work of putting all the possible parts together so that other manufacturers could look and see how they could do an Android phone with some feature (or even some better feature) without having to spend a bunch of cash doing it from scratch. It just so happens that Google included relockable (this is different and more important for security than unlockable) bootloaders, a processor with memory tagging support and a big pile of documentation in case you want to use those features.

Then Google indicated that it was gonna stop doing everyone else’s work for them. There are a bunch of reasons for this and I’m not gonna go into them but I will summarize some analysis: you should make it a priority to move away from Android devices eventually depending on your citizenship and stop relying on the securability of a computer system of any type. Doing everyone’s work for them was why the pixel phones were such a good target for graphene, they had the features and the documentation. Now that Google isn’t making reference implementations anymore, they don’t intend to have every feature (notably security features) or give out docs.

So the graphene people switched to Motorola. The new Motorola phone that’s expected to run graphene wasn’t designed for it, it just so happens to have the features and the company agreed to give them the documentation required. It’s “accidentally” securable.

That’s how graphene works. There isn’t an alternative for them. They don’t have the money, capital or expertise to design and release a phone specifically for security and there isn’t a market for that product they could endeavor to sell to and get a loan against the promise of.

I want to make sure we’re on the same page: graphene is open source. There are open source projects that prioritize security. Security and privacy are different things.