GrapheneOS

Key Findings

• Economic: GrapheneOS Foundation is an active Canadian federal soliciting not-for-profit corporation; its stated model is to receive and distribute donations supporting the open-source project.^{1, 2}

• Digital: Published infrastructure materials list providers and global service locations, with no Israel location or Israeli-origin enterprise-security vendor identified in that inventory.³

• Political: No public evidence identified of an official GrapheneOS statement on Israel, Palestine, Gaza, the IDF, or the current conflict in reviewed project-controlled sources.⁴

• Not found: No public evidence identified of GrapheneOS contracts, procurement, integrations, or services involving Israeli military, intelligence, police, or other state-security bodies.⁵

Target Profile

Key Facts:

• GrapheneOS states that Daniel Micay founded the project in late 2014 and that the Foundation was created in Canada in March 2023 to receive and distribute donations.^{2, 6}
• The project states that copyright remains with individual developers and has not been assigned to the Foundation or another company.⁶
• A March 2026 announcement described a long-term Motorola collaboration concerning future devices with official GrapheneOS support; the announcement did not identify an Israeli distributor, Israeli government customer, IDF customer, or settlement activity.⁷

Executive Summary

GrapheneOS is an open-source mobile operating-system project associated with the Canadian GrapheneOS Foundation. The Foundation is an active federal soliciting not-for-profit corporation incorporated on 17 March 2023, with a Toronto registered office and three listed directors: Khalykbek Yelshibekov, Daniel Micay, and Dmytro Mukhomor.¹ GrapheneOS describes itself as an independent, donation-funded non-profit project, and states that the Foundation’s role is to receive and distribute donations for developer payments, hardware, infrastructure, legal fees, and related expenses.^{2, 8}

The evidence record establishes no documented Israel/Palestine nexus. The project’s public infrastructure inventory identifies a set of named service providers and service locations across multiple regions, but no Israel location appears in that inventory and no Israeli-origin enterprise-security vendor is identified there.³ Project Nimbus materials confirm that Google Cloud supplies public-cloud services to Israeli government entities, but those materials do not name GrapheneOS as a contractor, subcontractor, participant, or customer. Optional user installation of Google Play services on GrapheneOS likewise does not establish a GrapheneOS commercial, procurement, licensing, or cloud-contract relationship with Google.^{9, 10}

No public evidence identified of GrapheneOS Foundation, the GrapheneOS project, or named principals holding contracts, tenders, framework agreements, procurement relationships, technical integrations, or service agreements with the Israeli Ministry of Defense, IDF, Israeli intelligence agencies, Israeli police, Israel Prison Service, Border Police, or other Israeli state-security bodies.⁵ No public evidence identified that GrapheneOS develops or markets a military-specific, tactical, weapons-integrated, surveillance, targeting, autonomous-decision, or offensive-cyber product for Israeli users.⁵

The record also does not establish Israeli operational presence, investment, sourcing, revenues, tax payments, subsidiaries, R&D facilities, settlements activity, lobbying, anti-BDS advocacy, or financial support to Israeli military, settlement, or state-aligned organisations.^{11, 12} Several negative findings are bounded: reviewed UN, OHCHR, BDS, AFSC, and other materials did not mention GrapheneOS, but document-scoped checks do not establish database-wide or exhaustive absence of relevant activity.^{13, 14}

On the fixed, human-vetted V6.5 record, all four domain scores are zero. The resulting BRS is 0, placing GrapheneOS in Tier E (Minimal/No Complicity). This classification reflects the absence of verified evidence under the audited criteria, not a claim that all possible information has been exhausted.

Timeline of Relevant Events

Corporate Overview

GrapheneOS is presented in its own materials as an independent open-source mobile operating-system project focused on privacy and security. It is Android-compatible, but does not bundle Google applications or services. Its documentation states that users may choose to install official Google Play services as ordinary sandboxed applications in a selected profile; those applications receive no special operating-system privileges and require user-granted permissions for profile data.¹⁶

The Canadian GrapheneOS Foundation is the project’s documented non-profit vehicle for receiving and distributing donations. The public federal record identifies an active soliciting corporation, a Toronto registered office, and the three listed directors. The reviewed registry and project materials do not identify a parent company, subsidiaries, franchisees, licensees, Israeli incorporation, Israeli branch, Israeli office, disclosed shareholding structure, or Israeli controlling capital.^{1, 6}

GrapheneOS states that the project’s source-code copyright remains with individual developers and that it has never used copyright assignment. It also states that a former sponsor associated with the CopperheadOS period is no longer associated with GrapheneOS. The available history does not identify that former sponsor’s legal name, jurisdiction, ownership, or current status; it also does not document an Israeli relationship or continuing connection.⁶

The project’s published server inventory names DataPacket, Xenyth, Vultr, Misaka.io, Cherry Servers, ReliableSite, Zare, netcup, and BuyVM as providers or sponsors for listed services. The inventory does not identify Israeli-origin enterprise-security vendors, and no Israel location appears among the listed public service locations.³

Domain Summaries

Military: Military

Mechanism of Involvement

No public evidence identified of GrapheneOS Foundation, the GrapheneOS project, or named principals holding an Israeli Ministry of Defense, IDF, Israel Prison Service, Border Police, or other Israeli-security-body contract, tender award, framework agreement, memorandum of understanding, or procurement relationship.⁵

No public evidence identified that GrapheneOS markets a ruggedised, tactical, mil-spec, defence-grade, or Israeli-security-force-specific variant. Its reviewed materials describe open-source mobile operating-system software, not a targeting, fire-control, weapons-integration, kinetic-effects, munitions, platform, or military-support product.^{5, 16}

No public evidence identified of GrapheneOS supply-chain integration with Elbit Systems, Israel Aerospace Industries, Rafael, IMI/Elbit Land, or another identified Israeli defence prime. No public evidence identified of GrapheneOS equipment or services being used for settlement construction, demolitions, the separation barrier, checkpoints, military installations, or related sites in the occupied Palestinian territory or Golan Heights.⁵

Counter-Arguments and Evidence Limits

The strongest defence is the project’s documented civilian character: GrapheneOS describes an independently developed, open-source mobile OS, funded through donations and not strongly associated with a particular company.^{2, 16} Public availability of open-source software alone does not establish military sale, end-user, military-specific implementation, or defence-prime supply.

The bounded research did not locate Israeli military procurement or end-user evidence. However, a lack of located public evidence is not proof that no downstream user has ever installed or used publicly available software. The audit’s conclusion is limited to absence of verified evidence of a direct military or security relationship.

Named Entities and Evidence Map

Digital: Digital

Mechanism of Involvement

GrapheneOS provides an Android-compatible mobile operating system. Its published server inventory lists public DNS, website and network, release, geocoding, attestation, mail, connectivity, time, location, and proxy-related services across Europe, North America, South America, Asia, and Australia; it does not list an Israel location.³

No public evidence identified of GrapheneOS procurement, licensing, subscription, integration, systems-integrator, outsourcing, reseller, cloud, or data-centre relationship involving Israeli-origin enterprise software or Israeli state entities.³ No public evidence identified of Project Nimbus participation, Israeli government-cloud contracting, or services marketed to Israeli state or military bodies for data sovereignty or resilience.^{9, 10}

No public evidence identified that GrapheneOS provides Israeli-origin surveillance, biometric, behavioural-analysis, predictive-policing, AI, computer-vision, autonomous tracking, target-generation, fire-control, offensive-cyber, exploit, or digital-weapons capabilities to Israeli state, military, intelligence, or security bodies.^{5, 16}

Counter-Arguments and Evidence Limits

The strongest defence is that GrapheneOS’s reviewed public materials describe a civilian non-profit open-source operating-system project, rather than a defence, intelligence, surveillance, or enterprise-security supplier.^{2, 16} The project’s optional support for users to install official Google Play services in a sandboxed profile is an end-user configuration. It does not establish a GrapheneOS business relationship with Google or participation in Google’s Project Nimbus work.^{9, 10, 16}

The public materials do not provide a complete map of routing by user-installed applications, carriers, device vendors, app developers, or third-party services. Accordingly, the finding is limited to the absence of verified GrapheneOS involvement in the identified Israeli digital, cloud, surveillance, or security relationships.^{3, 16}

Named Entities and Evidence Map

Economic: Economic

Mechanism of Involvement

GrapheneOS Foundation is a Canadian federal soliciting not-for-profit corporation. GrapheneOS states that donations from individuals, companies, and other organisations support developer pay, hardware, infrastructure, legal fees, and related project expenses.^{1, 8} The visible federal record does not identify a parent, shareholders, subsidiaries, investment holdings, or foreign operating entities.¹

No public evidence identified of direct investment in Israel or the occupied territories, Israeli subsidiaries, Israeli R&D facilities, Israeli sovereign-bond holdings, Israel-focused portfolio holdings, Israeli sourcing, importers, distributors, white-label arrangements, revenues attributable to Israel, Israeli tax payments, or profit repatriation to Israel.¹¹

The March 2026 Motorola partnership announcement concerns future devices with official GrapheneOS support. It does not identify an Israeli distributor, Israeli sales operation, Israeli government customer, IDF customer, or settlement-based activity.⁷

Counter-Arguments and Evidence Limits

The strongest defence is the project’s non-profit, donation-funded structure and the absence of verified Israel-linked economic activity in the reviewed record.^{1, 8} GrapheneOS further states that it intends to remain a non-profit open-source project rather than create a for-profit company.²

Limits remain material. The reviewed public sources do not provide audited financial statements, tax filings, donor registers, detailed funding reports, payroll disclosures, cap-table information, contract disclosures, or a complete operational map. The absence finding therefore does not quantify all funding sources or exclude all unreported economic links; it establishes only that none were publicly verified in the audited sources.^{1, 8}

Named Entities and Evidence Map

Political: Political

Mechanism of Involvement

No public evidence identified of an official GrapheneOS statement concerning Israel, Palestine, Gaza, the IDF, or the current conflict in reviewed project-controlled sources.⁴ An official forum moderation response stated that political discussion is prohibited under forum rules; this was a forum-policy statement, not a stated position on the conflict.¹⁵

No public evidence identified of GrapheneOS operations, resellers, contracts, sales, subsidiaries, or commercial presence in the occupied Palestinian territory, East Jerusalem, the Golan Heights, or Israeli settlements. No public evidence identified of GrapheneOS lobbying, PAC activity, anti-BDS advocacy, state partnerships, Israeli state honours, financial support to the IDF, FIDF, JNF/KKL, settlement entities, reservist funds, or military-welfare bodies.¹²

GrapheneOS states that, in the former Copperhead sponsorship period, there was an unsuccessful early attempt to secure a contract with an unnamed defence contractor. The project’s account states that no contract proceeded and does not identify the contractor, country, customer, or an Israeli or IDF connection.¹⁷

Counter-Arguments and Evidence Limits

The strongest defence is that the documented discontinued defence-contractor lead is explicitly non-attributable to Israel: no contract proceeded, and the cited project account does not identify the counterparty or country.¹⁷ Treating that historical, unnamed, unsuccessful lead as an Israeli or IDF relationship would exceed the evidence.

The audit found no verified political advocacy, conflict-related financing, or settlement operations. The project’s prohibition of political discussion on its forum should not be treated as evidence of a substantive position, employment action, platform-wide moderation asymmetry, or suppression of Palestinian content. No public evidence identified of independent studies, regulatory inquiries, or credible reports supporting such an interpretation.¹⁵

Named Entities and Evidence Map

BDS-1000 Score

Method: V6.5.

• V_MAX: 0.00 Avg_OTHERS: 0.00
• BRS Score: 0 Tier: E (Minimal/No Complicity)

V_MAX is 0.00 because the human-vetted record did not verify involvement in any audited military, digital, economic, or political vector. The resulting Tier E classification reflects a scale-free, evidence-only assessment: it does not infer responsibility from open-source availability, unverified allegations, historical but discontinued relationships, or wrong-entity attribution.

Methodology Note

• Evidence is limited to the four supplied domain audits and the source materials identified in their End Notes.
• The assessment is evidence-only: claims require documentary support, while unsupported allegations are not converted into findings.
• Impact reflects activity type rather than company size; M assesses documented scale and P assesses documented directness.
• Divested, exited, discontinued, or unsuccessful operations are mitigating context and are not scored as ongoing involvement.
• Entity attribution is specific: no transitive guilt is inferred from a third party, a downstream user, a former sponsor, or an unnamed counterparty.
• Settlement operations, if verified, would be assessed in both Economic and Political; “No public evidence identified” is used where the audits’ checks found no support, while document-scoped negative findings retain their stated limits.