US Charges Man After GrapheneOS 'Duress Password' Allegedly Wipes Phone During Border Search

A federal criminal case in the United States is drawing significant attention from the cybersecurity and privacy communities after prosecutors charged a man for allegedly using GrapheneOS' duress password feature during a border inspection.

The case involves Samuel Tunick, a U.S. citizen who was stopped by U.S. Customs and Border Protection (CBP) while returning through Hartsfield-Jackson Atlanta International Airport. According to the U.S. Department of Justice, Tunick intentionally prevented authorities from accessing his smartphone by providing a special passcode that erased the device instead of unlocking it.

What Happened?

According to court documents and multiple reports, border officers selected Tunick for a secondary inspection after he arrived from an international trip.

Officials requested access to his smartphone and asked him to provide the device's unlock code. Reports say Tunick initially declined and requested to speak with an attorney, but that request was not granted during the inspection. He later entered a passcode, after which the phone reportedly reset itself, permanently deleting locally stored data.

Federal prosecutors have charged him with knowingly destroying property to prevent lawful seizure, arguing that the phone's data was intentionally erased before investigators could examine it.

What Is GrapheneOS' Duress Password?

GrapheneOS is a privacy-focused, open-source operating system designed for Google Pixel smartphones. One of its optional security features is the duress password (also called a duress PIN or passcode).

Instead of unlocking the phone, entering the duress password immediately removes encryption keys and securely wipes user data from the device. The feature is intended for situations where someone is forced to unlock their phone under coercion.

Unlike a normal factory reset, the feature is designed to make stored information inaccessible by deleting the encryption keys protecting the data.

Why Is This Case Important?

Legal experts say this could become one of the first U.S. cases to directly examine whether using a smartphone's built-in privacy feature can lead to criminal liability.

Prosecutors argue that the phone was intentionally wiped to obstruct a lawful investigation. Meanwhile, Tunick's legal team maintains that border officers attempted to search his device without a warrant and that the inspection violated his constitutional rights. They are asking the court to suppress the evidence obtained during the incident.

Border Search Powers Remain a Key Issue

The case also highlights the long-running debate over digital privacy at border crossings.

U.S. Customs and Border Protection has argued that routine border searches generally do not require a warrant because travelers are undergoing immigration and customs inspections before formally entering the country. Privacy advocates, however, continue to question how these powers should apply to modern smartphones, which often contain years of personal, financial, and professional information.

Why This Matters for Smartphone Users

Although the case focuses on one individual, it could influence future discussions around:

1. Smartphone privacy
2. Digital security tools
3. Encryption technologies
4. Border device searches
5. User rights over personal data
6. Privacy-focused Android operating systems

A future court decision may help clarify how security features such as GrapheneOS' duress password are treated under U.S. law.

DeviceDecode's Take

This case is about more than one smartphone or one operating system. It raises broader questions about where personal privacy ends and government investigative powers begin.

It is important to note that the allegations remain before the court, and no final ruling has been made regarding the legality of Tunick's actions or the government's search.

Join the Discussion

This case has sparked debate over the balance between privacy and law enforcement powers in the digital age.

💬 What do you think?

1. Should privacy-focused features like GrapheneOS' duress password be protected by law?
2. Should border authorities be allowed to search smartphones without a warrant?
3. If you owned a phone with a similar security feature, would you enable it?

Share your thoughts in the comments below. We'd love to hear your perspective on this important privacy debate.