US Charges Atlanta Activist for Using GrapheneOS Duress Password to Wipe Phone at Border
Federal prosecutors have charged Atlanta activist Samuel Tunick under a rarely used destruction-of-property statute for allegedly wiping his phone with GrapheneOS's duress password during a border search.
Editor's Note ·
- Correction:
- The article states that "border officers said they were demanding access to his phone 'under the pretext of searching for child exploitation imagery'." TechCrunch's reporting actually attributes this framing to an accusation made by Tunick's attorneys against the government, not to a statement by the officers themselves: "Tunick's attorneys accused the government of demanding access to his phone under the pretext of searching for child exploitation imagery, but without providing evidence to justify its suspicion."
- Correction:
- The article names the Electronic Frontier Foundation technologist quoted as "Bill Buddington." The correct spelling, per TechCrunch, is "Bill Budington."
Overview
Federal prosecutors in the Northern District of Georgia have charged Samuel Tunick, an Atlanta-area activist, after he allegedly used a privacy feature built into GrapheneOS to wipe his phone during a border search, according to TechCrunch. The case is thought to be the first known prosecution in the United States over the alleged destruction of data using a phone’s built-in “duress” password, according to TechCrunch.
What We Know
According to TechCrunch, the encounter took place on January 24, 2025, when Tunick was pulled into secondary inspection at Atlanta’s Hartsfield-Jackson airport while returning from a trip overseas. TechCrunch reports that border officers said they were demanding access to his phone “under the pretext of searching for child exploitation imagery,” while Tunick’s own motion to suppress argues the government was “instead investigating him over his association with” Defend the Atlanta Forest, a long-running environmental movement that opposes a law enforcement training campus in Atlanta known as “Cop City.”
Tunick’s phone ran GrapheneOS, a privacy-focused Android variant that lets a user set a duress passcode. Entering that code, rather than the real unlock passcode, is designed to wipe the device, and TechCrunch reports that after Tunick gave officers the duress code, “the screen went blank, flashed several times and the phone appeared to restart.”
The indictment itself, reproduced by Gizmodo, states that on “January 24, 2025, in the Northern District of Georgia,” Tunick, before and during a search by a Customs and Border Patrol Tactical Terrorism Response Team Supervisory Officer identified in the filing only as “L.C.,” “did knowingly destroy, damage, waste, dispose of, and otherwise take any action to delete the digital contents of a Google Pixel cellular phone, for the purpose of preventing and impairing the Government’s lawful authority to take said property into its custody and control.” Gizmodo reports this is a single-count indictment brought under Section 2232(a) of Title 18 of the U.S. Code, a statute that makes it unlawful to knowingly destroy or damage property to prevent authorities from seizing it, per TechCrunch. Tunick’s attorney, Matthew Dodge, an assistant federal public defender, told TechCrunch it is rare for prosecutors to bring an indictment under that statute. Tunick has pleaded not guilty, according to TechCrunch, and the Atlanta federal court is expected to rule on his motion to suppress later this year.
Security consultant Runa Sandvik told TechCrunch, “I have not seen this before, though I’ve discussed the potential scenario with activists and journalists over the years.” She added, “I think this case serves as a reminder that authorities may argue you knowingly destroyed data, so it’s better to not have that data on you when you cross certain borders.”
Gizmodo also reports that Christophe Boutry, described as a privacy expert, said the prosecution “sends the message that [GrapheneOS] is criminal by default,” and that Boutry and Bill Buddington, a technologist with the Electronic Frontier Foundation, both said the case has no known precedent. Marlon Kautz, a member of the Atlanta Solidarity Fund, told Gizmodo, “We all have a right to secure our private data against unconstitutional searches. And we should – especially in a time of rising authoritarianism.”
According to Gizmodo, an online fundraiser for Tunick’s legal defense states that he was arrested roughly ten months after the airport encounter, during a traffic stop over a tail-light issue, when FBI and Department of Homeland Security officers detained him.
What We Don’t Know
Neither TechCrunch nor Gizmodo reports what penalty Tunick could face if convicted under the statute, and neither cites a public statement from GrapheneOS’s developers responding to the case. The outcome of Tunick’s motion to suppress, and whether prosecutors will ultimately be able to prove he — rather than a technical malfunction — triggered the wipe, remain undecided questions the Atlanta federal court has yet to resolve.