By Titik Puspa 
In an unprecedented legal development, the U.S. Justice Department has indicted an American citizen, Samuel Tunick, for allegedly providing border authorities with a passcode that intentionally erased the contents of his smartphone. This marks what is believed to be the first known instance in the United States where federal prosecutors have leveled charges against an individual for the destruction of data using a "duress" password, a sophisticated security feature built into some mobile operating systems. The indictment, along with extensive media reporting, including an initial report by The Guardian, has brought this intricate technological and constitutional case to the forefront, raising profound questions about digital privacy, border security, and the evolving interpretation of individual rights at the threshold of the United States.
Samuel Tunick, an Atlanta resident, is vigorously contesting the charges. His legal defense team has argued that the U.S. Customs and Border Protection (CBP) acted unlawfully by seizing his phone upon his arrival back in the U.S. last year. They contend that any evidence derived from the incident, including the alleged wiping of his phone’s data, should be inadmissible in court. The crux of the legal battle lies in a specific feature embedded within GrapheneOS, a privacy-focused custom Android operating system that can be installed on many Google Pixel devices. Tunick’s attorneys have confirmed that his phone was running this specialized software.
The "duress" passcode, a feature that GrapheneOS prominently advertises as a key security measure, is designed to allow a user to set a secondary password. When this duress password is entered, instead of unlocking the device, it triggers an immediate and complete wipe of all data stored on the phone. This function is intended as a last resort for individuals who may be coerced into revealing their device’s unlock credentials, providing them with a mechanism to protect their sensitive information from unauthorized access. However, in Tunick’s case, the prosecution alleges that by providing this duress passcode, he knowingly and intentionally destroyed evidence, thereby obstructing a federal investigation.
This case inherently delves into the complex and often contentious issue of constitutional rights at the border. The U.S. government has historically maintained a broad interpretation of its authority to conduct searches and seizures at the border, asserting that individuals are not considered to be on U.S. soil until they have been formally admitted into the country. This legal doctrine, often referred to as the "border search exception," allows authorities to conduct searches without warrants that would otherwise be considered unreasonable under the Fourth Amendment. Tunick’s case is testing the boundaries of this exception, particularly when it comes to digital data and the intentional self-destruction of that data through a pre-programmed feature.
The government’s indictment, which itself contains a typographical error referencing "Untied States Code," accuses Tunick of providing a passcode to border agents that resulted in the phone’s "digital contents" being deleted prior to its seizure. This action, the prosecution argues, falls under a federal statute that criminalizes the knowing destruction or damage of property with the intent to prevent its seizure by authorities. Tunick has pleaded not guilty to the charges, setting the stage for a potentially landmark legal precedent.
Tunick’s attorneys have filed a comprehensive motion to suppress the evidence, arguing that both the detention of Tunick and the subsequent seizure of his phone were unlawful. The motion details that Tunick was subjected to a secondary inspection at Atlanta’s Hartsfield-Jackson International Airport on January 24, 2025, upon his return from an overseas trip. Crucially, the filing asserts that Tunick was repeatedly denied access to legal counsel and was not properly informed of his fundamental legal rights during the inspection process. This denial of access to an attorney and the alleged failure to apprise him of his rights are central to the defense’s claim of unlawful conduct by border authorities.
Furthermore, the defense team has accused the government of employing a pretextual reason for demanding access to Tunick’s phone. They allege that the border agents initially claimed they were searching for child exploitation imagery, a claim for which no supporting evidence was provided. The motion to suppress argues that the true motivation behind the government’s interest in Tunick’s phone was his association with the "Defend the Atlanta Forest" movement. This prominent environmental advocacy group has been actively opposing the construction of a large-scale training facility for law enforcement, widely known as "Cop City," in Atlanta. The defense suggests that the government sought to gather information related to Tunick’s activism rather than genuinely investigate child exploitation.
The defense’s motion further highlights the government’s justification for searching Tunick’s phone without a warrant: the assertion that he had not yet officially crossed the U.S. border. This aligns with the long-standing U.S. government position that it possesses the authority to search and seize electronic devices at the border without requiring a warrant or court order, a practice that has been increasingly scrutinized and has seen a rise in device searches at U.S. borders in recent years.
According to the account provided by Tunick’s attorneys, when he provided his passcode to the border agents, they entered it. The immediate consequence was a startling sequence of events: "the screen went blank, flashed several times and the phone appeared to restart." Despite the data wipe, the authorities proceeded to seize the phone. Only after this process was completed was Tunick informed that he was free to enter the United States.
The subsequent indictment charged Tunick under 18 U.S. Code § 2232, a federal statute designed to prevent the destruction or concealment of property to impede its seizure by law enforcement. The application of this statute to a digitally triggered data wipe, facilitated by a user-implemented security feature, is what makes this case so novel.
Matthew Dodge, an assistant federal public defender and a member of Tunick’s legal team, emphasized the extreme rarity of this federal statute being invoked in an indictment. Security experts and privacy advocates have echoed this sentiment, noting that they have not encountered similar charges stemming from the use of duress passwords.
Bill Buddington, a senior staff technologist at the Electronic Frontier Foundation (EFF), a prominent digital rights organization, and Runa Sandvik, a highly respected digital security expert and founder of the security consultancy firm Granitt, have both expressed their surprise at the nature of the charges. Sandvik, who has extensively advised activists and journalists on digital security practices, stated, "I have not seen this before, though I’ve discussed the potential scenario with activists and journalists over the years." She added a cautionary note, interpreting the case as a stark reminder that "authorities may argue you knowingly destroyed data, so it’s better to not have that data on you when you cross certain borders." Sandvik also offered practical advice, suggesting that individuals planning to travel should consider downloading necessary data upon arrival at their destination rather than carrying it across borders, emphasizing, "With a little planning ahead of time, you can always download the data you need once you get to where you’re going."
The Electronic Frontier Foundation has been a leading voice in advocating for digital privacy and security at the border. They provide extensive resources, including guides on how individuals can protect their data and enhance their security when crossing U.S. borders, and also offer explanations of their legal rights in such situations. These resources are becoming increasingly vital as digital devices become indispensable tools for communication, work, and personal life, and as border agencies expand their surveillance capabilities.
The federal court in Atlanta overseeing Tunick’s case is expected to issue a ruling on his motion to suppress the evidence later this year. This decision could have significant implications for how digital privacy is treated at the U.S. border and how individuals’ use of advanced security features on their devices is interpreted by the legal system. A spokesperson for the Justice Department declined to comment when reached by TechCrunch for their perspective on the case. The outcome of Samuel Tunick’s legal battle will undoubtedly be closely watched by privacy advocates, technologists, and legal experts alike, as it navigates the uncharted territory of digital data destruction and constitutional rights in the context of border security.
The case of Samuel Tunick highlights a growing tension between national security imperatives and individual privacy in the digital age. As technology advances, so too do the methods by which governments seek to access information and by which individuals attempt to protect it. The "duress" password, designed as a safeguard, has unexpectedly become the focal point of a criminal prosecution, underscoring the complex legal and ethical challenges that emerge when technological capabilities intersect with established legal frameworks. The decision of the Atlanta federal court will not only determine the fate of Samuel Tunick but could also shape the future of digital rights and border search policies for years to come.
