A federal case moving through court in Atlanta is asking a question that privacy-tool developers have wondered about for years: can a phone's own built-in security feature be treated as a crime? The US Department of Justice is prosecuting Atlanta resident Samuel Tunick after his GrapheneOS phone wiped itself during a Customs and Border Protection search and GrapheneOS has now published its own detailed defense of the feature at the center of the case.

What Actually Happened at the Airport

On January 24, 2025, Tunick was returning to the US from the Dominican Republic when he was pulled into secondary inspection at Atlanta's Hartsfield-Jackson airport. According to court filings, CBP agents had circulated his name internally over "suspected terrorism activities" tied to his alleged association with Defend the Atlanta Forest, the movement opposing the city's police and fire training facility known as "Cop City." His attorneys say agents framed the stop around a search for child exploitation material without offering evidence for that claim, while the real focus was his protest ties.

Agents repeatedly asked Tunick to unlock his Google Pixel phone. His attorneys say he was denied access to a lawyer and never read his rights. When he eventually entered a passcode, the screen went blank, flashed, and restarted, the phone had been running GrapheneOS, and the code he gave was a duress PIN, a feature that instantly and irreversibly deletes a device's encryption keys instead of unlocking it. Agents seized the now-empty phone anyway and released him.

What a GrapheneOS duress PIN actually does: users can set a second PIN or password alongside their real credentials. Entering it anywhere the OS asks for authentication triggers an irreversible wipe no reboot required, no confirmation prompt, and no visible sign to anyone watching that anything but a normal unlock just happened.

The Charge: Destroying Evidence to Prevent Seizure

Prosecutors charged Tunick under 18 U.S.C. § 2232, a rarely used federal statute that makes it a crime to knowingly destroy property to prevent its lawful seizure by authorities. Legal experts say they aren't aware of this statute ever being aimed at an operating system's own documented security feature before. Bill Budington, senior staff technologist at the Electronic Frontier Foundation, and security researcher Runa Sandvik both told reporters they hadn't seen a comparable case.

Tunick's legal team has filed a motion to suppress the evidence, arguing the search and detention were unconstitutional from the start: agents lacked a warrant, relied on the border-search exception to the Fourth Amendment, denied him access to counsel, and never read him his Miranda rights. A federal judge isn't expected to rule on that motion until at least late October 2026.

GrapheneOS's Response

After the case drew wider press coverage, GrapheneOS published a detailed public explanation of its security architecture. The project's core position: its features are built to prevent unauthorized data extraction in the first place, not designed around the idea of destroying evidence after the fact. The duress PIN is documented, opt-in, and has existed for exactly the scenario the name describes someone being coerced into unlocking a device against their will rather than being built in response to this case or marketed as a way to defeat law enforcement specifically.

Why this case matters beyond one phone: GrapheneOS is used by journalists, human rights workers, security researchers, and privacy-conscious travelers generally, not just activists. If prosecutors succeed in treating a documented privacy feature as evidence of criminal intent, the concern raised by digital-rights groups is straightforward: using strong privacy tools at all could start to look suspicious to the people deciding whether to charge you, regardless of what's actually on your device.

Where It Stands

Tunick has pleaded not guilty. The case is still in its pre-trial stage, with the suppression motion pending and no trial date set. Whatever the judge decides on the constitutional questions will likely matter more to the outcome than the duress-PIN feature itself but the case is already being watched closely by security researchers as a test of whether privacy software can be used against the person who relied on it.

Sources

  • PCMag's coverage of GrapheneOS's response: PCMag
  • TechSpot's report on the charges and legal experts' reactions: TechSpot
  • CyberInsider's report on GrapheneOS's published statement: CyberInsider
  • Android Authority's coverage of the suppression motion: Android Authority

This article was written by DigitalEscapeTools based on published reporting and court filings referenced by that reporting, current as of publication. The case is ongoing and details may change as it proceeds.