A federal case testing whether a phone’s built-in “duress password” can be prosecuted as evidence destruction is drawing national attention after Atlanta activist Samuel Tunick was charged following a January 2025 encounter with U.S. Customs and Border Protection at Hartsfield-Jackson Atlanta International Airport. The unusual duress password phone wipe at the center of the case has become the subject of a recent YouTube video from legal commentary channel LegalEagle, which broke down the charges for its audience.
Thank you for reading this post, don't forget to subscribe!
Tunick, an activist from Atlanta, was coming home after a vacation in the Dominican Republic when U.S. Customs and Border Protection agents demanded his cellphone and the code to unlock it, on the pretext of searching for child sexual abuse material
, according to U.S. News & World Report.
Tunick’s device was running GrapheneOS, an Android-based operating system that includes a “duress” code that wipes a phone’s digital contents and restores factory settings, and when agents entered the PIN he provided, things did not go as they had hoped
.
According to TechCrunch’s reporting,
when Tunick provided his passcode and the authorities entered it, “the screen went blank, flashed several times and the phone appeared to restart.” The authorities seized his phone anyway, before telling him that he was free to go and could enter the United States
.
What the Duress Password Actually Does
GrapheneOS, a privacy-focused, security-hardened version of Android, allows users to set a secondary PIN that behaves differently from the standard unlock code.
The duress code may appear to do the same thing as a normal PIN, but instead initiates a factory reset or destroys encryption keys, rendering the data inaccessible, while the hardware remains intact and only the information stored on it does not
.
That distinction — an intact device with irretrievably scrambled data — is now central to the government’s case.
That distinction is central to the prosecution: the government’s theory is that the physical phone was merely the container, officers had asserted authority to seize the data inside it, and entering the duress code was an intentional act designed to destroy that evidence
.
An Unprecedented Prosecution
Federal prosecutors in the Northern District of Georgia charged Tunick with violating a statute that criminalizes destroying property to prevent its lawful seizure, saying he handed border agents a passcode that triggered a wipe on a Google Pixel running a privacy-focused operating system
.
Tunick has pleaded not guilty
.
The federal statute being used carries a maximum penalty of five years in prison, along with a potential fine
.
Digital security experts say they have never seen a case built this way before.
Bill Budington of the Electronic Frontier Foundation and Runa Sandvik, a digital security expert who works to protect at-risk people, told TechCrunch that they had not seen similar cases involving the use of duress passwords, with Sandvik saying “I have not seen this before, though I’ve discussed the potential scenario with activists and journalists over the years.”
Security researchers and privacy advocates have said they have not seen prosecutors bring a case like this before, and experts quoted by TechCrunch called the prosecution unprecedented
.
Tunick’s defense argues the search itself was pretextual.
His motion to suppress argued that the government was instead investigating him over his association with a long-running environmental movement called Defend the Atlanta Forest, which opposes the development of a sprawling training campus for law enforcement in Atlanta dubbed “Cop City.”
That controversy over the Atlanta training center has drawn sustained protest activity for years, echoing the kind of political friction seen in other closely watched local disputes, such as the fallout covered in JupiterFeed’s report on the Clacton by-election backlash in the UK.
Border Search Powers Remain Broad
The case also revives long-standing debate over how much authority CBP has over travelers’ devices.
The U.S. government has long claimed it can search and seize people’s devices without a search warrant or court order until they are permitted entry to the United States
.
While the Supreme Court held in Riley v. California that police generally need warrants to search phones during domestic arrests, the government argues that those protections are diminished at the border, where officers may inspect people and property entering the United States
.
The Electronic Frontier Foundation, which
has long warned that border device searches carry unique privacy risks and maintains guides for travelers about what to expect at ports of entry
, has weighed in on the broader stakes. Civil liberties advocates warn a conviction could have a chilling effect far beyond Tunick’s case.
Civil-liberties advocates say that if Tunick is convicted, the outcome could discourage people from using defensive tools that journalists, organizers, and other vulnerable travelers rely on
.
In discussing the case on his channel, LegalEagle host Devin Stone framed the prosecution as a novel and legally questionable stretch of an obstruction statute, walking viewers through why charging someone for triggering a security feature they were, in effect, invited to use raises thorny constitutional questions — his own commentary and opinion on the matter, distinct from the underlying facts of the prosecution itself.
What Comes Next
The case, formally titled USA v. Tunick, is being watched closely by privacy advocates, security researchers, and civil liberties attorneys as an early test of how far border search authority extends into the realm of encrypted data and self-destructing security features.
Its outcome may shape how courts treat privacy software, encryption keys and emergency reset functions during border inspections
for years to come, potentially affecting the tools journalists and activists use to protect sensitive information when crossing into the United States.