GrapheneOS 'Duress Password' Wipe Triggers Federal Prosecution

What happened

US Customs and Border Protection pulled Samuel Tunick into secondary inspection at Atlanta's Hartsfield-Jackson airport on January 24, 2025, as he returned from a trip overseas, according to TechCrunch. Officers asked for his phone's passcode; after his requests to call an attorney were refused, he provided a code. That code triggered a wipe. Tunick's attorneys have confirmed the phone was running GrapheneOS, a privacy-hardened Android build, and that the code he gave was the device's configured duress passcode rather than his normal unlock code.

The feature at the centre of the case

GrapheneOS lets an owner configure a second passcode that, when entered at the lockscreen, wipes the device instead of unlocking it — a duress password, distinct from the normal unlock PIN. It's built for exactly this scenario: a situation where someone is compelled to produce a code and wants a way to protect data without visibly refusing. The design intent is defensive, not evasive — the same category of control that enterprise MDM "remote wipe on wrong PIN" and anti-tamper features occupy, just owner-configured rather than centrally managed.

Why prosecutors are treating this as a crime

The Justice Department charged Tunick under 18 U.S.C. § 2232(a), the statute covering destruction of property to prevent its lawful seizure by federal authorities, as reported by TechCrunch. Tunick has pleaded not guilty. Security researchers cited in coverage of the case, including EFF's Bill Budington, say they aren't aware of a prior US prosecution built around a duress-wipe feature — making this, as far as public reporting shows, a first-of-its-kind test of whether configuring and using this kind of privacy control during a search can itself be charged as obstruction.

The defense is arguing the search itself was unlawful

Per Schneier on Security and reporting picked up in the wider coverage of the case, Tunick's attorneys have filed a motion to suppress, arguing the detention and device seizure were themselves unlawful and that the stated justification for the search was pretextual — with his association with a long-running environmental protest movement cited as the real reason he was flagged. If that motion succeeds, the case may never reach a jury verdict on the wipe itself, leaving the core legal question — is triggering a duress wipe "destruction of property" under §2232(a) — unresolved for now.

What this means if you carry a device across borders

• A duress-wipe or panic-wipe feature is a technical control, not a legal shield — this case shows it can draw a federal charge independent of whatever else is (or isn't) on the device.
• Border search authority for electronic devices is broad and the legal boundaries around compelled passcode disclosure are still actively litigated; don't assume a rule that applied at one crossing applies at the next.
• Organizations whose staff travel internationally with sensitive data should have an explicit, counsel-reviewed policy for device handling at borders — travel-only devices with minimal data are a more defensible control than relying on a wipe feature under pressure.
• If a device is compelled or seized, preserve records of exactly what was said and done during the stop — as this case shows, the legality of the stop itself can become the central issue.

The underlying tension isn't new: strong on-device privacy engineering and law-enforcement search authority have been on a collision course for years. What's new here is that a specific, widely available feature in a well-regarded privacy-focused OS is now the direct subject of a federal charge — which makes the outcome relevant well beyond Tunick's individual case.