The United States government is prosecuting an American citizen, Sam Tunick, for allegedly providing federal agents with a fake 'duress password' that wiped his phone when they attempted to seize it at Atlanta's Hartsfield-Jackson airport on January 24th, 2025. The incident has ignited a heated debate over the limits of border searches, the right to data privacy, and the legal protections available to U.S. citizens returning from abroad. Tunick's case is unprecedented because it relies on an obscure statute that criminalizes the destruction of property to prevent law enforcement from seizing it, and the outcome could reshape how travelers secure their devices.
According to the criminal complaint, Tunick was detained by federal agents while transiting through the Atlanta airport. The agents allegedly questioned him about child exploitation images, but Tunick's legal team argues that this line of inquiry was merely a pretext for a 'fishing expedition' into his connections to the Stop Cop City movement, a grassroots campaign opposing the construction of a massive police training center in Atlanta. The defense has filed a motion to suppress all evidence, contending that the detention and seizure were unlawful from the start. They claim that agents refused Tunick access to an attorney, failed to produce a warrant, and did not inform him of his legal rights.
The government's counterargument is starkly different. Prosecutors assert that since Tunick had not yet been granted permission to enter the United States when he was stopped at the border inspection area, they were not required to present a warrant or Mirandize him. This legal gray area has long been a source of controversy, as U.S. Customs and Border Protection (CBP) maintains the authority to search electronic devices without a warrant at ports of entry, a power that has been repeatedly challenged in court.
The duress password and GrapheneOS
Central to the case is the concept of a 'duress password', a security feature found in privacy-focused operating systems like GrapheneOS. This feature allows a user to set up two different passwords: one that unlocks the phone normally and another that, when entered, instantly wipes the device or triggers a factory reset. Tunick is accused of using precisely such a duress password when agents demanded he unlock his phone. By doing so, he effectively destroyed the data on the device before it could be searched.
The government is charging him under 18 U.S.C. § 1361, a federal statute that makes it a crime to willfully injure or destroy property belonging to the United States or within its jurisdiction. While this law is often used for vandalism of government buildings or monuments, prosecutors are applying it in a novel way: they argue that Tunick's phone, because it was in the custody of federal agents at the time of the wipe, constituted property subject to seizure. Destroying it therefore obstructed the lawful collection of evidence.
GrapheneOS is an open-source Android-based operating system that prioritizes security and privacy. It is designed for users who want to minimize data leaks and resist surveillance. The duress password feature is a key selling point, allowing users to ensure that sensitive information never falls into the wrong hands if they are compelled to give up their credentials. However, the Tunick case reveals a potential legal pitfall: using a duress password at the border could be interpreted as destruction of evidence, even if the user is acting out of concern for privacy or fear of unlawful search.
The Stop Cop City connection
Tunick's attorneys have provided a more specific motive for the agents' interest. They allege that the true purpose of the search was to gather intelligence on the Stop Cop City movement, which has been the target of intense surveillance and infiltration by law enforcement. The movement opposes the construction of a $90 million police training facility in Atlanta, which critics call a 'cop city' that would militarize police and displace local communities. Activists have faced harassment, surveillance, and even prosecutions for minor offenses. Tunick is believed to have been involved in organizing and supporting the movement, although no charges have been filed related to that activism directly.
If the defense's allegations are true, this case would represent another example of government overreach against dissidents. Marlon Kautz, a member of the Atlanta Solidarity Fund, told The Guardian that 'we all have a right to secure our private data against unconstitutional searches. And we should — especially in a time of rising authoritarianism.' Kautz's comment reflects a growing anxiety among civil liberties advocates that the Trump administration has emboldened border agents to conduct more aggressive searches and that ordinary citizens are being prosecuted for protecting their digital privacy.
Border device searches: a legal landscape
The legality of requiring travelers to unlock their phones at the border has been a contentious issue for years. The Fourth Amendment generally protects against unreasonable searches and seizures, but the 'border search exception' allows Customs and Border Protection to search persons and property entering the United States without a warrant or probable cause, based on the sovereign's right to control its borders. In 2017, the Supreme Court declined to hear a case challenging this policy, leaving lower courts to grapple with the boundaries. Some district courts have ruled that a full forensic search of a device requires reasonable suspicion, but the standard for requiring a password or passcode remains unclear.
In recent years, several high-profile cases have tested these boundaries. In 2019, a Canadian woman was held for hours and her phone searched because she had signed a petition critical of the Saudi government. In 2020, a U.S. citizen was detained for refusing to unlock his phone and later sued the government. The Department of Homeland Security has issued internal guidelines stating that agents should only manually search devices and should not conduct forensic exams without suspicion, but these guidelines are not legally binding and are often ignored.
The Tunick case pushes the envelope further by charging someone not for refusing to unlock a device, but for taking proactive steps to protect data. This could have a chilling effect on the use of privacy tools and encryption. If Americans fear prosecution for using duress passwords, they may be less likely to employ strong security measures, which is exactly the opposite of what many cybersecurity experts recommend.
Implications for privacy and civil liberties
Civil liberties organizations have condemned the prosecution. The Electronic Frontier Foundation (EFF) and the American Civil Liberties Union (ACLU) have both argued that individuals have a right to resist unlawful searches without facing criminal penalties. They point to the Fifth Amendment, which protects against self-incrimination, although courts have generally held that providing a password is a testimonial act and thus may be compelled only if the government can show that the evidence is already known. However, the border context complicates matters because the standard for compulsion is lower.
The use of a duress password raises an interesting legal question: is destroying data equivalent to refusing to provide a password? The government argues that Tunick didn't merely refuse; he actively destroyed evidence that they were lawfully seizing. The defense counters that the seizure was unlawful to begin with, and that Tunick was protecting his privacy from an unconstitutional search. If the court sides with the government, it could set a precedent that anyone who wipes their device when faced with a demand at the border is committing a federal crime.
Moreover, the case highlights the tension between privacy-focused operating systems and law enforcement's desire for access. GrapheneOS and similar systems (like the CalyxOS or even Apple's lockdown mode) are designed to resist coercion. The Tunick case may become a test case for whether such security features can be used without legal consequence. Already, some security experts are warning that this prosecution could lead to a crackdown on the very tools that protect citizens from surveillance.
The outcome remains uncertain. The defense has filed motions to suppress evidence and dismiss the charges on constitutional grounds. The government is pushing forward, arguing that national security and border integrity require such measures. Meanwhile, Tunick's supporters have launched a fundraising campaign to cover his legal fees and are mounting a public awareness effort about the dangers of border device searches.
As the case progresses through the courts, it will likely attract attention from privacy advocates, civil libertarians, and tech companies alike. The question at its core is whether the government can force Americans to choose between their digital privacy and their freedom from prosecution. For now, Sam Tunick faces charges that could carry significant prison time if convicted, and his case may determine the future of phone security at the border.
Source: The Verge News