A Georgia man faces a felony charge for allegedly wiping his own smartphone during a U.S. Customs and Border Protection search after providing agents with a duress password that triggered a factory reset. Samuel Tunick, an Atlanta activist, was questioned by CBP officers in early 2025. Prosecutors allege that Tunick used the duress password feature available in GrapheneOS, a security-focused Android derivative, to delete evidence from his device while agents were attempting to access it The Verge.

According to court filings, CBP officers told Tunick they needed to search his device to determine whether it contained child sexual abuse material. Tunick's attorneys argue that this rationale was a pretext for a fishing expedition into his connections with the Stop Cop City protests in Atlanta. In a motion to suppress evidence filed in March, Tunick's legal team states that he did not consent to a search and repeatedly asked to speak to his attorney. CBP officers told Tunick they did not need a warrant to search his phone The Verge.

The device in question was a Google Pixel smartphone running GrapheneOS, as identified in earlier reporting on the case Privacy Guides. GrapheneOS offers a duress password feature designed to securely wipe the device's encryption keys, rendering the stored data irrecoverable, as a last-resort measure against compelled access. Tunick eventually gave CBP agents the password to his phone. When they entered it, the screen went blank, flashed several times, and the phone appeared to restart, according to court records The Verge.

The prosecution of Tunick rests on the intersection of border search exceptions to the Fourth Amendment and laws governing the destruction of evidence. Tunick's lawyers argue that the CBP demand to search his phone was invalid because it violated his constitutional rights U.S. News. The defense motion to suppress, filed in March, further contends that the search itself was unlawful, which would render any subsequent evidence, including the fact that the phone was wiped, inadmissible The Verge.

The Verge's reporting on the case draws from court filings and the motion to suppress evidence rather than a Department of Justice press release or an exclusive journalistic investigation The Verge. Ars Technica also published a report on the felony case in July 2026 Ars Technica.

For security professionals and technologists, the case centers on a feature that is considered a standard defensive tool in high-risk operational environments. Duress passwords, or duress PINs, are implemented across various secure operating systems and enterprise mobile device management frameworks. They function by directing the OS to cryptographically erase the master keys protecting the userdata partition rather than simply deleting files at the filesystem level. This ensures that even a physical forensic extraction via a chip-off or JTAG procedure cannot recover the previous contents.

The broader context here is the tension between self-protective security engineering and federal statutes on evidence tampering. For decades, the standard security guidance for users crossing international borders has been to travel with minimal data, use full-disk encryption, and be prepared to use duress or wipe features if compelled to surrender a device. Security training has consistently framed this as the responsible approach to protecting source material, client data, and privileged communications.

What the Tunick case tests is whether the execution of that exact security protocol can be prosecuted as a crime when it occurs during a border search. The outcome will hinge on procedural details: whether the search was deemed lawful at the time the duress password was entered, and whether a user can be charged with destruction of evidence when the underlying search has not yet produced any evidence to destroy. The motion to suppress directly attacks the legality of the search, arguing that without a valid search, there can be no legal obligation to preserve data for it.

This is not a case about the efficacy of GrapheneOS, which functioned exactly as designed, or about the technical merits of duress passwords, which remain a valid component of operational security. It is a test of the legal framework surrounding compelled disclosure at the border. If the court permits the felony charge to stand, it would mean that security features designed to protect data from forced access could themselves be used as the basis for criminal prosecution. The technological capability is established and will continue to exist; the legal parameters for its use are what remains contested.