US Brings First-Known Criminal Case Over a Phone 'Duress Password' at the Border

Federal prosecutors have charged Atlanta activist Samuel Tunick under 18 U.S.C. § 2232 — destroying property to prevent its lawful seizure — after he allegedly wiped his Google Pixel during a secondary inspection at Hartsfield-Jackson Atlanta International Airport on January 24, 2025. His phone ran GrapheneOS, a hardened Android build whose ‘duress password’ feature erases the device’s encryption keys and factory-resets it when entered in place of the real PIN. Legal observers believe it is the first known prosecution anywhere tied to the use of a duress password on a mobile device.

The case turns a technical privacy control into an alleged federal crime, which is what makes it significant. CBP asserts broad authority to search devices at the border without a warrant, a zone the government has long treated as exempt from ordinary Fourth Amendment protections. Prosecuting a traveler for rendering that search fruitless tests whether the act of protecting one’s own data can itself be criminalized — a question with direct implications for anyone who uses full-disk encryption, remote wipe, or duress features.

Tunick has pleaded not guilty. His attorneys are moving to suppress, arguing CBP detained him in secondary inspection while denying access to counsel and failing to advise him of his rights, and that agents invoked a search for child-exploitation imagery without articulable suspicion. The defense further alleges the stop was pretextual, tied to Tunick’s involvement in the environmental movement opposing Atlanta’s ‘Cop City’ police training facility, raising First Amendment and selective-enforcement concerns alongside the border-search dispute.