The US government is prosecuting American citizen Sam Tunick for allegedly providing a 'duress password' that wiped his phone when federal agents tried to seize it at Hartsfield-Jackson Atlanta International Airport on January 24, 2025. The case marks a rare application of a little-known statute that criminalizes destroying or damaging property to prevent authorities from seizing it. According to federal prosecutors, Tunick used a special feature of the privacy-focused operating system GrapheneOS, which allows a user to enter a separate password that, when typed, triggers a remote wipe of the device rather than unlocking it.
The incident occurred as Tunick was returning from international travel. Upon arrival, he was detained by Department of Homeland Security agents. The agents questioned him about alleged possession of child exploitation images, but Tunick's attorneys have argued that this was merely a pretext for a broader investigation into his alleged ties to the Stop Cop City movement in Atlanta. Stop Cop City is a protest campaign opposing the construction of a police training center in a forested area, which has attracted activists and led to legal and physical confrontations. The defense motion filed in court claims that the agents lacked a warrant, refused Tunick access to an attorney, and failed to inform him of his rights.
The government, however, contends that the detention was lawful because Tunick had not yet been formally admitted into the United States at the time of the questioning. The legal doctrine of the 'border search exception' grants authorities broad powers to inspect persons and belongings arriving at US borders without a warrant, even for US citizens. This exception has been extended to digital devices, but courts have begun to question its limits. The statute cited by prosecutors, 18 U.S.C. § 2232, makes it a crime to knowingly destroy or damage property to prevent a seizure. The charge carries a potential penalty of up to five years in prison.
GrapheneOS is an open-source, security-hardened Android-based operating system designed for users who prioritize privacy. One of its signature features is the ability to set a 'duress password' or 'panic button' that, when entered, can perform actions such as locking the device, logging out of accounts, or wiping data. Such tools have become increasingly popular among journalists, activists, and individuals concerned about government surveillance or device theft. The use of a duress password in a border context raises novel legal questions about whether a user's choice to protect data via encryption or remote wipe constitutes obstruction of justice.
The case has drawn attention from civil liberties groups, who argue that border searches of digital devices are invasive and often lack probable cause. The American Civil Liberties Union (ACLU) has repeatedly challenged government searches of phones and laptops at the border, arguing that they violate the Fourth Amendment's protection against unreasonable searches. In 2017, the Ninth Circuit ruled that border agents cannot forensically examine a device without reasonable suspicion, but the practice remains widespread. The Trump administration expanded the use of warrantless device searches at ports of entry, and the Biden administration has continued many of those policies.
Tunick's alleged connection to Stop Cop City is also significant. The movement has faced heavy surveillance by law enforcement, including the monitoring of social media accounts and the infiltration of activist groups. In 2021, the Department of Homeland Security issued a bulletin warning about potential domestic terrorism associated with environmental and anarchist extremists, which critics say has been used to justify surveillance of lawful protest. Tunick's attorneys maintain that the agents were looking for evidence of his involvement in the protests and that the child exploitation pretext was a ruse to bypass legal safeguards.
The case also highlights the role of technology in enabling digital self-defense. Tools like duress passwords, secure messaging apps, and encrypted storage are now standard among activists and journalists operating in hostile environments. However, their use can inadvertently run afoul of laws designed to prevent evidence tampering. The defense is expected to argue that Tunick did not intend to obstruct justice but simply exercised his right to protect private data from an unlawful search. The government, on the other hand, will characterize the wipe as an intentional act to destroy evidence related to a crime.
Legal experts are watching the case closely because it could set a precedent for how the courts treat the use of privacy tools at the border. If the government succeeds in prosecuting Tunick under Section 2232, it could deter others from using similar protective measures, even when they are acting within their rights. Conversely, if the court rules that the detention and seizure were unlawful, the case could strengthen the legal framework for digital privacy and limit the scope of border searches.
The broader context includes increasing reliance on data as a target of government investigation. In recent years, US Customs and Border Protection (CBP) has expanded its ability to search electronic devices, including copying social media contacts and reviewing cloud-stored files. In fiscal year 2023, CBP conducted over 50,000 device searches, a dramatic increase from previous years. While most searches are cursory, more intrusive examinations have been challenged in court. The Supreme Court has not yet directly addressed the question of whether border agents can compel a traveler to provide a passcode or biometric unlock, leaving lower courts to grapple with the issue.
Marlon Kautz of the Atlanta Solidarity Fund, which supports activists facing legal issues, told The Guardian that the case represents a broader assault on the right to data privacy. 'We all have a right to secure our private data against unconstitutional searches,' Kautz said. 'And we should — especially in a time of rising authoritarianism.' Under the Trump administration, entering the US became a much more fraught process, even for citizens who can face hours-long detention and scrutiny of social media accounts. Most agree the only way to protect your data is to delete it, but doing so can lead to a criminal charge.
The case is scheduled for a preliminary hearing in federal court in Atlanta in August. The defense is expected to file a motion to suppress all evidence obtained from the phone, arguing that the initial detention was unlawful under the Fourth Amendment. The outcome could have significant implications for the tens of thousands of Americans who cross the border each year with encrypted devices. As the legal battle unfolds, technology companies are watching closely, as their products are increasingly caught in the crosshairs of law enforcement.
This is a developing story. More details will be added as they become available.
Source:The Verge News