Man Charged for Using GrapheneOS Duress Password at Airport Border Search
In brief
- Samuel Tunick charged under 18 U.S.C. § 2232 for triggering GrapheneOS duress password at Atlanta airport on January 24, 2025
- Duress password is a GrapheneOS feature that irreversibly wipes a phone when a second code is entered
- CBP conducted warrantless search citing border exception; Tunick denied counsel and Miranda rights
- First known U.S. criminal prosecution involving duress password technology
- Federal judge expected to rule on suppression motion by end of October
What Is a Duress Password?
A duress password is a second unlock code you set up alongside your regular one. Enter the real PIN and your phone opens normally. Enter the duress code and the device performs an immediate, irreversible wipe—deleting the encryption keys (the mathematical locks that scramble your data and make it unreadable to anyone without the right code) and leaving the phone as blank as the day it left the factory.
The feature lives inside GrapheneOS, a privacy-hardened version of Android built exclusively for Google Pixel phones. GrapheneOS added the duress PIN in June 2024, targeting precisely this kind of scenario: someone physically forced to hand over a device.
This isn't academic. Edward Snowden stated he uses GrapheneOS daily and tweeted about it on November 4, 2022. The OS is built for people who face real surveillance threats.
The Border Search
Customs and Border Protection agents pulled Tunick into a secondary inspection room as he returned from the Dominican Republic and demanded access to his phone without a warrant—under the so-called "border search exception" to the Fourth Amendment, CBP claims the right to inspect devices before a traveler formally enters the country.
Tunick was denied a lawyer, according to his attorneys, and never read his Miranda rights. When he provided a code, the screen went blank, flashed several times, and the phone appeared to restart.
The government's own indictment accuses Tunick of providing "a passcode to border agents that caused the phone to delete its digital contents prior to seizure." Prosecutors frame this as destruction of property. His legal team frames it as activation of a safety mechanism he lawfully installed.
The Legal Road Ahead
Tunick has pleaded not guilty. A federal judge is expected to rule on his motion to suppress no earlier than the end of October.
The case arrives as courts grapple with privacy-focused devices. In 2023, courts encountered the limits of smartphone monitoring when devices running privacy-focused operating systems including GrapheneOS proved resistant to surveillance software installed per a judge's order. This prosecution signals the government's willingness to criminalize the technical tools citizens deploy to resist warrantless searches.
