A US federal prosecution now under way is believed to be the first of its kind, targeting an Atlanta resident accused of wiping his phone using a built-in duress passcode as border agents searched it.
Samuel Tunick was stopped for a secondary inspection at Atlanta's Hartsfield-Jackson airport in January 2025, returning from a holiday abroad. Prosecutors allege that when he handed over a passcode to agents, it triggered a factory reset rather than unlocking the device.
How a Duress Passcode Triggered a Factory Reset
Tunick's phone ran GrapheneOS, a privacy-focused operating system that runs on Google Pixel devices in place of standard Android software.
The system includes a feature allowing users to set a separate passcode that wipes the phone's contents if entered instead of the normal unlock code.
According to a motion filed by Tunick's federal public defenders, when agents entered the code, the screen went blank, flashed several times and the phone appeared to restart.
Agents seized the device anyway before telling Tunick he was free to enter the country.
The motion further alleges Tunick was repeatedly denied access to a lawyer and was not read his rights during the interrogation, which his defence team says focused first on unrelated questions before turning to his ties to the movement opposing Atlanta's police training facility, known as Cop City.
A federal court in Atlanta is expected to rule on the motion to suppress evidence later this year.
First known US case: American charged for using a “duress” password
— Smartphones sans Google (GAFAM) (@Sans_Google) July 25, 2026
Samuel Tunick, an Atlanta resident, is being prosecuted for allegedly giving border agents a passcode that wiped his phone.
The feature comes from GrapheneOS, a privacy-focused Android OS. Entering the duress…
The Obscure Federal Law at the Centre of the Case
Prosecutors have charged Tunick under a federal law making it an offence to knowingly destroy property to prevent its lawful seizure. He has pleaded not guilty.
Matthew Dodge, an assistant federal public defender on Tunick's team, described the use of the statute in this context as incredibly rare.
Security experts said they were unaware of any prior case built around a duress password in this way. Runa Sandvik, founder of security consultancy Granitt, said she had not seen this before, though she had discussed the potential scenario with activists and journalists over the years.
The case also raises unresolved questions about which constitutional protections apply at international borders, where the US government has long argued that arriving travellers are not yet legally on US soil until permitted entry.
A Pattern Already Emerging in Europe
The case has also drawn attention beyond the US. Christophe Boutry, a cybersecurity and surveillance expert based in France, said Tunick's prosecution echoes a pattern already playing out in France and Spain, where authorities have struggled to access the phones of journalists, lawyers and political opponents running GrapheneOS.
Boutry argued the operating system's purpose cuts the other way. He said the phones belong to users and the state cannot dictate how they are used, adding that its core purpose is protecting user privacy.
Marlon Kautz of the Atlanta Solidarity Fund framed the case in terms of a broader right to digital security. He said everyone has a right to secure private data against unconstitutional searches, adding that this matters even more at a moment of growing authoritarianism.
Spoke to @zackwhittaker about the case of U.S. federal prosecutors going after an American for allegedly wiping his phone with a duress password during a border search. First case I've seen, though I've discussed the potential scenario with at-risk folks. https://t.co/WMlzWQvI5J
— Runa Sandvik (@runasand) July 25, 2026
What It Means for Everyday Phone Users
While the case stems from a protest movement, its outcome could carry consequences well beyond activism. Duress passcodes and similar wipe features exist on several privacy-focused platforms precisely because standard border searches can compel travellers to unlock devices containing sensitive personal, financial or professional data.
Sandvik advised that travellers concerned about border searches should consider leaving sensitive data off a device entirely before crossing, rather than relying on wipe features once questioned. She said that with a little planning ahead of time, travellers can always download the data they need once they get to where they are going.
Should prosecutors succeed in this case, legal experts and privacy advocates suggest it could establish a precedent that discourages the use of built-in privacy protections at ports of entry, regardless of a traveller's political activity.
A ruling against Tunick could set a precedent affecting millions of travellers who rely on these privacy tools, not just activists. Given how widely duress-password and remote-wipe features are marketed by manufacturers as standard security measures, a precedent here would extend well beyond this single case, into how any traveller manages personal data at ports of entry.
