First Known US Prosecution for Using a Duress Password to Wipe a Phone at the Border Tests Constitutional Limits

First Known US Prosecution for a Duress Password Tests Constitutional Limits at the Border

Samuel Tunick was returning to the United States through Atlanta's Hartsfield-Jackson airport on January 24, 2025, when Customs and Border Protection agents pulled him into a secondary inspection and asked for his phone's passcode. Tunick gave them one. The phone's screen flashed and went dark. By the time it restarted, the data was gone 1.

His phone was running GrapheneOS, a custom Android operating system for Google Pixel devices. It includes a duress feature: the owner sets a secondary passcode that, when entered instead of the normal unlock code, wipes the device clean 1. The Electronic Frontier Foundation publishes guides recommending that travelers take steps to protect their data before crossing the U.S. border 1.

The Justice Department has charged Tunick under a federal law that bars deliberately destroying property to keep it from being seized by authorities. The case is thought to be the first known prosecution in the United States for destroying data with a duress password built into phone software 1. Prosecuting someone for activating a duress wipe reframes a privacy tool as evidence of a crime. The software exists because people anticipate searches like the one Tunick faced. Under the government's theory, the act of using that protection becomes the offense.

EFF senior staff technologist Bill Budington and Runa Sandvik, founder of the security consultancy Granitt, which advises people facing elevated digital risks, both told TechCrunch they had not encountered charges like these before 1. "I have not seen this before, though I've discussed the potential scenario with activists and journalists over the years," Sandvik said 1. She noted that the prosecution highlights a risk for travelers: if you carry sensitive information, a border agent could accuse you of willfully discarding it. Her advice is to leave sensitive data behind and retrieve it remotely after clearing customs 1.

Border agents maintained that no warrant was required to search his phone, since he had not technically entered the country yet 1. Federal authorities take the position that until someone receives official permission to enter, they need neither a warrant nor a judicial order to search or confiscate electronic devices 1. After the phone wiped itself, authorities seized it anyway and told Tunick he was free to enter the United States 1. The collision is direct: the government says it can search your phone at the border without a warrant, and a duress feature lets you destroy the data before that search succeeds. Tunick's case is where those two positions meet.

Tunick's attorneys have filed a motion to suppress all evidence, arguing the seizure was unlawful. The filing contends that agents blocked him from speaking with a lawyer and failed to advise him of his rights. It alleges that authorities used a child exploitation investigation as a pretext to demand his phone, without any evidence supporting that suspicion. The motion argues the real target was Tunick's association with Defend the Atlanta Forest, an environmental campaign against the construction of a large police training facility in Atlanta, widely known as Cop City 1.

Matthew Dodge, a federal defender representing Tunick, said indictments citing this particular law are exceedingly uncommon 1. Tunick has pleaded not guilty 1. The Justice Department declined to comment when contacted by TechCrunch. The Atlanta court handling Tunick's case will likely decide the suppression motion later this year 1.

The duress password exists because the government can search your phone at the border without a warrant. The DOJ is now prosecuting someone for using the tool built in response to that power. Every traveler who installs a wipe feature for protection is also installing something a prosecutor can present as destruction of evidence. The protection and the crime are the same keystrokes.