GrapheneOS, a privacy-focused Android operating system, is at the center of a controversial legal case that could have broad implications for digital privacy. A US man, Samuel Tunick, is being prosecuted after he allegedly used the system's duress PIN feature to wipe his Google Pixel phone during a border search at Atlanta's Hartsfield-Jackson airport in January 2025. The case, reported by The Guardian, marks the first known instance where a duress PIN has become the crux of a criminal charge, testing the boundaries of privacy protections and government seizure laws.
What is a duress PIN?
GrapheneOS offers a unique security feature called a duress PIN or password. Unlike a standard lock screen code, a duress PIN is designed to be used under coercion, such as when someone is forced to unlock their device by a mugger or law enforcement. When entered, it performs a factory reset or wipe of the device, deleting all user data and restoring the phone to its original state. No confirmation prompt or visual clue indicates that a duress PIN has been used, making it indistinguishable from a normal unlock attempt to an observer.
The feature is part of GrapheneOS's broader commitment to user privacy, which includes hardened memory allocation, improved exploit mitigations, and strict control over network access. The duress PIN is particularly aimed at protecting sensitive information in high-risk scenarios, such as for journalists, activists, or individuals crossing borders with authoritarian governments.
The incident at Atlanta airport
According to court documents, Tunick was returning from the Dominican Republic on January 27, 2025, when he was stopped by US Customs and Border Protection (CBP) officers at Atlanta's Hartsfield-Jackson International Airport. The officers demanded access to his Google Pixel phone, which he was running with GrapheneOS. When asked for the passcode, Tunick allegedly entered a duress PIN, which immediately wiped the device. The screen reportedly went blank, flashed several times, and then the phone appeared to restart, as described by his attorneys.
The indictment charges Tunick under a federal law that prohibits the destruction of property to prevent its seizure. The government argues that by knowingly wiping the phone, Tunick obstructed the lawful search and seizure of evidence. His legal team, however, contends that the search was illegal from the start. They claim that border agents repeatedly denied his requests to speak with a lawyer, did not read him his Miranda rights, and used the search as a pretext to investigate his alleged connections to the movement opposing the Atlanta police training center, known as Cop City.
Legal and privacy implications
This case raises several pressing legal questions. Under US law, border searches are considered a narrow exception to the Fourth Amendment's requirement for a warrant. Courts have generally allowed searches of electronic devices at the border without individualized suspicion, but the scope and permissibility of such searches are still debated. The use of a duress PIN complicates matters because it is a security feature designed for coercion, not for obstructing justice. Defense attorneys argue that Tunick acted reasonably under the circumstances, as he believed the search was unlawful and was simply protecting his privacy.
Digital privacy experts are closely watching the proceedings. If the court rules against Tunick, it could set a precedent that using a duress PIN or similar privacy-preserving tools during a government search is considered criminal destruction of evidence. Conversely, a ruling in his favor could reinforce the notion that individuals have the right to protect their data even at the border, especially when law enforcement does not follow proper procedures.
The case also highlights the tension between security features and legal compliance. GrapheneOS's duress PIN is widely praised for protecting victims of theft or coercion, but its use with state actors is uncharted territory. In 2023, a similar scenario played out in the UK when a police officer forced a suspect to unlock his phone by holding it to his face—a biometric unlock that the court later deemed unlawful. The duress PIN, being a deliberate action by the user, may be viewed differently.
Background on GrapheneOS and its user base
GrapheneOS is an open-source, privacy and security-focused Android-based operating system developed by Daniel Micay and the GrapheneOS team. It is designed for users who require maximum security, such as journalists, activists, and individuals in high-risk environments. Unlike mainstream Android, GrapheneOS removes Google Play Services by default, uses verified boot, and includes features like the duress PIN, network permission toggle, and storage scoping. It has gained a reputation as one of the most secure mobile operating systems available.
The duress PIN, in particular, has been marketed as a lifesaver for those in dangerous situations. For example, a journalist covering protests could use the PIN if forced by police to unlock their phone, preventing access to sensitive sources or materials. However, the lack of any confirmation prompt means that once entered, the data is gone forever—no backups, no recovery. This irreversibility is intended to deter attackers, but it also means that users must be absolutely certain they want to wipe the device.
The charges and potential defenses
The specific law cited in the indictment, 18 U.S.C. § 2232(a), makes it a crime to destroy or damage any property to prevent its seizure, with penalties including fines and up to five years in prison. Tunick's attorneys are challenging both the legality of the initial search and the applicability of the law to a duress PIN. They argue that the government cannot prove that Tunick acted with the intent to prevent seizure, as he was under duress from the officers' alleged threats. Moreover, they claim that the duress PIN is a standard security feature, not a tool specifically designed to thwart law enforcement.
Another key issue is the question of consent. CBP officers do not need a warrant at the border, but they still require consent to search a device in some circumstances—especially if the traveler is not a US citizen. Tunick is a US citizen, and his lawyers argue that the repeated demands for access without a warrant constituted an unreasonable seizure. They also point out that the officers' questions about child sexual abuse material were a pretext to investigate his political activism against Cop City, suggesting a violation of his First Amendment rights.
A judge is expected to rule on the motion to suppress evidence by late October 2026. Until then, the case remains a focal point for privacy advocates, legal scholars, and technology users concerned about the balance between security and government power. The outcome could influence how other manufacturers design lock screen features or how law enforcement agencies approach device searches.
Experts note that the case is reminiscent of earlier disputes over encryption, such as the FBI's fight with Apple over unlocking the San Bernardino shooter's iPhone. But the duress PIN introduces a new twist: it is not about unlocking a device but about triggering a wipe. If prosecutors succeed, they may create a chilling effect on users who rely on privacy tools to protect themselves at borders or in other high-risk situations.
The broader conversation also touches on the concept of 'digital self-defense.' As governments increasingly demand access to digital devices, technologies that allow users to destroy data under coercion are becoming more common. However, they walk a fine line between privacy protection and obstruction of justice. In the United Kingdom, for example, the Investigatory Powers Act requires individuals to provide encryption keys or face jail time—a legal requirement that conflicts with the very purpose of duress PINs. In the US, similar tensions exist with the All Writs Act and other laws.
As the court proceedings unfold, both sides will present expert testimony on the technical and legal aspects of duress PINs. The defense will likely argue that the feature is not illegal but a legitimate tool for protecting privacy, akin to a safe that self-destructs under duress. The prosecution will counter that using such a tool during a lawful search amounts to destroying evidence. The judge's ruling could shape future behaviors: travelers may become reluctant to use duress PINs at borders, or law enforcement may start demanding that PINs be entered in their presence to prevent wipes.
Outside the courtroom, GrapheneOS has not released an official statement, but the community has rallied behind Tunick. Online forums discuss ways to avoid the same fate, such as using multiple user profiles or storing sensitive data in encrypted containers rather than relying on a duress PIN alone. The case also underscores the importance of understanding the legal landscape before using advanced privacy features. What works in one jurisdiction may be a crime in another.
The timeline remains uncertain, but the case is likely to attract amicus briefs from civil liberties organizations like the ACLU and EFF, which have long argued for stronger privacy protections at borders. In the meantime, digital privacy experts recommend that travelers carefully weigh the risks of using duress PINS, especially when crossing international borders. Some suggest leaving sensitive data at home or using cloud-based storage that can be wiped remotely instead.
This is an evolving story, and the outcome will have lasting implications for how we balance privacy and security in an age of ubiquitous surveillance. The use of GrapheneOS's duress PIN may be a test case, but it is not the last. As technology continues to advance, courts will increasingly grapple with the conflict between individual privacy rights and law enforcement's need for evidence. The Tunick case is just the beginning of what promises to be a prolonged legal struggle over the boundaries of digital self-defense.
Source: Android Authority News