The United States government is prosecuting American citizen Sam Tunick for allegedly providing authorities with a 'duress password' that erased his phone when they attempted to seize it at Atlanta's Hartsfield-Jackson International Airport on January 24th, 2025. This case, which draws attention to the tension between national security and personal privacy, centers on an obscure statute concerning the destruction of property to prevent seizure.

Background of the Case

According to court filings, federal agents detained Tunick at the airport and began questioning him about child exploitation images. However, Tunick's legal team has filed a motion arguing that this line of questioning was merely a pretext for a broader investigation into his connections to the Stop Cop City movement in Atlanta, a grassroots campaign opposing the construction of a police training facility in a local forest. The defense contends that the detention was unlawful and that any evidence obtained should be excluded.

The government alleges that Tunick used a feature of GrapheneOS, a privacy-focused operating system designed to provide enhanced security and anonymity on smartphones. GrapheneOS includes a 'duress password' feature that, when entered, wipes the device and reverts it to factory settings. Tunick is accused of providing this duress password to border agents instead of his actual passcode, thereby destroying the phone's data and obstructing the seizure.

Legal Framework and Rarely Used Statute

The prosecution relies on a little-known and rarely used federal statute that makes it illegal to destroy or damage property to prevent authorities from lawfully seizing it. This statute is typically invoked in cases involving destruction of evidence during a criminal investigation, but its application in a border context is highly unusual. Legal experts note that the government is pushing boundaries in an area where case law remains sparse.

Tunick's attorneys argue that the detention and attempted seizure were themselves unlawful. They claim that agents refused Tunick access to a lawyer, did not produce a warrant, and failed to inform him of his legal rights. The government counters that because Tunick had not yet been granted permission to enter the United States—he was returning from international travel—they were not required to adhere to the usual procedural requirements. This argument highlights a longstanding legal gray area regarding the Fourth Amendment rights of individuals at border entry points.

Border Searches and Privacy Rights

The U.S. border is often considered a constitutional exception zone where warrantless searches are permitted under the 'border search exception' doctrine. However, the scope of that exception has been hotly debated, particularly with the rise of digital devices that can contain vast amounts of personal data. Courts have grappled with whether border agents can force travelers to provide passwords or biometric information to unlock devices, and whether the same rules apply to U.S. citizens as to foreign nationals.

In recent years, American Civil Liberties Union (ACLU) and other advocacy groups have filed lawsuits challenging warrantless searches of electronic devices at the border. Some courts have ruled that reasonable suspicion is required before agents can conduct a forensic search of a device, while others have allowed more leeway. The Tunick case could set a significant precedent if it reaches higher courts, particularly regarding the legality of duress password systems and the right to protect one's data from government scrutiny.

GrapheneOS and Duress Passwords

GrapheneOS is an open-source operating system that prioritizes privacy and security, often used by journalists, activists, and individuals concerned about surveillance. Its duress password feature allows the device to appear to function normally but actually erases sensitive data automatically when a specific password is entered. This tool is designed to protect users in situations where they are coerced into revealing their device credentials.

Marlon Kautz, a member of the Atlanta Solidarity Fund, told The Guardian that 'we all have a right to secure our private data against unconstitutional searches. And we should—especially in a time of rising authoritarianism.' This sentiment underscores a growing unease among privacy advocates about the expanding surveillance powers of border authorities under the current administration. During the Trump presidency, entering the U.S. became increasingly fraught, even for citizens, who could face hours-long detentions and requests to unlock devices for inspection of social media accounts.

Broader Implications for Digital Rights

The case against Sam Tunick is emblematic of broader conflicts between state security measures and individual privacy rights. As encryption and privacy-enhancing technologies become more widespread, governments around the world are seeking ways to access encrypted data. The use of duress passwords is one technique that allows individuals to comply with a demand for a password while still protecting their data. However, the prosecution suggests that such behavior can be deemed criminal if it thwarts a government seizure.

Legal observers note that the application of this statute in the border context could have a chilling effect on the use of privacy tools by travelers. If merely having a duress password on your phone can lead to criminal charges, it might deter people from adopting security measures that are essential for protecting sensitive information, such as trade secrets, confidential work documents, or personal communications.

Historical Context of Border Device Searches

The practice of searching electronic devices at the border has grown exponentially since the September 11, 2001 attacks. In 2017, the Department of Homeland Security (DHS) issued a directive allowing border agents to inspect electronic devices without a warrant, leading to thousands of searches each year. Data from U.S. Customs and Border Protection (CBP) shows that over 30,000 device searches were conducted in fiscal year 2018, though the number has fluctuated in subsequent years.

Courts have struggled to balance the government's interest in preventing crime and terrorism with the Fourth Amendment's protection against unreasonable searches and seizures. In 2013, a federal appeals court held that border agents could not search a traveler's laptop without reasonable suspicion, but the Supreme Court has not definitively ruled on the issue. The Tunick case could provide the impetus for a definitive ruling if it reaches the Supreme Court.

Arguments from Both Sides

The defense has framed the government's actions as an overreach. In a motion filed by Tunick's lawyers, they argue that the agents lacked any specific reason to suspect Tunick of wrongdoing related to the alleged child exploitation images. Instead, they claim the interrogation was a pretext to explore his ties to the Stop Cop City movement, which has been a target of surveillance by law enforcement. The defense points out that Tunick was not read his Miranda rights, and was denied access to counsel despite multiple requests.

Moreover, the defense contends that the duress password feature is a legitimate security measure designed to protect data in coercive situations. They argue that Tunick complied with the agents' demand to provide a password; he merely provided a password that automatically performed a function he had set beforehand. The government's argument, they say, criminalizes the very act of using a privacy tool that is legal to possess.

On the other side, prosecutors assert that Tunick's actions were deliberate and aimed at destroying evidence relevant to an ongoing investigation. They claim that the agents had probable cause to suspect Tunick of possessing illegal materials, based on unspecified leads. The government also argues that the border search exception applies fully, and that Tunick's failure to grant access to his device after being instructed to do so constitutes obstruction.

Reactions from Civil Liberties Organizations

Civil liberties groups have closely watched the case. The Electronic Frontier Foundation (EFF) issued a statement calling the prosecution 'an alarming attack on the right to secure our digital devices.' They point out that the statute being used was originally designed for tangible evidence like paper documents or physical objects, not encrypted data that can be protected with a duress password.

The ACLU has also weighed in, noting that if the government's position is accepted, it could criminalize the use of encryption and security tools that millions of Americans rely on. 'Every traveler would be at risk of prosecution simply for using a VPN, encrypted messaging app, or privacy-focused operating system,' said an ACLU lawyer in a press release.

Some civil libertarians have drawn parallels to the case of Siddiqui, a U.S. resident who was detained for refusing to unlock his phone at the border, though that case ended without charges. The Tunick case appears to be the first time a traveler has been charged with destruction of property for wiping a device at the border.

Technical Details of GrapheneOS Duress Password

To understand the technical aspect, GrapheneOS is a security-hardened version of Android that removes proprietary code and adds robust privacy features. The duress password function is implemented as a separate user profile that appears empty or is configured to immediately wipe itself. When the duress password is entered, the system logs out of the primary user profile or triggers a factory reset, depending on the user settings. This process is designed to be irreversible, ensuring that no data can be recovered after the duress password is used.

Forensic experts note that even if the device had been seized before the wipe, standard forensics might not be able to recover the erased data due to the encryption used in GrapheneOS. This makes the duress password an effective tool for individuals who fear their devices could be seized under duress. However, the government argues that Tunick's use of this feature was not an innocent act but an intentional effort to hinder an investigation.

Potential Outcomes and Precedent

The case is currently in the early stages of litigation. Judge scheduled a hearing for early August to argue motions to suppress evidence and dismiss charges. If the defense succeeds in having the evidence suppressed, the government may drop the charges. If the case proceeds, it could lead to a landmark ruling defining the legality of duress passwords at borders.

Legal scholars suggest that the ultimate outcome may hinge on whether the court finds that the initial detention was lawful. If the detention was unlawful, any subsequent actions—including the demand for a password—may be invalidated. Conversely, if the court upholds the detention as legal under border exception doctrine, Tunick could face a tougher path.

The case also comes at a time when the Department of Justice is increasingly pursuing charges related to digital privacy, such as the recent prosecution of a man for refusing to unlock his phone for the FBI. This trend has alarmed privacy advocates who see it as part of a broader assault on encryption.

Importance for Tech Community

Tech companies have remained largely silent on the case, but privacy-focused organizations like the Free Software Foundation and the Open Privacy Initiative have voiced support for Tunick. They argue that if using a duress password is criminalized, it could set a dangerous precedent that would undermine the trust users place in security tools.

Apple, which has long championed user privacy, may watch this case carefully as it could affect the viability of similar features in its operating systems. Apple's iOS does not currently have a duress password feature, but the company has implemented other privacy tools like Face ID that can be quickly disabled. The outcome could influence future product designs.

Public Reaction and Social Media

On social media, the case has sparked intense debate. Some users argue that Tunick should have cooperated fully with border agents, while others see his actions as a legitimate exercise of his rights. The hashtag StandWithSam has been trending on Twitter, and a crowdfunding campaign to support his legal fees has raised over $100,000.

The Stop Cop City movement itself has also rallied behind Tunick, viewing the prosecution as an attempt to intimidate activists. A spokesperson for the movement said, 'This is not just about one phone. It's about the government trying to send a message that they can reach into our pockets at any time.'

As the legal proceedings unfold, the case will likely continue to attract national attention. It touches on fundamental questions about privacy, security, and the limits of government power in the digital age. The next few months will be critical in determining whether individuals can truly protect their data when crossing international borders.

Source: The Verge News