A US Citizen Was Charged After His GrapheneOS Phone Wiped Itself at the Border. Here Is What the Case Actually Decides.

Sam Tunick returned from the Dominican Republic on January 24, 2025. He walked through Hartsfield-Jackson Atlanta International Airport the way most people do: tired, carrying bags, ready to be home. Federal agents stopped him for secondary screening. They already had his name and photo circulated internally. They already knew what they were looking for. What they were not prepared for was a phone that did exactly what its owner had configured it to do.

When Tunick provided a passcode, his GrapheneOS device wiped itself. The screen went blank, flashed, restarted. Data gone. Now he is charged under a federal statute that criminalizes destroying property to prevent seizure. The case has 982 points on Hacker News and 753 comments, which tells you something: engineers recognize that this case is about something much larger than one man’s phone.

I want to be precise about what this case actually decides, because the internet’s reaction—split between “good for him” and “he’s obviously guilty”—misses the real engineering and legal question underneath.

The Charge Is Not About Security Software. It Is About Intent.

The federal statute at issue makes it a crime to destroy property in an attempt to prevent it from being seized. The word “attempt” is doing enormous work there. It is not illegal to have a phone that wipes on wrong-passcode entry. It is not illegal to configure GrapheneOS with a duress PIN. It is not even illegal to have zero data on your phone when you cross a border. What prosecutors are arguing is that Tunick’s intent, at the moment he entered that passcode, was to destroy evidence in anticipation of seizure.

This is the part that breaks the engineer’s brain. Two phones. Two passcodes. Both are four-digit strings. Both cause the phone to unlock. One produces a working device; the other produces a wiped device. The bits are different, but is the act different? Legally, yes—not because the digits differ, but because of what you were trying to make happen when you typed them.

Cybersecurity expert Seth Schoen, who co-wrote EFF’s border search guide, put the real problem precisely in the HN thread: the big picture issue is not whether the technology is legitimate—it is whether the threat model you built your technical solution around actually helps you once agents with physical custody of your device and authority to deny entry have decided they are interested in you. You can protect your data technically and still anger the agents more than you planned to.

That gap—between “technically legal” and “operationally safe”—is what this case exposes.

What GrapheneOS Actually Does, and Why the Wipe Happened

GrapheneOS is an open-source, hardened Android distribution that runs exclusively on Google Pixel hardware. It is not a fringe piece of malware; it is the result of years of serious security engineering, endorsed by Amnesty International, used by journalists, activists, security researchers, and people who simply take data privacy seriously.

The feature that matters here is duress PIN functionality. GrapheneOS allows users to configure a secondary passcode that, when entered, triggers a secure erasure of the device. “Secure erasure” in this context means destroying the encryption key that protects the device’s storage. Modern Android devices encrypt storage by default; removing the key makes the ciphertext permanently unrecoverable. This is not deletion in the sense of “files you can undelete”—the data is mathematically gone.

The question the court has to answer is whether configuring that feature, and using it, constitutes “destruction of property” in the legal sense. Defense counsel argues the search violated Tunick’s constitutional rights and that evidence should be suppressed. Prosecutors call the wipe intentional destruction of evidence. A ruling is not expected until at least late October 2025.

From an engineering standpoint, the duress wipe is a feature. It exists because there are scenarios—robbery, coercive search, seizure—where you want cryptographic destruction of your data faster than any other option allows. The hardware supports it, the OS implements it, and using it is no more inherently criminal than using a paper shredder before handing files to someone who demands them. Timing and intent are everything.

Border Search Powers Are Not What Most Engineers Think

There is a persistent misconception in technical communities that the Fourth Amendment’s protections against unreasonable search and seizure apply uniformly at US borders. They do not.

Courts have consistently held that border searches—including at international airports—fall under a “border search exception” to the Fourth Amendment. Customs and Border Protection does not need a warrant or probable cause to search your person, baggage, or electronic devices at a port of entry. This has been litigated extensively. The Ninth Circuit in United States v. Cotterman (2013) did require reasonable suspicion for “forensic” searches of devices (deep extraction of data), but basic manual searches remain warrantless. The First Circuit in United States v. Alasaad (2021) upheld the same framework.

The practical result: if you are crossing a US border, CBP agents can ask to search your phone. For non-citizens, refusing is legal grounds for denial of entry. For citizens, refusing means they can seize the device—potentially for months—without charging you with anything. They cannot legally compel you to provide your passcode, but they can make your life extremely complicated if you do not.

Tunick’s lawyers argue agents denied him legal counsel four times during the interrogation—a constitutional violation in its own right. They also argue the search was pretextual: agents said they were looking for child sexual abuse material, but the defense motion states the investigation was actually about Tunick’s political associations with opposition to “Cop City,” a $109 million Atlanta police training facility that has drawn activist opposition since 2022. Whether that pretext argument succeeds will depend heavily on what the suppression hearing reveals.

The International Pattern: GrapheneOS Is Already Being Profiled

The Atlanta case is not an isolated data point. In Catalonia, Spain, police have been systematically profiling people who carry Google Pixel phones, on the assumption that the phones run GrapheneOS and that GrapheneOS users are drug dealers or gang members. Christophe Boutry, a cybersecurity and surveillance expert cited in the TechSpot reporting, flagged this directly: authorities are treating possession of GrapheneOS as evidence of intent to hide criminal activity.

This creates a perverse dynamic. The harder your phone is to search, the more suspicious you appear. The more suspicious you appear, the more likely you are to be searched. The more you resist or fail to cooperate with the search, the more suspicious you become. It is a reinforcing loop that punishes technical competence and privacy hygiene.

The Chaos Computer Club’s documented recommendation—don’t travel to the US; if you must, use a clean device with only what you need—tells you the German security research community has already concluded that the US border is not a safe place to carry a device with real data on it.

The Threat Model Failure No One Wants to Discuss

I have spent time with the GrapheneOS documentation and with the EFF border search guide, and I want to be direct about something the technical community keeps dancing around: the duress wipe is the wrong tool for border crossings, and using it when agents are watching is not a clever technical move—it is a legal liability.

Here is the problem. The duress PIN was designed for a scenario where you are being robbed or coerced and you want to destroy data before the adversary can access it. In that scenario, the adversary has no legal standing to accuse you of evidence destruction. They are a criminal. Their ability to take your phone is already illegal.

A border search is legally different. CBP agents have statutory authority to inspect devices. The moment you enter a passcode in their presence, in response to their request, and the device wipes—you have handed them a story. Their story is: you intentionally destroyed evidence during a lawful inspection. That story is extremely hard to disprove regardless of what the actual correct technical sequence of events was.

The correct threat model for border crossing is: don’t carry data you don’t want searched. Wipe before travel. Use a travel profile. Restore from encrypted cloud backup when you arrive. Don’t create a situation where you are entering a passcode in front of federal agents while a data destruction sequence runs.

This is not victim-blaming. Tunick’s constitutional rights appear to have been violated in several ways. But technical correctness and operational safety are different axes, and conflating them gets people prosecuted.

What the Defense’s Best Argument Actually Is

The defense has three plausible avenues, in rough order of strength.

First: the search itself was unconstitutional. If agents denied Tunick counsel four times and conducted a warrantless search based on political targeting rather than any genuine customs purpose, the suppression motion could succeed and eliminate the evidentiary foundation for the entire case. This is the strongest argument because it does not require winning on the merits of the device-wipe charge.

Second: the government cannot prove intent beyond a reasonable doubt. “Intent” is not binary, and the government has to prove Tunick knew the passcode would trigger a wipe and entered it for that purpose. GrapheneOS’s duress PIN requires deliberate setup—it is not a default feature. But proving he entered the duress PIN intentionally, rather than mistyping his real passcode under stress during a high-pressure interrogation after an international flight, is harder than it sounds. Duress and confusion create reasonable doubt.

Third: the statute does not apply to an operating system feature. The property-destruction statute was written to cover physical destruction of objects, not the operation of software features on legally owned devices. This is a creative argument and probably the weakest of the three, but it is the argument that would create precedent. If a court rules that deliberately activating a security feature constitutes evidence destruction, every full-device encryption and automatic wipe feature in every operating system becomes legally suspect.

The Cop City Connection Is Not a Distraction

Every write-up of this case treats the Cop City association as background color. It is not. It is central to the case’s actual meaning.

The Cop City protests began in 2022 in response to Atlanta’s approval of a $109 million police training facility in a forested area. Opposition has been sustained, organized, and in some cases disruptive. Protesters have faced state-level RICO charges—charges that have largely collapsed at trial. Federal prosecutors stepped in after state prosecution struggles, with a separate federal indictment announced before the airport detention.

The defense motion states that the interrogation’s actual focus was on Cop City connections, not on child sexual abuse material—which was named as the ostensible justification for the search. If true, this is a significant problem for the government: using border search authority to investigate domestic political activity is a different legal and ethical category than using it to intercept contraband. CBP’s powers are explicitly tied to customs and immigration purposes, not domestic law enforcement investigation.

Whether or not you have any opinion on Cop City, this matters: the precedent this case sets will apply to anyone carrying a hardened phone across a US border who is deemed politically inconvenient. That is not a narrow population.

The Practical Engineering Takeaway

I am going to give you the recommendation I would give any engineer traveling internationally with data worth protecting, because I think it is underspecified in most of the discourse around this case.

Before travel: wipe your device entirely. Not “delete the sensitive files”—full factory reset. Restore from a clean backup that contains only what you need for the trip. Your email client, your travel documents, your maps. Nothing sensitive. This is legal, unambiguous, and creates no duress-wipe liability because there is no data to destroy and you are not doing anything in response to a request from an agent.

At the border: if asked to unlock your device, unlock it. If there is nothing sensitive on it, this costs you nothing. If you do not want to unlock it, do not—understand that for non-citizens this means probable denial of entry, and for citizens it means possible device seizure. Do not enter any passcode in an agent’s presence that does anything other than unlock the device normally.

After arrival: restore sensitive data from encrypted cloud storage using a zero-knowledge provider you trust. Bitwarden, Proton, Tresorit. Ensure the data was never on the device during transit.

The GrapheneOS duress feature is a legitimate security capability. The border is not the threat model it was designed for.

What a Court Ruling Against Tunick Would Actually Mean

If the court rules that Tunick committed evidence destruction by entering a duress PIN, the downstream effects for security engineering are significant.

Every enterprise MDM solution that supports remote wipe would need to be evaluated for this theory. Every iPhone with “erase data after 10 failed attempts” enabled would technically be configured to destroy property upon presentation of ten wrong passcodes. Apple’s implementation of that feature is on by default. The chain of reasoning that convicts Tunick—deliberate configuration of software to destroy data in anticipation of unauthorized access—applies to every device with this feature, including ones that hundreds of millions of people carry.

Prosecutors would likely argue that intent distinguishes Tunick’s case from iPhones in grandmothers’ purses. That is probably right as a matter of prosecutorial discretion. But it is not right as a matter of law. And it creates a world where the existence of duress and auto-wipe functionality is treated as circumstantial evidence of criminal intent, which is where Spain is already headed in practice.

The EFF and the Electronic Privacy Information Center will almost certainly file amicus briefs if this case proceeds to trial. The outcome will be one of the most significant legal statements about device security and border search authority in the past decade. The ruling expected in late October 2025 on the suppression motion will tell us a lot about whether it gets that far.

Predictions

The suppression motion will succeed on at least the Fourth Amendment denial-of-counsel grounds, and the case will be substantially weakened before it reaches trial. If it reaches trial, the government will not get a conviction on the device-wipe charge specifically—”intent” is too hard to prove when the duress-PIN sequence is indistinguishable from a mistyped passcode without forensic evidence of prior deliberate configuration. The political investigation angle, if the defense can establish it, will likely generate enough judicial skepticism to produce either dismissal or acquittal.

The longer-term prediction: Congress will attempt to pass legislation explicitly requiring device-unlock cooperation at borders, motivated by this case and similar ones, and will fail due to the same Fourth and Fifth Amendment objections that have defeated previous attempts. The border search exception will remain legally contested for another decade. Security-conscious travelers will increasingly follow the CCC model: clean device in, clean device out, no exceptions.

What will not happen: GrapheneOS will not add a warning that says “do not use this feature at borders.” It is correct not to. The feature is legitimate. The threat model mismatch is the user’s responsibility to understand. That is uncomfortable to say, but it is true, and the alternative—building security tools around the assumption that the government is always trustworthy—is not a serious engineering position.

The Technical Architecture of GrapheneOS Security — What Agents Actually Encounter

To understand why this case is technically unusual, it helps to understand what happens at the hardware and software level when a GrapheneOS device triggers a wipe.

Android devices since Android 6.0 have used file-based encryption (FBE), where different keys protect different classes of data. GrapheneOS implements this with additional hardening: the encryption keys are derived from both the user’s passcode and hardware-backed secrets stored in the device’s Titan M security chip (in Pixel devices). When the duress wipe executes, it does not “delete files” in the traditional sense—it destroys the key material in the Titan M chip, rendering the encrypted storage permanently inaccessible.

This is important for the legal analysis. The data is not “hidden” or “temporarily inaccessible.” It is gone in the same sense that data is gone when you physically destroy a hard drive. No court order can undo it. No forensic tool can recover it. The encryption mathematics are irreversible. Prosecutors treating this as “property destruction” are technically correct in that sense: the informational content of the device is gone, and it cannot be returned.

The defense argument that “the screen just went blank and restarted” is almost certainly true as a description of observable events. From the agents’ perspective, they saw a phone restart. They did not see keys being destroyed in a secure enclave. The visible behavior was indistinguishable from a routine reboot. This matters because their inference—that Tunick “deliberately wiped” the phone—is based on knowledge of GrapheneOS’s capabilities combined with the fact of data loss, not direct observation of any deliberate act.

What the government likely has is: evidence that Tunick ran GrapheneOS (they can identify the OS from its fingerprint), knowledge that GrapheneOS supports duress PINs, and the fact that data was lost after passcode entry. Whether they can prove he had a duress PIN configured, and that he entered it intentionally, is the evidentiary question the trial would have to answer.

Historical Context: When Using Security Software Became Suspicious

The pattern of treating security software as inherently suspicious has a long history in law enforcement, and it has never produced good outcomes for civil liberties.

In the 1990s, Phil Zimmermann created PGP—Pretty Good Privacy—a program for encrypting email. The US government classified PGP as a “munition” subject to export controls, on the theory that strong encryption in civilian hands was a threat to national security. Zimmermann was investigated for three years for exporting PGP by publishing its source code as a book (books being exempt from export restrictions). The investigation was eventually dropped. PGP became the basis for essentially all modern encrypted communication.

In the 2000s and 2010s, law enforcement consistently argued that TrueCrypt, VeraCrypt, and similar disk encryption tools were presumptive evidence of data-hiding and criminal intent. The Department of Justice repeatedly sought court orders compelling defendants to decrypt their devices. Courts split: the Eleventh Circuit, in United States v. Doe (2012), ruled that compelling decryption violated the Fifth Amendment privilege against self-incrimination. Other circuits reached different conclusions. The law remains unsettled.

The GrapheneOS case follows this pattern precisely. A tool built for legitimate security purposes—used by journalists, dissidents, security researchers, and anyone who takes data privacy seriously—is being framed as evidence of criminal intent based on its use in a context the government finds inconvenient. The tool’s legitimacy is not in dispute. Its use at a specific moment, for a specific purpose, is what prosecutors are building a case around.

The outcome of this case will likely set precedent that affects millions of people who carry privacy-hardened phones without ever thinking about border search law.

The Fifth Amendment Dimension

There is a separate constitutional angle that has not received enough attention in the public discourse: whether compelling someone to provide a passcode that unlocks (or, in this case, wipes) their phone violates the Fifth Amendment privilege against self-incrimination.

The Fifth Amendment provides that no person “shall be compelled in any criminal case to be a witness against himself.” Courts have distinguished between “testimonial” acts, which are protected, and “physical” acts, which are not. Providing a key to a locked box is generally physical and not protected. But providing the combination to a combination lock has been treated as testimonial, because it requires disclosing something known only to the defendant.

The Supreme Court has not directly ruled on passcode compulsion. Lower courts have split. The general rule that has emerged is the “foregone conclusion” doctrine: if the government already knows the passcode exists, knows the defendant knows it, and can independently establish what the encrypted storage contains, then compelling the passcode is not testimonial—it adds no new information. If the government is fishing—if they need the passcode to even discover what the phone contains—then compelling it is unconstitutional.

In Tunick’s case, there is a paradox: the device wiped, so there is no longer any content the government could seek to access by compelling a passcode. The Fifth Amendment passcode issue is somewhat mooted by the wipe having already occurred. But if the government had simply seized the device without asking Tunick to unlock it and later sought a court order compelling the passcode, the Fifth Amendment analysis would be directly on point. That is the legal world most security engineers building hardened devices need to understand.

What Engineers Should Know About Designing for Adversarial Border Crossings

I want to shift from legal analysis to practical engineering, because the HN thread had a lot of creative suggestions that ranged from reasonable to legally problematic, and I have opinions about which is which.

Duress PIN that loads a clean profile: This is the most commonly suggested alternative to a full wipe. GrapheneOS supports multiple user profiles. A duress PIN could unlock the device into an empty secondary profile, presenting a clean phone without erasing the primary data. The problem: if you are asked whether this is your primary account and you lie, that is potentially obstruction or false statements to federal agents—18 U.S.C. § 1001, which carries up to five years. Seth Schoen’s border search guide noted this issue explicitly: deception in response to agent questions is legally distinct from refusing to answer them. Silence is protected; lies are not.

Full wipe before travel: Legal, unambiguous, and the most operationally sound approach. You are not responding to any agent’s request—you wiped the phone a week ago. There is nothing suspicious about it. The only downside is the operational overhead of restoring from a clean backup, which for a well-organized self-hosting setup is roughly an hour of work.

Burner phone: Popular advice in the thread and widely practiced in the security research community. Buy a cheap Android device, set it up with a fresh account, carry only what you need for the trip. The risk is that it looks like a burner—no photos, no long chat history, no browser history—which can itself trigger suspicion. A device that has been used for two years looks different from a device activated last week. Border agents are trained to notice this. The risk is lower than carrying a full device, but it is not zero.

Travel profile on primary device: Some users maintain a secondary GrapheneOS profile that contains only travel-relevant data. Before crossing, they switch to the travel profile and disable the primary. This is similar to the burner approach but on a single device. The same concerns about “blank-looking phone” apply, and there is an additional risk: if the primary profile is somehow discoverable by forensic tools, having it disabled but present is worse than not having it at all.

Cloud-only approach: No sensitive data on the device; all data accessed via zero-knowledge cloud services with strong authentication. The risk: CBP has explicitly asked travelers for cloud service credentials and social media passwords. Whether they can legally compel this for citizens is unclear. They can compel non-citizens by denying entry. For citizens, the Fifth Amendment analysis on password compulsion applies here as well, and is similarly unsettled.

The honest answer is that there is no fully safe technical solution once you are in secondary screening with agents who are specifically interested in what is on your device. The safe solution is not being in that situation, which requires either not crossing the border with data worth protecting, or building operational habits where the device you cross with genuinely does not contain what they are looking for.

The Cop City Context, in More Detail

The Cop City opposition movement deserves more explanation than most tech coverage provides, because understanding it is understanding why Tunick’s phone was interesting to federal agents in the first place.

The Atlanta Public Safety Training Center—universally called “Cop City” by opponents—was approved by Atlanta City Council in 2021 and is located in a forested area of Dekalb County. The $109 million facility, funded partly by a nonprofit connected to Atlanta’s corporate community, is designed to train police and fire personnel. Opposition formed around two concerns: environmental impact on the South River Forest, and political concern about police militarization.

The protest movement became legally significant in September 2023, when Georgia prosecutors charged 61 people under the state RICO statute, alleging a criminal conspiracy to damage the construction site. The RICO indictment included activists, a legal observer, and a bail fund organizer—people whose presence at protests or support for those present was alleged to be part of the conspiracy. This was widely criticized as an attempt to use organized crime statutes to suppress political dissent. The prosecution has largely struggled; charges against many defendants were dropped or reduced.

Federal prosecutors announced a separate indictment in June 2025—weeks before Tunick’s airport detention—related to the same movement. The defense motion’s allegation that Tunick’s interrogation focused on Cop City connections rather than CSAM fits a pattern of federal law enforcement continuing pressure on the movement after state prosecutions faltered.

None of this makes any of the alleged activities legal. It does explain why federal agents had Tunick’s name and photo circulated before his flight landed, and it contextualizes the interrogation’s actual focus. Border search authority is legally justified by customs and immigration purposes; using it to advance a domestic political investigation is a different thing, and that distinction matters for the suppression analysis.

Why This Is a Security Engineering Problem, Not Just a Legal One

The security engineering community tends to treat legal problems as someone else’s problem. Build the tool, document it correctly, let users decide how to use it. That is not entirely wrong—engineers should not be in the business of watering down security capabilities because some governments find them inconvenient—but it does create a gap between what a tool can do and what users understand about when they should deploy it.

GrapheneOS documentation is technically excellent. It is not a threat-model tutorial. It does not tell users: “the duress PIN is designed for physical coercion by non-state actors, not for border crossings by US law enforcement, and using it in the latter context is legally risky.” That gap is now filled by a federal prosecution that will teach the lesson much more expensively than documentation would have.

I am not suggesting GrapheneOS add legal disclaimers—that is not the project’s job, and it would set a terrible precedent for security tooling to come pre-caveated with government-approved use cases. What I am suggesting is that the security community needs to do more work on threat-model education that is specific to different adversary classes: your phone’s security model against a phone thief is different from its security model against an employer-issued MDM, which is different from its security model against a state actor with physical custody and legal authority. The technical primitives are the same in all three cases; the operational decisions are completely different.

Tunick used the right technology. He used it against the wrong adversary, at the wrong moment, with no apparent understanding of how the legal consequences would unfold. The prosecution may ultimately fail—I think it probably will—but he is facing federal charges because of a mismatch between a tool’s threat model and its deployment context. That is a security engineering failure of a different kind, and the community bears some responsibility for not making that distinction clearer.