GrapheneOS tells feds to 🧅-peel off: duress-password case heads to court

GrapheneOS said its privacy-focused smartphone operating system is "completely legal" and constitutionally protected as the first U.S. prosecution tied to one of its features moves through the federal courts. The project, which markets its hardened Android fork as an alternative to stock mobile operating systems, said on July 27 it "has no obligation to weaken any of the security protections it provides" and that any law requiring it to do so "would be unconstitutional." Once key material is wiped, "there's nothing we can do to assist with it," the project wrote, adding that bypassing the operating system's encryption is "not possible" by design.

The case centers on Samuel Tunick, an Atlanta activist charged under 18 U.S.C. § 2232 after he allegedly entered a duress code that wiped his Google Pixel during a warrantless border search at Atlanta's Hartsfield-Jackson airport on January 24, 2025. Tunick has pleaded not guilty and faces up to five years in federal prison. A judge is expected to rule on his motion to suppress no earlier than the end of October. The charge, which makes it illegal to knowingly destroy property to prevent authorities from seizing it, is "extraordinarily rare," according to Tunick's federal public defender, Matthew Dodge, who said he found only one other prosecution under the statute, in a drug trafficking investigation.

Dodge said Department of Homeland Security officers called ahead to the airport and asked that Tunick be stopped and his phone searched. Agents searched his bags and person over his objections and found nothing, Dodge said, and could have sought a warrant. "They didn't do that," he said. Tunick told 404 Media the case is aimed at deterring others, describing the charges as "meant to intimidate people against protecting their data" and arguing the government "hopes to set a precedent that no one has the right to privacy." He said he was subjected to a year of surveillance before the indictment, including a tracker on his car and subpoenas for his phone records and Gmail account.

A Customs and Border Protection spokesperson told 404 Media that all travelers are subject to inspection, that searches of electronic devices are rare, and that each search is decided case by case, taking account of travel history and law enforcement alerts. The U.S. Attorney's Office declined to comment. GrapheneOS added the duress PIN feature in June 2024, allowing users to configure a separate code that, when entered, erases device data and keys.

The outcome of the motion to suppress, and any subsequent trial, will determine whether duress features on GrapheneOS and comparable systems remain a legally defensible privacy tool or become evidence in prosecutions under existing property-destruction statutes.