GrapheneOS Duress PIN Prosecution: Legal Analysis of United States v. Tunick
Executive Summary
Federal prosecutors charged Samuel Tunick under 18 U.S.C. Section 2232(a) in November 2025 after his GrapheneOS duress PIN wiped his phone during a Customs and Border Protection search.
The indictment is the first known federal case built on a phone’s built in duress feature, a function that erases device contents when a decoy credential is entered instead of the true passcode. Tunick, an Atlanta resident and United States citizen, has pleaded not guilty and moved to suppress the evidence gathered at the airport on January 24, 2025. The case tests three bodies of law at once: the border search exception to the Fourth Amendment, the reach of a destruction of property statute written for physical contraband, and the Fifth Amendment limits on compelling a traveler to disclose a memorized passcode.
Customs and Border Protection agents told Tunick they were searching for child sexual abuse material. His attorneys say the agents had no evidence to support that claim and that the actual interest was Tunick’s association with Defend the Atlanta Forest, the movement opposing construction of the Atlanta Public Safety Training Center. The suppression motion sits inside a circuit split that already divides the Fourth, Ninth, and Eleventh Circuits over how much suspicion a border agent needs before searching a traveler’s device. Because the Northern District of Georgia sits within the Eleventh Circuit, the controlling precedent is United States v. Touset, which permits forensic searches of electronic devices at the border without any suspicion at all. That precedent favors the government on the underlying search. It does not resolve whether a duress PIN, which leaves the physical phone intact while erasing its contents, destroys property under a statute historically applied to smugglers who dumped or scuttled contraband. A ruling is expected later in 2026.
Detailed Findings
The Stop at Hartsfield-Jackson and the Charge
Tunick was returning from a trip to the Dominican Republic on January 24, 2025, when Customs and Border Protection agents pulled him into secondary inspection at Hartsfield-Jackson Atlanta International Airport. Agents told him they did not need a warrant and asked him to open his phone, which ran GrapheneOS, a privacy focused operating system built for Google Pixel hardware. GrapheneOS lets an owner configure a duress PIN in addition to a primary passcode. Entering the duress PIN does not open the phone. It destroys the cryptographic keys that protect the phone’s encrypted data, an act that looks identical from the outside to a phone restarting after a normal passcode entry. Tunick entered the duress PIN. Court filings describe the screen going blank, flashing several times, and the phone appearing to restart. Agents seized the phone anyway and released Tunick a short time later.
On November 13, 2025, a federal grand jury indicted Tunick on one count under 18 U.S.C. Section 2232(a), which makes it a crime to knowingly destroy, damage, waste, dispose of, transfer, or otherwise take action against property for the purpose of preventing or impairing the government’s lawful authority to take that property into custody. The maximum sentence is five years. The statute has been applied for decades to people who threw narcotics overboard or destroyed physical evidence during a search. The Tunick indictment marks the government’s first known attempt to apply it to a data wipe triggered from inside the device being seized. Tunick has pleaded not guilty.
The Border Search Doctrine and the Circuit Split
The border search exception traces to United States v. Ramsey, 431 U.S. 606 (1977), which held that the government’s interest in controlling who and what enters the country justifies searches at the border without a warrant or individualized suspicion. Riley v. California, 573 U.S. 373 (2014), required police to obtain a warrant before searching a phone incident to arrest, but the Supreme Court has not extended that holding to the border. Federal appellate courts disagree on how far the border exception reaches once the object of the search is a phone rather than a suitcase.
The Ninth Circuit held in United States v. Cotterman, 709 F.3d 952 (2013) (en banc), that a forensic search of an electronic device is intrusive enough that agents need reasonable suspicion before performing one, describing the process as a computer strip search. The Fourth Circuit reached a similar conclusion in United States v. Kolsuz, 890 F.3d 133 (2018), requiring individualized suspicion of a transnational offense before a forensic search. The Eleventh Circuit rejected both approaches in United States v. Touset, 890 F.3d 1227 (2018), holding that the Fourth Amendment imposes no suspicion requirement on a forensic search of an electronic device because it imposes none on a search of luggage or any other property carried across the border. Tunick’s case sits in the Northern District of Georgia, inside the Eleventh Circuit, so Touset controls the underlying search question. In July 2026, the Fourth Circuit added another layer to the split in United States v. Belmonte Cardozo, No. 25-4239, holding that a manual search of a phone, as opposed to a forensic download, is routine and requires no suspicion at all. The Electronic Frontier Foundation and the National Association of Criminal Defense Lawyers continue to argue for a probable cause and warrant standard nationwide, but no such rule currently binds the Eleventh Circuit.
The Fifth Amendment and the Function of a Duress PIN
A traveler cannot be forced to disclose a memorized passcode without implicating the Fifth Amendment privilege against self incrimination. The act of production doctrine, traced to Fisher v. United States, 425 U.S. 391 (1976), treats the act of entering or producing a passcode as testimony because it reveals that the person knows the code and controls the device. The Eleventh Circuit applied this reasoning directly to encrypted hard drives in In re Grand Jury Subpoena Duces Tecum Dated March 25, 2011, 670 F.3d 1335 (2012), finding that compelled decryption can violate the privilege unless the government already knows, as a foregone conclusion, that the person can access the device.
A duress PIN operates inside this constitutional gap. Agents cannot compel disclosure of the true passcode, so a traveler who wants to avoid conflict at the border can enter a code that appears cooperative. GrapheneOS engineered the duress PIN so that entering it produces no confirmation prompt and no visible warning, matching the behavior of a phone that is simply restarting. The feature was built for people who fear coercion, not for people planning to destroy evidence of a crime already under investigation. The prosecution’s theory treats the outcome, a wiped phone, as the relevant fact regardless of the feature’s purpose or the lawfulness of the demand that preceded it.
Whether a Data Wipe Is Destruction of Property Under Section 2232(a)
Section 2232(a) requires that the destruction, damage, or other listed act be done for the purpose of preventing or impairing the government’s lawful authority to take the property into custody. The government retained physical custody of Tunick’s phone. Only the data inside it was destroyed. Defense counsel is expected to argue that data is not the kind of property the statute contemplates, since every prior prosecution under the statute involved a physical object such as narcotics, a boat, or paper records. Prosecutors are expected to argue that the statute’s language, which includes disposing of and otherwise taking action against property, is broad enough to cover the deliberate destruction of the digital contents that were the actual object of the search. No appellate court has decided this question because no prior case has presented it in this form.
The Association with Defend the Atlanta Forest
Tunick’s attorneys argue that Customs and Border Protection agents cited a search for child sexual abuse material without evidence supporting that basis and that the agents’ real interest was Tunick’s association with Defend the Atlanta Forest, the movement opposing the Atlanta Public Safety Training Center. A selective or vindictive prosecution claim under United States v. Armstrong, 517 U.S. 456 (1996), requires the defense to show that the government treated similarly situated travelers differently and that the decision to search or prosecute was motivated by an improper purpose such as protected association or expression. Tunick’s team has raised this argument in the pending suppression motion, and a ruling is expected later in 2026.
Want more industry insights? I publish daily analysis on the intersection of deep tech and venture law.
Open Questions
Does entering a passcode that triggers a data wipe, while leaving the physical device in the government’s custody, meet the definition of destroying property under Section 2232(a), or does the statute require damage to a physical object.
Does the Eleventh Circuit’s rule in Touset, which permits a forensic search without suspicion, also answer whether the stated basis for a search can be pretextual, or does a selective prosecution claim survive even when the search itself was lawful.
Will the court find that the stated basis for the search, a search for child exploitation material, was supported by evidence, and if not, what remedy follows for Tunick under Armstrong.
How will the Fourth Circuit’s decision in Belmonte Cardozo and the wider circuit split affect appellate review if Tunick is convicted and appeals to the Eleventh Circuit or petitions the Supreme Court to resolve the split.
Does a conviction under Section 2232(a) discourage travelers from using privacy preserving device features, and if so, what obligations does that create for hardware and software companies selling those features to consumers.
Can prosecutors satisfy the statute’s specific purpose element when the defendant’s stated purpose was to protect personal data from a search his attorneys call unlawful rather than to obstruct a lawful one.
Source List
United States v. Touset, 890 F.3d 1227 (11th Cir. 2018), decided May 23, 2018. This is the controlling Eleventh Circuit precedent holding that the Fourth Amendment imposes no suspicion requirement on forensic searches of electronic devices at the border, and it governs the search question in Tunick’s case.
United States v. Kolsuz, 890 F.3d 133 (4th Cir. 2018), decided May 9, 2018. The Fourth Circuit’s contrary holding, requiring individualized suspicion of a transnational offense before a forensic device search, illustrates the circuit split that frames the suppression motion.
United States v. Cotterman, 709 F.3d 952 (9th Cir. 2013) (en banc), decided March 8, 2013. The Ninth Circuit’s description of a forensic device search as a computer strip search requiring reasonable suspicion, an early foundation of the circuit split.
United States v. Belmonte Cardozo, No. 25-4239 (4th Cir. July 13, 2026). The most recent circuit court ruling on border phone searches, holding that manual searches are routine and require no suspicion, decided while Tunick’s motion was pending.
18 U.S.C. Section 2232(a). The charging statute, which the government applied to a digital data wipe for the first known time in the indictment filed against Tunick on November 13, 2025.
In re Grand Jury Subpoena Duces Tecum Dated March 25, 2011, 670 F.3d 1335 (11th Cir. 2012), decided February 23, 2012. The Eleventh Circuit’s own precedent on compelled decryption and the Fifth Amendment, directly relevant to why a duress PIN exists as a technical response to a constitutional gap.
United States v. Armstrong, 517 U.S. 456 (1996), decided May 13, 1996. The Supreme Court standard governing Tunick’s selective and vindictive prosecution argument tied to his association with Defend the Atlanta Forest.
TechCrunch, coverage of the indictment published July 24, 2026, at https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search/. The most detailed contemporaneous news account of the charge, the seizure, and the defense’s suppression motion.
Electronic Frontier Foundation, Deeplinks Blog, published July 2026, at https://www.eff.org/deeplinks/2026/07/fourth-circuit-says-border-agents-can-search-your-phone-hand-no-suspicion-required. Commentary on the Belmonte Cardozo ruling and the national circuit split surrounding border device searches.
Bibliography
18 U.S.C. Section 2232 (2018).
Fisher v. United States, 425 U.S. 391 (1976).
In re Grand Jury Subpoena Duces Tecum Dated March 25, 2011, 670 F.3d 1335 (11th Cir. 2012).
Riley v. California, 573 U.S. 373 (2014).
United States v. Armstrong, 517 U.S. 456 (1996).
United States v. Belmonte Cardozo, No. 25-4239 (4th Cir. July 13, 2026).
United States v. Cotterman, 709 F.3d 952 (9th Cir. 2013) (en banc).
United States v. Kolsuz, 890 F.3d 133 (4th Cir. 2018).
United States v. Ramsey, 431 U.S. 606 (1977).
United States v. Touset, 890 F.3d 1227 (11th Cir. 2018).
Android Authority. GrapheneOS Duress PIN Could Land a Man in Prison. 2026. https://www.androidauthority.com/grapheneos-duress-pin-us-prosecution-3691271/.
Electronic Frontier Foundation. The Fourth Circuit Says Border Agents Can Search Your Phone By Hand, No Suspicion Required. Deeplinks Blog, July 2026. https://www.eff.org/deeplinks/2026/07/fourth-circuit-says-border-agents-can-search-your-phone-hand-no-suspicion-required.
TechCrunch. US Accuses American of Allegedly Wiping His Phone Using a Duress Password During Border Search. July 24, 2026. https://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-search/.
Interested in analysis about the intersection of tech, policy and the law? Check out my Substack channel.