Summary: After Sam Tunick entered his passcode at Atlanta airport secondary inspection on January 24, 2025, his Pixel running GrapheneOS began an automatic wipe. About 18 months later, the Justice Department charged him under a property-destruction statute for preventing seizure, a case experts described as possibly the first to put an OS feature effectively on trial. Reporting and court filings give competing framings: an alleged Cop City link prompted a terrorism flag, while defense counsel called the child-abuse-image questioning a pretext and said no warrant was produced.
On January 24, 2025, Sam Tunick returned from a vacation in the Dominican Republic and was directed into secondary inspection at Atlanta’s Hartsfield-Jackson airport. Border agents demanded his passcode; after he entered it, the screen went dark and the device began wiping itself. About eighteen months on, the US Department of Justice has charged him with something that rattled the security community: not espionage, but destruction of property to prevent its seizure. Experts who spoke to the press suggested this may mark the first time a federal statute has, in effect, put a single operating-system feature on trial.
The Timeline: An Email Three Hours Before Landing
Documents the Guardian obtained lay out the sequence. Roughly three hours before Tunick’s flight was scheduled to arrive, a Department of Homeland Security agent emailed a CBP tactical terrorism response team and an FBI joint terrorism task force, flagging him for “suspected terrorism activities” based on an alleged link to the movement opposing Cop City — the $109 million police training facility in Atlanta — an association that reportedly placed him on a terrorism watchlist. Inside secondary inspection, agents kept returning to questions about child sexual abuse imagery, repeatedly ordering him to unlock the phone and threatening seizure. Counsel say he requested an attorney four times and was turned down each time, that he was never read his rights, and that no warrant ever materialized. When he finally entered the passcode, a defense motion describes what happened next: “the screen went blank, flashed several times and the phone appeared to restart” — the data was gone. One CBP officer testified that the team was “looking for anything that’s prohibited.”
Why the Duress PIN Exists: Built for When You Must Hand the Phone Over
The phone was a Pixel running GrapheneOS, an open-source Android build centered on privacy for Google Pixel hardware. The legal fight hinges on its duress PIN — a backup code indistinguishable from a normal unlock credential that, instead of opening the device, triggers an irreversible wipe with no confirmation dialog to tip anyone off. Designers imagined it for the moments when a handset is physically wrested from you: a street robbery, a coerced border inspection. The court must now decide whether that reads as self-protection or evidence destruction.
What the Court Is Really Examining: The Feature on Trial
Prosecutors rest on a little-known federal law, 18 U.S.C. § 2232, criminalizing destruction of property to keep it from being seized. Bill Budington at the EFF and cybersecurity specialist Christophe Boutry each told reporters they could not recall a parallel case. The government’s theory is that Tunick knowingly erased the phone so the device would never reach official custody. A suppression motion counters that the search was unconstitutional, calls the child-abuse-image line of questioning a pretext to fish for Cop City connections, and frames the larger issue: which rights actually survive at the border? Boutry put it bluntly — the case “sends the message that [GrapheneOS] is criminal by default,” even though privacy protection is the OS’s reason for being. He cited frustration among French and Spanish authorities, Catalan police profiling Pixel owners as suspects, and Marlon Kautz of the Atlanta Solidarity Fund defending the right to keep private data private. A ruling on the motion is not expected before late October; whatever emerges will become the first reference point.
Takeaways for Users and Teams
Carrying a work phone across a border is no longer a safe assumption. Three practical steps. First, lighten what any one device holds before international travel — a dedicated travel handset, minimal installs, sensitive files in the cloud until you are back home. Second, organizations need a written border-search playbook: when a journalist, researcher, or developer is ordered to disclose a passcode, a named decision-maker and procedure should govern the response instead of on-the-spot improvisation. Third, security features are not legally neutral; knowing how your tools behave under duress is baseline literacy in 2026 whether you ship software or simply carry it. Android Authority captured the same friction from another angle: the duress PIN reassures you during a mugging, yet when pointed at law enforcement the industry confronts unsettled questions. If a wipe happens under compulsion, does that constitute destroying evidence — even if no underlying charge ever sticks? Until courts speak, the cautious view is that a wipe is permanent, discoverable, and almost certain to attract scrutiny. GrapheneOS is not on trial for being weak; the spotlight is on it for doing exactly what its documentation promises — and that distinction is why this case merits attention.