First Known Case of 'Duress' Password Used to Destroy Phone Data in US

The US Justice Department is prosecuting an American for allegedly using a 'duress' password to wipe the contents of his phone during a border search, raising questions about constitutional rights at the border.

Custom Android OS Feature at Center of Allegations

The case centers on a feature included in GrapheneOS, a custom Android operating system that runs in place of the software on most modern Google Pixel devices. The software feature allows the device owner to set a passcode that deliberately wipes the contents of that device if entered instead of the user's unlock passcode.

Tunick's attorneys confirmed GrapheneOS was running on his phone, and they claimed that it was unlawful for U.S. Customs and Border Protection to seize his phone as he arrived back in the U.S. last year.

• The government's indictment accuses Tunick of allegedly providing a passcode to border agents that caused the phone to "delete the digital contents," prior to the device being seized.
• Tunick's attorneys filed a motion to suppress the evidence, claiming that the detention and seizure were unlawful.
• The motion said U.S. border authorities took Tunick into a secondary inspection at Atlanta's Hartsfield-Jackson airport as he returned from overseas on January 24, 2025, but that he was repeatedly denied access to an attorney and was not informed of his legal rights.

Border Search Rights and Data Protection

The case raises ongoing questions about what constitutional rights can be invoked at the border, which the U.S. government has long asserted is not U.S. soil until a person is authorized to enter. Security experts say they have not seen charges brought in this way before, and it is incredibly rare to see the federal statute used in an indictment.

• "I have not seen this before, though I’ve discussed the potential scenario with activists and journalists over the years," said Runa Sandvik, a digital security expert who works to protect at-risk people as the founder of security consultancy firm Granitt.
• "I think this case serves as a reminder that authorities may argue you knowingly destroyed data, so it’s better to not have that data on you when you cross certain borders."

Electronic Frontier Foundation Guides on Data Protection

The Electronic Frontier Foundation has guides on how to protect your data and security at the U.S. border, and explaining what rights you have. The Atlanta federal court overseeing the case is expected to rule on Tunick's motion to suppress later this year.