GrapheneOS Defends Legality After Duress PIN Case

GrapheneOS said its operating system is legal and constitutionally protected after Atlanta activist Samuel Tunick was charged under federal law for allegedly using a duress PIN that wiped his phone during a warrantless border search at Hartsfield-Jackson Atlanta International Airport on Jan. 24, 2025.

Tunick has pleaded not guilty and faces up to five years in prison under 18 U.S.C. § 2232, a statute that prohibits knowingly destroying property to prevent its seizure. A judge is not expected to rule on his motion to suppress until at least the end of October.

In a July 27 statement on its public account, GrapheneOS wrote that it cannot assist once key cryptographic material on a device has been erased and that bypassing encryption is not possible by design. The project added that it has no obligation to weaken security protections and described laws that would require such weakening as unconstitutional.

GrapheneOS highlighted technical features of the recommended Pixel hardware and firmware, noting the phone’s secure element requires owner authentication before firmware updates and that the duress feature wipes key material so data cannot be recovered after erasure. The project’s founder has said the duress PIN was added in June 2024 to protect users in scenarios like the one described by Tunick.

Tunick told authorities and his attorney that agents coordinated to stop him, searched his bags and person over his objections and did not seek a warrant. His federal public defender, Matthew Dodge, argued the charge is extraordinarily rare, saying he located only one prior prosecution under the same statute. Tunick has said the indictment follows a year of surveillance that included a tracking device on his car and subpoenas for his phone records and email.

A U.S. Customs and Border Protection spokesperson said all travelers are subject to inspection and that searches of electronic devices are rare and handled case-by-case with attention to travel history and law enforcement alerts. The U.S. Attorney’s Office declined to comment.

Legal experts have commented that the case raises questions about encryption, user privacy and how law enforcement can access data on locked or wiped devices. The prosecution is the first known U.S. federal case tied to a GrapheneOS feature to advance through the courts, and it may be referenced in future litigation over defensive security features and encrypted devices.