American Being Prosecuted for Wiping His Phone Before Handing It Over to Border Officials

He’s being prosecuted for giving border officials a code that wiped his phone:

The case centers on a feature included in GrapheneOS, a custom Android operating system that runs in place of the software on most modern Google Pixel devices. Tunick’s attorneys confirmed GrapheneOS was running on his phone.

The software feature allows the device owner to set a passcode that deliberately wipes the contents of that device if entered instead of the user’s unlock passcode.

Tunick’s case also raises ongoing questions about what constitutional rights can be invoked at the border, which the U.S. government has long asserted is not U.S. soil until a person is authorized to enter.

Right. And he wasn’t under arrest, either.

Three more news stories.

Graphene says that the feature is “completely legal“:

GrapheneOS is completely legal. We have no obligation to weaken any of the security protections it provides. Creating and using GrapheneOS is strongly protected by the US constitution. Laws attempting to make it illegal or require weakening the security would be unconstitutional.

It’s hard to know how much the Constitution matters in the US right now.

Tags: , , , ,

Posted on July 30, 2026 at 12:20 PM • 30 Comments

Comments

Hans Baeker • July 30, 2026 1:06 PM

Jason,

I agree. It would be nice to have a passcode/pin to wipe the phone. Make it something like 1111 that a phone thief might try instead of your real passcode/pin of 5151. It would seem likely that a thief would try 1111 early on.

Wolfger • July 30, 2026 1:57 PM

“It’s hard to know how much the Constitution matters in the US right now.”
Depressingly accurate.

Scott • July 30, 2026 2:07 PM

FWIW, the article in the NYT I read explained the statute in question a bit:

“The act applies before, during or after a search. If the target of an investigation knows that a search or seizure is imminent, and that person acts to thwart it, he or she would fall under the statute, experts said.”

So given that they asked for the phone and he then deleted in response is a main issue.

Not that the overall situation isn’t crap, but I think that the application specifically of that law to the situation (once you get past everything that got us there) is potentially a reasonable interpretation.

lurker • July 30, 2026 2:48 PM

@Wolfger

I s’pose it’s something to do with the typo on the second page of the indictment:

“… in violation of Title 18, Untied States Code,Section 2232(a)”

So, you see he’s at the border, hasn’t entered the US, doesn’t have his constitutional rights, YET Title 18, S.2232(a) can be thrown at him. That’s usually called “extra-territoriality”. The Chinese were complaining about it 160 years ago.

schwit • July 30, 2026 3:44 PM

“It’s hard to know how much the Constitution matters in the US right now.”

The border policy did not get created under Trump. It started with 9/11.

Snowden showed us. The The government’s Covid response showed us

‘right now’ has been happening for 25 years.

Wannabe Techguy • July 30, 2026 4:38 PM

@schwit
Yes! However,regarding just “It’s hard to know how much the Constitution matters in the US right now”(not just border policy).I would say that’s been the case before 9/11.
And it’s both parties.

Bcs • July 30, 2026 6:16 PM

@Time For A New Empire:

Not enough context to know one way or the other, but if the hicks you refer to are not the government, then I’d suggest part of the problem was assuming that it’s the government’s job to protect people from other people. At best it’s the government’s job to enact justice (i.e. socially acceptable “revenge”) after the fact. That’s not to go in the direction of “just shoot them”, but a government that can prevent all (or even most) wrongdoing is already totalitarian.

If those hick are the government, then different story. But still, not enough context; for all I know the guy could have gone full sov-cit and been 100% at fault for all his own troubles (a lot of those loons are totally convinced they are in the right and it’s all other people’s fault).

TimH • July 30, 2026 6:29 PM

If he had said nothing, but kept a slip of paper tucked in the phone case with a somewhat difficult to remember password, and someone typed that in, which deleted the phone, then he would have been ok because he had no agency in the action.

Clive Robinson • July 30, 2026 7:28 PM

@ Bruce, ALL,

With regards,

“It’s hard to know how much the Constitution matters in the US right now.”

As he was by a facile argument of idiots not in the US, the Constitution is irrelevant.

At some point someone with sufficient grunt is going to push the point that contrary to what the idiots in charge claim about US law applying everywhere it does not.

Consider the legal implication of shooting a US Boarder gard prior to being admitted and claiming “self defence”…

There are a number of scenarios like that which have been fielded and logic generally falls that “Might is Right” is actually unlawful and against human rights that are mostly internationally agreed via the UN etc.

But untill such time as the idiots are cleared out etc happens… My standing advice is do not carry any kind of electronics into a boarder zone of any country.

Because if you don’t have any you can not be accused of withholding access etc.

And I genuinely do mean “no electronics”.

Look at it this way microcontrollers with Flash are just cents and they end up in everything.

Under UK legislation not having the way to access such memory can get you locked up for half a decade or more. The chances are you have no way of accessing storage on a microcontroller in some random IoT or similar device.

You have to be able to prove beyond doubt you don’t have access, which is in effect a logical impossibility… It’s why UK judges are quite cautious with this legislation since Tony Bliar tried to “force it” and so really don’t use the legislation.

More recently there has been talk of “AI Auto investigation” and judgment” out of various idiots, who appear to believe the nonsense.

However there are some curious gaps in the law which render the use of AI in court cases rather more than suspect.

Aaron • July 30, 2026 7:41 PM

The US Constitution cannot be applied outside of the United States.

The authority granted by the US Constitution also cannot be applied outside of the United States.

So either they have no legal authority, because the action took place outside of the United States or they have legal authority because it actually is recognized as being the United States, in which case the full protection of the US Constitution is in effect.

There is no grey zone

V • July 30, 2026 11:12 PM

What exactly did they ask for? The phone wipe code is certainly A password: it unlocks part of the OS and orders it do do something.

retro • July 30, 2026 11:14 PM

Woah, woah, woah….you’re Constitutional Rights are not suspended if you leave the Union and are coming back in. You are still a citizen and still have Rights.

Granted other countries [States] do not recognize our Rights in their country, but we still have those Rights in regards to the Federal Corporation [28 US Code 3002] known as United States.

HowExactly... • July 30, 2026 11:59 PM

Wait. How exactly do we know he provided a duress password that wiped his phone? How do we know the agents didn’t destroy his phone and blame him for it? A little static electricity will fry CMOS. You wouldn’t even feel the shock.

Where exactly is did these agents get their technological education? How do we know they didn’t destroy his phone and are pushing this duress password story to shift blame away from themselves? Such an outcome seems plausible given their behavior…

Even is this isn’t the case here, this could be a real problem going forward. Authorities can destroy your phone and then arrest you claiming you provided a “Duress Password”. It’s your word against theirs… Good luck with that.

mw • July 31, 2026 1:39 AM

“It’s hard to know how much the Constitution matters in the US right now.” and this case is one aofthe reasons why I’ll never set a foot in the USA.

Unitled • July 31, 2026 3:09 AM

@Clive:

My standing advice is do not carry any kind of electronics into a boarder zone of any country.

I see your point but is that realistic? How many people drive cars and trucks across border zones every day? They all carry electronics: every modern car or truck has built-in electronics, not just in the dashboard stuff but also in the engine. How many people could commute from Switzerland into Geneva, to name only one place, if they followed your rule?

Not Really Anonymous • July 31, 2026 4:15 AM

Driving cars across the US border is risky too. Innocent people have had their cars taken apart to search them. The border guards don’t put them back together for you after they don’t find anything they can charge you with.
Other bad things can happen to you crossing the US border as well. Best not to do it.

Kenneth • July 31, 2026 7:43 AM

Yes, please tell me when we are going to start enforcing 15 USC Chapter 1 and 8 USC 1324.

Clive Robinson • July 31, 2026 8:11 AM

@ Untitled, ALL,

With regards,

I see your point but is that realistic?

Short answer is no, because even a wrist watch has electronics with a microcontroller with FlashROM in it.

The long answer is “perception counts” take a modern radio, it to has a microcontroller in it, but as you don’t load apps etc next to nobody would think about it as been clandestine or other storage etc.

Most modern cars are loaded with microcontrollers all localy networked up, with loads of Flash ROM external communications to the Internet etc etc.

But… People don’t think about them being “user access”.

And that’s the point if the perception is you do not have access then nobody cares unless they really know their job. However anything with a user app with changable skins etc and the assumption is you could be hiding GBytes of illicit material…

If you can successfully play the perception game then you can get away with a lot, but if somebody knows the job and want’s to “clip your wings” then you are right royally stuffed…

Rontea • July 31, 2026 9:19 AM

GrapheneOS’s uncompromising security posture shows just how far modern mobile protections can go to keep data out of reach, even from determined government actors. From a cybersecurity standpoint, designs like hardware-backed encryption and irreversible key wiping are doing exactly what they’re intended to do: protect user data from unauthorized access.

But security engineering doesn’t exist in a vacuum. Once law enforcement encounters a duress wipe scenario, the conversation shifts from technology to policy and legal frameworks. If the data is gone, it’s gone. GrapheneOS is playing by the rules of strong cryptography, and law enforcement will need to adapt its tactics accordingly.

r • July 31, 2026 10:22 AM

@rontea,

hopefully they’re not using /dev/null to feed it.

the flash could have a flag that makes it report back as all zeroes even when it isn’t.

you could use timing to detect a prng fed wipe and if you saw the seed before hand you could later verify the completuon rate after hand-off.

true rng may have advantages too.

it’s a good feature to have if you’re kidnapped for bitcoin.

DBA • July 31, 2026 11:36 AM

An important point is that the guy was part of the Cop City protests in Atlanta. He had been put on the terrorist watchlist and pulled into a room for questioning when he re-entered the country after a vacation, but they didn’t ask him about the protests: they started asking him about CSAM: child sexual abuse material! THAT is when he allegedly gave them the wipe code for his phone.

They not only wanted him, they wanted evidence to prosecute more people for the Cop City protests.

The concept of burner phones and laptops when traveling is more and more attractive.

Placebo • July 31, 2026 12:36 PM

One thing to remember is that he didn’t enter the duress code. He gave the customs agent the correct password, and the agent mistyped it, causing the accidental wipe.

Well, that is what I would say.

Richard Schulman • July 31, 2026 12:43 PM

Colonial opposition to warrantless searches (“Writs of Assistance”) by British customs officials was one of the important motivations for the American Revolution. (Reference: Page Smith, “John Adams,” vol. I, ch. 5)

Matthai • August 3, 2026 10:38 AM

Regarding the case in which a GrapheneOS user gave border police a duress PIN that triggered the deletion of data from his phone – and he is now facing criminal charges for allegedly destroying property during a lawful search or seizure.

The problem is not GrapheneOS, but the user made a mistake.

The correct approach would be this: when they ask you for your PIN, your answer is “I do not answer questions”*

Then they of course take your phone from you. However in a phone case you have a piece of paper with a number written. Number looks like the PIN code. But it is not. It is actually a duress PIN. But hey, you don’t answer questions!

When the police officer asks you if this is the PIN code to unlock your phone, you answer: “I do not answer questions”. And if then the police officer enters this PIN himself and the phone is erased… it is not your fault.

See: https://www.youtube.com/watch?v=ul5oC-F-IF0

Leave a comment

Blog moderation policy

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.