The prosecution of an Atlanta activist over the alleged use of GrapheneOS’ duress password has become one of the most closely watched technology law cases of the year, not because it revolves around a software vulnerability or a data breach, but because it tests where digital privacy tools end and criminal liability begins.

For more than a decade, governments and technology companies have argued over encrypted devices, lawful access, and whether security features should ever be weakened to assist investigators. Those debates have typically centered on Apple, Google, encrypted messaging platforms, or demands for so-called “lawful access” mechanisms. This case introduces a different question altogether: can someone be prosecuted simply for activating a security feature that was intentionally designed to protect data?

The defendant, Samuel Tunick of Atlanta, has pleaded not guilty after federal prosecutors accused him of using a GrapheneOS duress password during a border inspection, allegedly causing the contents of his smartphone to become permanently inaccessible. The US Department of Justice argues that the action amounted to unlawful destruction of property intended to prevent a lawful government seizure. Tunick’s attorneys, meanwhile, contend that the border search itself violated constitutional protections and that the evidence obtained during the encounter should be suppressed.

Regardless of how the court ultimately rules, legal scholars, digital rights advocates, and security researchers agree on one point: this appears to be the first known federal criminal case centered on GrapheneOS’ duress password feature, placing both the operating system and modern smartphone encryption under unprecedented legal scrutiny.

What allegedly happened at Atlanta airport?

According to court filings and multiple reports, the incident dates back to January 24, 2025, when Tunick returned to the United States through Hartsfield-Jackson Atlanta International Airport after an overseas trip. Customs and Border Protection officers selected him for secondary inspection, a process that permits additional questioning and, in certain circumstances, examination of electronic devices at the border.

The government has alleged that officers requested access to Tunick’s Google Pixel smartphone. Rather than refusing outright, he entered what prosecutors believe was a preconfigured duress password instead of his normal device credential. The phone reportedly displayed a black screen, restarted, and the stored data subsequently became inaccessible.

Federal prosecutors later charged Tunick under 18 U.S.C. § 2232(a), a statute prohibiting the knowing destruction or removal of property to prevent its lawful seizure. If convicted, he could face up to five years in prison.

Tunick has denied wrongdoing. His legal team argues that the questioning violated his constitutional rights, alleges he repeatedly requested legal counsel without success, and contends that investigators exceeded lawful limits during the airport examination. They have also sought to suppress evidence obtained during the encounter, arguing that the government’s justification for the search was legally insufficient. Those constitutional questions remain before the court, and no final ruling has yet been issued.

The legal dispute therefore extends well beyond one phone. It could determine whether activating a built-in privacy feature constitutes destruction of evidence, or whether it is simply the intended operation of software designed to protect encrypted information.

Understanding GrapheneOS

GrapheneOS is not a modified version of Android built around convenience features or visual customization. Instead, it is a hardened, security-focused operating system based on the Android Open Source Project (AOSP), developed primarily for Google Pixel smartphones.

Unlike many aftermarket Android distributions that prioritize interface customization or removal of Google applications, GrapheneOS concentrates almost entirely on attack surface reduction, exploit mitigation, stronger memory protections, application sandboxing, and improved hardware security integration.

Because modern Pixel devices already include several hardware security technologies, GrapheneOS builds on top of them rather than replacing them. The operating system works closely with hardware-backed cryptographic components such as Google’s Titan security chip and Android’s KeyMint infrastructure to strengthen protection against physical attacks, forensic extraction attempts, privilege escalation, and credential theft. It also introduces additional security improvements beyond stock Android, including stricter memory allocation protections, enhanced permission controls, hardened WebView components, optional network restrictions, improved exploit resistance, and additional privacy controls.

As a result, GrapheneOS has gained popularity among journalists, researchers, security professionals, activists, and users who routinely handle sensitive information.

The duress password is not a hidden backdoor

Much of the reporting surrounding this case has described the duress password as though it were an emergency self-destruct mechanism borrowed from a spy novel. In reality, it is a documented security feature included by design within GrapheneOS.

GrapheneOS Duress Password – How it Works

Users configure a second credential that is entirely separate from the normal unlock PIN or password. If that secondary credential is entered anywhere the operating system requests authentication, GrapheneOS immediately begins an irreversible process that destroys access to the encrypted contents of the device.

Importantly, the duress password is not intended to “unlock” the device before deleting files. The operating system instead destroys the cryptographic material required to derive the encryption keys protecting user data. Once that key derivation material has been securely erased, the encrypted storage effectively becomes unreadable because the information necessary to decrypt it no longer exists. The physical flash memory remains, but its contents become computationally useless without the destroyed keys.

GrapheneOS documentation further explains that the wipe includes all user profiles and installed eSIMs, is immediate, cannot be interrupted once initiated, and works anywhere device credentials are requested rather than only at the lock screen.

This distinction matters because the operating system is not overwriting every storage block individually in real time. Modern smartphones rely on full-disk and file-based encryption, meaning encrypted information is only meaningful while the corresponding cryptographic keys remain available. Securely destroying those keys achieves the same practical outcome far more quickly than attempting to erase hundreds of gigabytes of flash storage sector by sector.

Why deleted encryption keys matter more than deleted files

To understand why the alleged phone contents cannot realistically be recovered, it is necessary to understand how modern Android encryption works.

Android File-Based Encryption on GrapheneOS

Current Pixel devices implement Android File-Based Encryption (FBE), where every file is encrypted using keys ultimately protected by hardware-backed cryptographic secrets stored within dedicated secure hardware. User credentials are not themselves the encryption keys. Instead, they participate in a layered key derivation process that ultimately unlocks the cryptographic hierarchy protecting stored data.

GrapheneOS strengthens this design by relying heavily on hardware-backed security features already present in Pixel devices. One important component is the secure element, which stores high-entropy secrets and enforces hardware rate limiting on authentication attempts. Rather than allowing unlimited password guesses, the secure element introduces progressively increasing delays after failed attempts, making brute-force attacks dramatically more difficult even when attackers possess the physical device.

The duress password takes advantage of this architecture. Instead of attempting to erase every encrypted file individually, GrapheneOS securely destroys the key derivation material required to reconstruct the encryption hierarchy. Once those cryptographic roots disappear, recovering the underlying plaintext becomes practically impossible because the encrypted storage no longer has any usable path back to its decryption keys. The GrapheneOS Foundation has publicly stated that once this process completes, neither the developers nor anyone else can recover the protected data.

This design mirrors a long-standing principle in applied cryptography. Strong encryption is often easier to protect by securing or destroying keys than by attempting to erase every encrypted byte individually. Without the keys, encrypted storage simply appears as random ciphertext, regardless of how much computing power is later applied.

Modern forensic tools therefore focus heavily on obtaining credentials before devices fully lock, extracting keys while they remain resident in memory, or exploiting software vulnerabilities before encryption becomes effective. Once devices return to a secure encrypted state and the relevant cryptographic material has been destroyed, even advanced forensic platforms frequently lose practical access unless an exploitable implementation flaw exists.

GrapheneOS itself has emphasized that the duress password is only one component of its broader security model. The Foundation has repeatedly stated that users should carefully consider activating the feature in real-world coercive situations because, although it effectively eliminates the possibility of recovering data, using it can also carry legal or physical consequences depending on the circumstances.

GrapheneOS’ broader security model extends well beyond the duress password

Much of the public discussion has focused exclusively on the duress password because it sits at the center of the criminal case. However, GrapheneOS developers have repeatedly emphasized that it represents only a small component of the operating system’s overall security architecture. In fact, the Foundation has cautioned users against viewing it as the primary mechanism for protecting sensitive information, noting that GrapheneOS is designed to resist data extraction even without triggering a device wipe.

One of the most significant protections is the operating system’s handling of devices that remain locked. Android’s File-Based Encryption divides device operation into two distinct states. Before the user authenticates after boot, commonly referred to as Before First Unlock (BFU), the majority of user data remains inaccessible because the decryption keys have not yet been derived from the user’s credentials. After successful authentication, the device enters the After First Unlock (AFU) state, where keys required for normal operation become available in memory and applications can access encrypted storage according to Android’s security model.

GrapheneOS encourages users handling particularly sensitive information to minimize the amount of time devices remain in the AFU state. To support this, it includes an Auto Reboot feature that automatically restarts the phone after a configurable period of inactivity while locked. Once rebooted, the device immediately returns to the BFU state, where encrypted user data is significantly more resistant to forensic acquisition because the necessary decryption keys are no longer resident in memory. This feature has become increasingly relevant as commercial forensic vendors continue developing techniques aimed at extracting data from devices that have remained powered on after their first unlock.

GrapheneOS also introduces profile isolation that exceeds the default Android implementation. Separate user profiles maintain independent encryption keys and application environments, reducing the risk that compromise of one profile automatically exposes information stored in another. Combined with strengthened application sandboxing, enhanced permission management, hardened memory allocation, and exploit mitigations, the operating system attempts to reduce both software vulnerabilities and opportunities for post-compromise privilege escalation.

The Foundation therefore argues that the duress password should be viewed as an option for exceptional circumstances rather than a routine security measure. Its documentation explicitly warns that activating the feature in situations involving law enforcement or coercive searches may carry legal or physical consequences, even though the feature itself is lawful software functionality.

Why forensic recovery becomes extraordinarily difficult

The public conversation surrounding this case has often used phrases such as “the phone wiped itself” or “the phone deleted everything.” While technically understandable, those descriptions oversimplify what actually happens inside a modern encrypted smartphone.

Flash storage is fundamentally different from traditional magnetic hard drives. Simply deleting files rarely removes the underlying encrypted information immediately. Instead, the operating system marks storage as reusable while cryptographic protections continue safeguarding the data. Consequently, modern mobile security increasingly relies on encryption rather than physical overwriting.

When GrapheneOS processes a duress password, the objective is not to erase every byte individually. Instead, it securely destroys the cryptographic material that makes the encrypted storage intelligible. Once those hardware-protected secrets are eliminated, every encrypted file remaining on the storage medium becomes computationally useless because no practical mechanism exists to reconstruct the missing keys.

This distinction explains why the GrapheneOS Foundation has consistently stated that it cannot assist investigators in recovering data following a completed duress wipe. According to the Foundation, once the key derivation material has been reliably destroyed, recovery is not merely unsupported but cryptographically impossible using the operating system’s intended security design.

That position reflects a broader principle shared by modern encrypted systems. Whether the platform is Android, iOS, BitLocker, FileVault, or Linux Unified Key Setup (LUKS), strong encryption derives its effectiveness from protecting cryptographic keys rather than relying on the secrecy of stored files themselves. If the keys are permanently destroyed without backup, the encrypted data remains physically present but functionally indistinguishable from random noise.

This architectural approach has long complicated digital forensic investigations. Commercial forensic products often rely on exploiting software vulnerabilities, extracting credentials before devices fully lock, or leveraging implementation flaws. They generally cannot bypass mathematically sound encryption when hardware security functions as intended and no exploitable vulnerability exists.

The legal question is not whether GrapheneOS is legal

Some early headlines suggested that the government was attempting to criminalize GrapheneOS itself. That characterization does not accurately reflect the current prosecution.

No federal agency has argued that installing GrapheneOS is unlawful. Likewise, there has been no allegation that developing, distributing, or possessing the operating system violates US law.

Instead, prosecutors focus on what allegedly occurred during the border inspection.

According to the indictment, the government contends that activating the duress password intentionally impaired its ability to examine property that officers were lawfully attempting to seize. The criminal charge relies on 18 U.S.C. § 2232(a), a statute that prohibits knowingly destroying or removing property to prevent its lawful seizure.

Historically, this provision has been applied in situations involving tangible evidence, such as physically destroying documents, narcotics, firearms, or other property before law enforcement can seize them. Applying the statute to encrypted digital information raises substantially different legal questions because the physical smartphone remained in government custody while only the ability to decrypt its contents allegedly disappeared.

That distinction has attracted significant attention from legal scholars.

The central issue is not whether a phone existed after the encounter. Rather, it is whether intentionally rendering encrypted information inaccessible constitutes destruction of “property” within the meaning of the statute. Existing federal case law offers relatively little guidance because prosecutions involving cryptographic key destruction rather than physical evidence remain rare.

For that reason, several legal observers have described the case as potentially precedent-setting regardless of its eventual outcome.

The constitutional issues extend beyond the phone

Tunick’s defense does not rely solely on disputing the criminal charge. His attorneys have also challenged the legality of the underlying search itself.

Court filings argue that he repeatedly requested legal counsel, was not provided Miranda warnings before questioning, and that investigators exceeded constitutional limits during the border examination. The defense further argues that the government’s stated investigative purpose did not justify the scope of the search and seeks suppression of evidence obtained during the encounter.

The Department of Justice disputes those allegations, maintaining that border officers possess broad authority to conduct inspections of travelers and electronic devices entering the United States.

This disagreement reflects a long-running area of constitutional law commonly referred to as the border search exception.

Under longstanding Supreme Court precedent, routine searches conducted at the international border generally require neither a warrant nor probable cause. Courts have traditionally recognized broader government authority at the border than exists during ordinary domestic law enforcement encounters because of the government’s responsibility to regulate entry into the country and prevent contraband from crossing national boundaries.

However, digital devices have complicated that legal framework.

Modern smartphones contain years of communications, photographs, financial information, location histories, health records, cloud credentials, legal correspondence, journalistic sources, and extensive personal metadata. Consequently, courts have increasingly grappled with whether searching a smartphone should be treated like inspecting luggage or whether the extraordinary quantity of private information stored on modern devices requires heightened constitutional protections.

The Supreme Court acknowledged the uniquely sensitive nature of smartphones in Riley v. California (2014) when it held that police generally require a warrant before searching a cell phone seized during an arrest. Border searches remain governed by different legal doctrines, but Riley fundamentally changed judicial recognition of how much private information modern devices contain.

Tunick’s case therefore intersects two evolving areas of constitutional law simultaneously: government authority at international borders and the legal implications of strong end-to-end device encryption.

Why privacy advocates are paying close attention

The prosecution has generated significant discussion among privacy organizations, security researchers, journalists, and civil liberties advocates because it touches questions extending well beyond one activist’s smartphone.

GrapheneOS has become widely used by individuals whose work routinely involves sensitive communications, including investigative journalists, lawyers, human rights defenders, researchers, whistleblower support organizations, and cybersecurity professionals. For these users, device encryption protects confidential sources, privileged legal communications, proprietary research, and personal safety rather than serving merely as a convenience feature.

Digital rights advocates argue that if activating built-in security protections can itself become the basis of criminal prosecution under certain circumstances, users may become reluctant to employ legitimate privacy technologies even when those technologies are lawful.

The Electronic Frontier Foundation has long maintained that strong encryption is an essential component of digital security because weakening encryption for investigators inevitably weakens it for criminals, hostile governments, and other malicious actors as well. Similar arguments have appeared repeatedly throughout debates involving encrypted messaging services, Apple’s resistance to creating investigative backdoors, and government proposals seeking exceptional access to encrypted devices.

GrapheneOS has adopted essentially the same position.

Following public attention surrounding the case, the Foundation reiterated that the operating system is lawful, that it has no obligation to weaken its security protections, and that neither it nor anyone else can recover data once the underlying cryptographic key material has been securely destroyed. At the same time, the Foundation emphasized that users should carefully evaluate the practical consequences of employing the duress password during real-world encounters with authorities because the feature may carry significant legal implications depending on jurisdiction and circumstance.

A case likely to influence future debates over encrypted devices

Although the proceedings remain ongoing and no court has determined Tunick’s guilt or innocence, the litigation has already become an important milestone in the broader discussion surrounding digital privacy.

Unlike previous high-profile disputes that focused on compelling technology companies to bypass encryption or create investigative backdoors, this case asks whether activating an existing privacy feature can itself become the basis for criminal prosecution. The distinction may appear subtle, but it carries potentially significant implications for future cases involving encrypted smartphones, self-encrypting storage devices, secure communication platforms, and cryptographic key destruction.

For GrapheneOS, the case has also drawn unprecedented public attention to an operating system that has largely remained within security and privacy communities despite years of active development. Its duress password was designed as a niche defensive capability for users facing coercive access to their devices. Today, it sits at the center of a federal prosecution that may help define how courts interpret privacy-enhancing technologies in an era where encrypted devices have become the norm rather than the exception.

Whatever the court ultimately decides, the outcome is likely to resonate far beyond a single Pixel smartphone. It could influence how investigators approach encrypted devices, how developers design future security features, and how courts balance legitimate law enforcement interests against an individual’s ability to protect sensitive digital information. As smartphones continue to function as repositories for nearly every aspect of modern life, the legal principles established in this case may shape the relationship between encryption, privacy, and government authority for years to come.

Alt...

GrapheneOS duress password

Alt...

GrapheneOS Duress Password - How it Works

Alt...

Android File-Based Encryption on GrapheneOS