First U.S. Prosecution Over Phone 'Duress' Wipe Raises New Digital-Privacy Questions

Atlanta — A federal prosecution in Georgia has put a rare legal question about digital privacy into the spotlight: can deliberately triggering a smartphone's "duress password" during a border inspection amount to a crime?

Federal prosecutors say Atlanta activist Samuel Tunick intentionally wiped his Google Pixel while returning to the United States through Hartsfield-Jackson Atlanta International Airport on January 24, 2025. Court filings allege the device ran GrapheneOS, a privacy-focused Android distribution that offers a duress-password feature. When that code is entered, the phone deletes its encryption keys and resets itself, rendering stored data inaccessible.

Charges And The Legal Theory

Prosecutors have charged Tunick under 18 U.S.C. § 2232(a), a rarely used federal statute that criminalizes destroying or disposing of property to prevent lawful seizure. Authorities contend Tunick activated the wipe after border agents requested access to his phone, thereby preventing investigators from examining its contents. Tunick has pleaded not guilty.

Defense Claims And Suppression Motion

Tunick's attorneys say the encounter at the airport violated his constitutional rights. They allege he was denied access to counsel, was not properly advised of his rights, and was questioned about alleged child-exploitation material as a pretext to investigate his ties to Atlanta's Stop Cop City protest movement. The defense has asked the court to suppress all evidence gathered during the encounter, arguing the search itself was unlawful.

Government Response

Federal prosecutors counter that border agents did not need a warrant because Tunick had not yet formally reentered the United States, and they argue that deliberately erasing data to frustrate a lawful search can constitute criminal conduct under § 2232(a). The court has not yet ruled on the suppression motion.

Vendor Statement And Technical Options

SOVREIGN, the company associated with the duress-password configuration, has publicly acknowledged the case and described its practices. The company says it configures duress passwords on request and explains trade-offs to customers, adding: "We do not market it as a way to defeat a lawful investigation, and we would not sell a phone to someone who described that as their goal." SOVREIGN also says some customers choose alternatives that avoid permanent data destruction — for example, an "auto-reboot" or timed keys-unloaded state that preserves data while making it inaccessible without destroying encryption keys.

Broader Implications

Security researchers contacted by reporters said they were unaware of any earlier U.S. prosecution focused on a smartphone's duress-password feature. Privacy advocates argue travelers should be able to protect sensitive personal information from warrantless searches; the government maintains that intentionally erasing data during a lawful seizure crosses into criminal behavior. Observers say the case could create important precedent on how border-search powers apply to encrypted devices and privacy-focused operating systems.

"The central question is not whether the feature exists," a legal analyst summarized, "but whether triggering it in the face of a lawful search is the equivalent of destroying evidence."

The federal court has yet to decide Tunick's motion to suppress evidence. The outcome will likely shape how law enforcement, travelers, and privacy-focused vendors approach duress features and encrypted devices at U.S. borders.