GrapheneOS user’s ‘duress code’ case raises data privacy concerns
An activist from Atlanta faces a number of federal charges after a 2025 airport interrogation in which he gave border agents a duress passcode which wiped the data from his phone.
In January 2025, an Atlanta resident named Samuel Tunick was on a nature trip with his friends when a homeland security agent started circulating emails about investigating him for “suspected terrorism activities.” Tunick had no idea that he had already been on a watch list and plans about detaining him upon his return to Atlanta were already discussed by authorities.
Thinking he was simply returning home, Tunick was shocked when agents met him at the airport and immediately escorted him to a room for what was described as a “secondary inspection.”
He was then asked about certain child sexual abuse images, followed by a request to surrender his phone for data collection. He agreed after hearing that they would confiscate it if he didn’t.
Tunick, however, used a feature in GrapheneOS, a mobile operating system which can clear a phone’s data after entering a duress passcode.
For providing the duress code instead of the actual passcode, he now faces several federal charges from the US Department of Justice.
An unprecedented case
The case had its first hearing on July 20, where testimonies were given after Tunick’s public federal defenders filed a motion. The Guardian reported that they urged the court to throw out all evidence obtained by the agents, including the erasure of his phone contents, arguing that this was a violation of his constitutional rights. They also added that asking Tunick about the sexual abuse images was “a pretext for a fishing expedition to Mr. Tunick’s connections.”
Tunick claimed he was denied several times after asking to speak with a lawyer and be read his constitutional rights. A justice department attorney and the airport agents, however, said the data collection was just a normal everyday interrogation at an international airport, where they were simply “looking for anything that’s prohibited.”
Meanwhile, experts have expressed that this may be the first time an operating system was targeted by the law — which poses concerns on privacy and security being used to criminalize protesters.
What are duress codes?
Ars Technica, in its report, explained that Google Pixel phones running GrapheneOS like Tunick’s support user privacy with features like memory protection, memory reboot, and duress codes.
The duress code that Tunick used during the airport investigation is an optional feature of GrapheneOS that allows users to set a passcode that is different from the unlock code. This aims to protect a user’s phone through irreversibly deleting all data and eSIMs stored in the device — a tool Tunick used when authorities unexpectedly interrogated him.
Defending Tunick
In a tweet, the GrapheneOS developer defended Tunick saying that the Android version is “completely legal”.
“We have no obligation to weaken any of the security protections it provides. Creating and using GrapheneOS is strongly protected by the US constitution.,” said the developer, adding that laws that attempt to make it illegal would be “unconstitutional”.
Speaking with The Guardian, French cybersecurity and surveillance expert Christophe Boutry said this case was just another example of authorities attempting to access phones of journalists, lawyers, and political leaders, only to be thwarted.
In Catalonia, Spain, for example, police have already been profiling people with Google Pixel phones, especially if they use GrapheneOS.
Boutry added, “They’re our phones and the state can’t tell us to use them.”
Meanwhile, Marlon Kautz, a member of the Atlanta Solidarity Fund, also defended Tunick saying: “We all have a right to secure our private data against unconstitutional searches. And we should — especially in a time of rising authoritarianism.”
Following these events, the GrapheneOS Foundation reminded people that while the features are aimed at data privacy and protection, users must still “carefully consider how to use it in an actual duress situation where there can be physical or legal consequences for wiping the device.”
Tunick’s case can last until the end of October, when the judge is expected to decide on the motion. If convicted, he will face up to five years in prison. – Rappler.com
Charley Dueñas is a Rappler intern and a fourth year AB Communications student from the Ateneo de Manila University.
