American Citizen Charged for Using 'Duress Password' to Wipe Phone at Airport

The Case Against Sam Tunick

The U.S. government is prosecuting Sam Tunick, an American citizen, for allegedly triggering a remote wipe of his smartphone at Atlanta's Hartsfield-Jackson International Airport on January 24th, 2025. Federal agents detained Tunick and, according to prosecutors, he provided a "duress password" — a feature of the privacy-focused mobile operating system GrapheneOS — that wiped the device rather than unlocking it. The government is relying on a little-known, rarely invoked federal statute that prohibits destroying or damaging property to prevent its lawful seizure by authorities.

The charges represent one of the first known prosecutions under this legal theory applied to a smartphone self-wipe scenario, raising urgent questions about the boundaries of digital privacy rights at U.S. borders — a zone where courts have historically granted the government broad search authority.

Political Undertones and the Stop Cop City Connection

The government's stated justification for the initial detention was an investigation into child exploitation images — a serious allegation, but one that Tunick's defense team directly contests. His attorneys have filed a motion arguing the child exploitation claim was a pretext, and that the real target of the investigation was Tunick's alleged ties to the Stop Cop City movement, a protest campaign opposing the construction of a large police training facility in Atlanta's South River Forest.

Marlon Kautz, a member of the Atlanta Solidarity Fund — a group that has supported activists affiliated with the Stop Cop City movement — publicly defended Tunick's actions, arguing that individuals have a fundamental right to protect private data from unconstitutional searches, particularly during what he characterized as a period of rising authoritarianism.

Legal Battleground: Rights at the Border

Tunick's attorneys are mounting a multi-pronged constitutional challenge. They allege agents denied him access to an attorney, failed to present a warrant, and did not inform him of his legal rights during the detention. They further contend that the phone was sought under false pretenses. If successful, the defense's argument would result in all evidence gathered being thrown out as fruit of an unlawful seizure.

The government has pushed back on the warrant requirement with a significant legal caveat: Tunick had not yet been formally admitted into the United States at the time of detention, meaning agents were not obligated under existing law to produce a warrant. Border and pre-entry zones have long been treated as legal gray areas where Fourth Amendment protections are significantly curtailed, a doctrine that courts have repeatedly upheld.

Broader Implications for Travelers and Digital Privacy

The case arrives amid a broader pattern of heightened scrutiny at U.S. ports of entry under the Trump administration. Even American citizens have reported multi-hour detentions and demands to hand over social media account credentials and device passcodes. The Tunick prosecution dramatically raises the stakes for anyone who takes active steps to secure their data at the border.

GrapheneOS, the Android-based operating system Tunick allegedly used, is designed specifically for users who prioritize security and privacy. Its duress password feature — which wipes a device when a predetermined alternate code is entered — is a legitimate, publicly documented security tool used by journalists, activists, attorneys, and privacy-conscious individuals worldwide. The prosecution effectively treats using this feature as a criminal act, setting a potentially sweeping precedent that could criminalize widely available privacy technology.