In January 2025, Samuel Tunick stepped off a flight at the Atlanta airport after a vacation in the Dominican Republic. By the time he landed, a government email had already flagged him for "suspected terrorism activities" over his ties to a protest movement. Border agents pulled him into secondary inspection, questioned him about child abuse imagery without stating any basis for that suspicion, ignored four requests for a lawyer, and told him plainly: when it comes to customs, "we don't need a warrant."
They seized his phone. Under that pressure, he gave up his password.
When an officer typed it in, the phone wiped itself.
In November 2025, a federal grand jury indicted Tunick for destruction of property to prevent seizure, a charge carrying up to five years. His phone runs GrapheneOS, a hardened open-source operating system, and it includes a duress password: a second code that erases the device if entered instead of the real one. He set it up long before he ever flew. The feature exists for one situation, the moment someone forces your phone open. It worked as designed during a coerced search, and the Justice Department called it a crime.
EFF's Bill Budington, security researcher Runa Sandvik, and surveillance researcher Christophe Boutry all say they have never seen a prosecution like it. Boutry's summary: it sends the message that GrapheneOS is criminal by default.
Why this should worry you (even if you've never heard of GrapheneOS)
The government's theory is that configuring a security feature that destroys data proves you planned to interfere with a search. The same logic applies to:
- Setting a strong password
- Running a tool that overwrites deleted files
- Wiping your laptop before a flight, after backing it up
Any security measure that runs automatically becomes evidence of criminal intent, because you set it up in advance. The theory doesn't stop at journalists and activists. Family photos, client files, business records, a banking app: any of it behind a password stronger than what an officer could guess in five tries sits inside the same argument.
The border is already a constitutional blind spot
At a US port of entry, agents claim the power to search your phone with no warrant, no probable cause, and no suspicion at all. The Eleventh Circuit, which covers Georgia, has gone furthest and ruled that agents don't even need reasonable suspicion. The First, Fourth, and Ninth Circuits put limits on the same search. Where your flight lands decides how much protection your phone has.
Tunick's motion to suppress adds the pretext problem. His lawyer's filing shows the terrorism flag circulated before his plane landed, coordinated through a DHS terrorism response team and the FBI, over his domestic political association. The interrogation leaned on a sex-abuse accusation with no stated evidence behind it. A border authority built for contraband and immigration violations became the doorway into a domestic criminal investigation. The same doorway works on anyone.
What's actually at stake
The court held an evidentiary hearing in July 2026. Briefing ends November 23, so a ruling is expected after that. Three questions hang on it.
Can the border really be warrant-free for your whole digital life? Tunick's defense argues the search was a domestic criminal investigation dressed up as a border search. A ruling that narrows the border exception for phones would protect every traveler, not just defendants.
Did he knowingly destroy anything? A duress wipe fires only when someone forces entry. Tunick provided the only password he could give, and a feature configured years earlier for his own protection did the rest. Punishing a person for what defensive software does under coercion reverses the intent requirement the statute actually contains.
Are privacy settings evidence of guilt? If the prosecution prevails, expect the theory to spread: reporters protecting sources, small business owners protecting client data, anyone using a feature a prosecutor finds suspicious. If the defense prevails, the ruling establishes that security tools are lawful and ordinary.
What this means for you
- Travel with less. The only reliable protection from a border device search is not carrying the data across the border. A clean device that pulls what you need from the cloud limits the exposure.
- Strong encryption and security features are lawful today, everywhere in the US. What's changed is that a prosecutor is willing to test the theory.
- Invoke a lawyer clearly and on the record, every time. Tunick's suppression case turns on his four recorded requests.
- If you run a privacy-hardened device, keep it. Understand which scenario its features are built for.
The bigger picture
We write a lot on this site about smart TVs that scan home networks and assistants that record kitchens. Those are companies trading your attention for money. Annoying, but predictable.
The Tunick case is different. Here the government argues that privacy engineering is itself suspicious. A phone's security feature worked as designed during a coercive search by agents who refused to let the owner call a lawyer, and that became a felony charge.
Whatever the court decides, this case asks one question that deserves a straight answer: is it a crime to protect your own data? We're watching the docket and will report the ruling when it lands.
Sources: United States v. Tunick, 1:25-cr-00499 (N.D. Ga.) docket and motion to suppress; The Guardian, July 23, 2026; TechCrunch, July 24, 2026; Law Commentary, August 22, 2026.