The GrapheneOS Panic-Wipe Case: When Anti-Forensics Meets Border Search Law

In January 2025, Samuel Tunick, an Atlanta activist tied to the movement opposing the city's police training center, landed at Hartsfield-Jackson after a trip to the Dominican Republic. CBP pulled him into secondary inspection and demanded his phone password, and his lawyers say agents skipped Miranda warnings, refused his requests for a lawyer, and told him no warrant was needed.

He gave a passcode. According to the court filing, "the screen went black, flashed several times and the phone appeared to restart". That behavior matches a GrapheneOS duress PIN, an alternate credential that looks like a normal unlock but quietly triggers an irreversible wipe.

The government charged Tunick in November 2025 under a statute covering destruction of property to prevent a lawful government seizure, with a maximum of 5 years in prison. It may be the first prosecution centered specifically on a GrapheneOS duress-PIN wipe.

A duress PIN is a second unlock code you set up in advance. At the lockscreen there is nothing to tell it apart from your real code, no confirmation prompt and no warning. Type the real one and the phone unlocks; type the duress one and it wipes the keys that make the encrypted data readable.

The wipe targets the key derivation material, so there is no plaintext left to recover. GrapheneOS put it bluntly: "Data cannot be recovered after the key derivation material is reliably wiped. It's not possible and there's nothing we can do to assist with it". The hardware and software are built so that no vendor backdoor can undo it.

Here is the detail the case may turn on: Tunick never typed the code that wiped his phone. He handed over the duress credential as if it were his real password, and the CBP officer entered it. The wipe was set in motion by the officer's own hand.

The defense frames it as compelled disclosure, with the destructive act being CBP's independent choice to type an unfamiliar code. The prosecution's theory leans on intent: if you knowingly hand over a credential designed to destroy evidence, your speech is what starts a chain of events you knew would end in a wipe. Whether that counts as the defendant destroying property is genuinely unsettled.

Rather than cheer the duress feature, GrapheneOS mostly steered attention elsewhere. Its auto-reboot timer restarts a locked device after a set idle period, dropping it back to the Before First Unlock state where the encryption keys are not resident in memory and cannot be pulled out by forensic tools.

The project also points to how far behind extraction vendors sit. A GrapheneOS account citing leaked Cellebrite documents said the newest GrapheneOS release those tools could exploit on a locked device was still from 2022 as of recently. Combined with the default charging-only USB mode when locked, the physical attack surface is thin before anyone reaches for a wipe.

On the duress PIN itself, GrapheneOS urged caution: "People should carefully consider how to use it in an actual duress situation where there can be physical or legal consequences for wiping the device". It defends the feature as legal while nudging users toward protections that don't invite a destruction charge.

The border search exception lets CBP inspect travelers and their devices without a warrant or individualized suspicion. CBP's stated position is that "all travelers are obligated to present their electronic devices and the information resident on the device in a condition that allows for the examination of the device and its contents".

Tunick's team moved to suppress everything from the interrogation, arguing the search was an unreasonable seizure and that the child-abuse-material pretext masked an investigation into his political activity. Riley v. California required a warrant to search a phone after arrest but never resolved the border context, so lower courts remain split.

Device searches at the border are still rare. In fiscal year 2025, CBP data shows fewer than 0.1% of arriving international travelers had a device searched. Tunick was one of them, and his case now tests whether protecting your own data can itself become a federal crime.