Key facts
- GrapheneOS asserts its smartphone operating system is "completely legal" and constitutionally protected.
- Samuel Tunick, an Atlanta activist, is the first person prosecuted in the U.S. involving a GrapheneOS feature.
- Tunick faces charges under 18 U.S.C. § 2232 after allegedly using a duress code to wipe his phone during a warrantless border search in January 2025.
- His public defender argues law enforcement could have obtained a warrant but chose not to.
- GrapheneOS stated that bypassing its encryption is not possible by design and that laws requiring it to weaken security would be unconstitutional.
Privacy software firm GrapheneOS has asserted that its smartphone operating system is "completely legal" and constitutionally protected, following the first U.S. prosecution involving one of its features. The project stated on July 27 that it has no obligation to weaken its security protections, and any laws requiring it to do so would be unconstitutional.
The case involves Atlanta activist Samuel Tunick, who faces up to five years in federal prison under 18 U.S.C. § 2232. Tunick has pleaded not guilty to charges stemming from an alleged incident in January 2025, where he entered a duress code that wiped his Google Pixel phone during a warrantless border search. Tunick told 404 Media that the charges are intended to intimidate individuals from protecting their data and to establish a precedent against the right to privacy.
Tunick's federal public defender, Matthew Dodge, stated that Department of Homeland Security officers could have sought a warrant for the search but did not. Dodge also noted that the statute under which Tunick is charged is "extraordinarily rare," having been used in only one other prosecution he could find, which was in a drug trafficking investigation.
A spokesperson for CBP indicated that all travelers are subject to inspection, and searches of electronic devices are infrequent, decided on a case-by-case basis considering factors like travel history and law enforcement alerts. The U.S. Attorney's Office declined to comment.
GrapheneOS confirmed that the duress PIN feature was added in June 2024 specifically to counter scenarios like the one Tunick described. The firm's founder, Daniel Micay, highlighted the system's defenses against data extraction, noting that the secure element on recommended Google Pixel phones requires owner authentication before firmware updates, serving as a safeguard against "state coercion."