Using a Security Feature Is Now a Felony at the Border

TITLE: Using a Security Feature Is Now a Felony at the Border

On January 24, 2025, Samuel Tunick landed at Atlanta's Hartsfield-Jackson airport returning from holiday abroad. He was stopped for secondary inspection, and prosecutors allege that when he handed over a passcode to agents, it triggered a factory reset rather than unlocking the device. The phone was running GrapheneOS. GrapheneOS lets users configure a duress PIN that looks like a normal authentication code but triggers an irreversible wipe when entered. It is designed for situations where someone is being forced to unlock a device, and there is no confirmation prompt or other clue that would give away what the alternative code is doing.

Tunick has pleaded not guilty. This is thought to be the first known case in the United States where federal prosecutors have charged someone for the alleged destruction of data using a duress password built into a phone's software.

Everyone is calling this a civil liberties story: government overreach versus security screening, two sides drawing lines, courts will sort it out. That framing misses what the law actually does, which is more radical than the headline.

What the Charge Says

The government is invoking 18 U.S.C. § 1519, a little-known statute making it illegal to destroy property to prevent authorities from seizing it. Maximum sentence: 20 years. The law covers whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States.

Notice what is absent: any requirement that the defendant knew an investigation existed. The Ninth Circuit Model Jury Instructions make clear that the defendant need not know the matter falls within federal jurisdiction. Ignorance is not a defense. The DOJ does not need to prove Tunick knew he was under investigation. Mere use of the tool is the conduct.

Translation: you complied. You handed them a passcode. The fact that it did what the manufacturer advertised is now the crime.

The motion said border agents claimed they did not need a warrant because Tunick had not yet crossed the U.S. border. The U.S. government has long claimed it can search devices without warrant or court order until entry is permitted. At U.S. borders and international airports, the border search exception applies: the government has argued that routine searches require no warrant, reasonable suspicion, or probable cause.

The legal terrain going in was already hostile to the traveler. Tunick adds a second layer: technical resistance to a warrantless search may itself be felony obstruction.

Why This Charge Is Different

The defense has a real argument. Tunick's attorneys said it was unlawful for U.S. Customs and Border Protection to seize his phone as he arrived back in the U.S. and that any evidence should be thrown out. If the seizure was unlawful, the obstruction charge collapses. Attorneys allege the search was a pretext to investigate Tunick's association with the Defend the Atlanta Forest movement, which opposes the 'Cop City' law enforcement training campus. If that holds and the government had no legitimate basis for the search, the whole theory fails.

But assume the courts decide the search was lawful.

The precedent that follows is severe. Prosecutors charged Tunick under federal law making it an offense to knowingly destroy property to prevent its lawful seizure. The duress PIN wipes the device instead of unlocking it, for use when you may be forced to hand over access against your will. That is the product description. Charging someone for using a feature is charging someone for owning it.

The indictment itself signals amateur hour. The government's indictment, which contains a typo ("Untied States Code"), accuses Tunick of allegedly providing a passcode that caused the phone to "delete the digital contents," prior to seizure. Drafting errors in a first-of-its-kind filing mean prosecutors are working without a template. That cuts both ways: dangerous while precedent is soft, exploitable by skilled defense.

Matthew Dodge, an assistant federal public defender on Tunick's team, described use of the statute in this context as incredibly rare. Bill Budington, senior staff technologist at the Electronic Frontier Foundation, and Runa Sandvik, a digital security expert and founder of security consultancy Granitt, told TechCrunch they had not seen similar cases involving duress passwords.

Nobody has, because until now, using a security feature was not a crime.

What It Costs You

If this charge sticks, every operator carrying hardened hardware across a U.S. border is exposed to a theory that security posture is probable cause. Duress PINs become a liability instead of a feature. Manufacturers who market privacy tools face pressure from arrested users.

Your travel policy has a gap. If your security team instructs executives and engineers to use hardened devices, those devices may now be a felony at secondary screening. Traveling with an unencrypted device to avoid obstruction charges is not security. It is capitulation in advance.

The real target may not be Samuel Tunick. It is the operating system that made the duress PIN possible, and the operators who made it standard practice.

What to watch: Whether the court suppresses the evidence on unlawful seizure grounds, ending this before the obstruction theory gets tested. Whether CBP issues formal guidance treating specific hardware or software as suspicious at checkpoints. Whether GrapheneOS or the EFF files amicus briefs as argument proceeds. Whether corporate legal and security teams update travel policies before the next secondary screening pulls one of your people.