Forgot your password?
typodupeerror
Privacy Crime Government The Courts United States

US Accuses American of Allegedly Wiping His Phone Using a 'Duress' Password During Border Search (techcrunch.com) 181

An anonymous reader quotes a report from TechCrunch: The U.S. Justice Department is prosecuting an American for allegedly providing U.S. border authorities with a passcode that wiped the contents of his phone, according to an indictment and media reports. This is thought to be the first known case in the United States where federal prosecutors have charged someone for the alleged destruction of data using a so-called "duress" password built into a phone's software. According to The Guardian, which covered the story earlier this week following the court's first hearing on Monday, Atlanta resident Samuel Tunick is fighting the charges. Tunick's attorneys said that it was unlawful for U.S. Customs and Border Protection to seize his phone as he arrived back in the U.S. last year, and that any evidence -- including the alleged wiping of his phone -- should be thrown out.

The case centers on a feature included in GrapheneOS, a custom Android operating system that runs in place of the software on most modern Google Pixel devices. Tunick's attorneys confirmed GrapheneOS was running on his phone. The software feature allows the device owner to set a passcode that deliberately wipes the contents of that device if entered instead of the user's unlock passcode. Tunick's case also raises ongoing questions about what constitutional rights can be invoked at the border, which the U.S. government has long asserted is not U.S. soil until a person is authorized to enter.
Bill Budington, a senior staff technologist at the Electronic Frontier Foundation, and Runa Sandvik, a digital security expert who works to protect at-risk people as the founder of security consultancy firm Granitt, told TechCrunch that they had not seen similar cases involving the use of duress passwords.

"I have not seen this before, though I've discussed the potential scenario with activists and journalists over the years," said Sandvik. "I think this case serves as a reminder that authorities may argue you knowingly destroyed data, so it's better to not have that data on you when you cross certain borders."

"With a little planning ahead of time, you can always download the data you need once you get to where you're going," said Sandvik.

US Accuses American of Allegedly Wiping His Phone Using a 'Duress' Password During Border Search

Comments Filter:
  • by hwstar ( 35834 ) on Friday July 24, 2026 @06:04PM (#66255438)

    There should be an option for a password which unlocks the phone in a separate sandbox which is benign.

    Of course, if the government has a warrant, even this will get you into trouble.

    • by flug ( 589009 ) on Friday July 24, 2026 @06:20PM (#66255452)

      Yes, ideally it wouldn't just wipe - which makes it obvious to everyone what has happened - but instead replaced with something perfectly normal and innocuous.

      Regardless, this whole thing of making people hand over their passwords is what should be illegal.

      • by AmiMoJo ( 196126 )

        It's very difficult to make it look "normal", because they will look at things like usage logs. If it doesn't show calls that match what your phone provider has, if it doesn't show recent emails matching your Outlook account, and if it doesn't have plausible web browsing and maps navigation from the last few days, they are going to know that something is up.

    • by gweihir ( 88907 )

      Not doable with any reliability. This is a fantasy many have and that completely fails in reality. Do not have any data on there you do not when them to see when crossing the border. Nothing else will do it.

      • by hwstar ( 35834 ) on Friday July 24, 2026 @06:48PM (#66255496)

        Not a lawyer and this is not legal advice:

        I researched this some more after my initial post. You are correct about plausible deniability. You want to access that data in the cloud and then clear all session keys and access tokens, along with browser history when you cross the border. The border search doesn't extend beyond your phone, and they actually put your phone in airplane mode when they do the search. They can however, inter your phone for however long they wish, and you up to 5 days before you can file a writ of habeus corpus.

        • by gweihir ( 88907 ) on Friday July 24, 2026 @07:28PM (#66255524)

          Thanks. Always good that at least some people look at actual facts.

          Also remember that this is not really about getting your data. Only idiots have problematic data on their phone when they cross the US border. Sure, they may catch the occasional child molester or the like, but they will not catch any terrorist or spies that way. Primarily this is about harassment and making people fear them. Better be prepared for potentially needing a new phone after crossing that border.

      • Surely it couldn't be too hard to generate plausible looking data on a second sandbox(finally a use for LLMs). Ideally a second password would wipe the main sandbox and show the second one as if it were the only one.
        • by gweihir ( 88907 )

          Basically all actual security experts agree that a) this has a far too high probability of failing, landing you in hot water and b) there _really_ is no need. Just put the data encrypted on some cloud account and download after crossing the border.

      • by Jeremi ( 14640 )

        Not doable with any reliability. This is a fantasy many have and that completely fails in reality.

        There's nothing like saying "it can't be done" to make a nerd's imagination fire...

        I'd start with a filesystem that stores all data encrypted, so that without the proper decryption key, there's no way to tell whether a given block of storage contains encrypted data or random noise. We'd overwrite the entire drive with random noise on install, of course.

        Then on top of that, add a layer that determines which subset of the physical blocks to use based on a hash of the decryption key; so if you log in with pas

        • If they plugged it into a forensics terminal they'd likely see right away that the device OS isn't reporting the correct blocks.

          You'd need a custom hardware security chip that switched in different sets of memory.

    • There should be an option for a password which unlocks the phone in a separate sandbox which is benign.

      Or, alternatively, the password could simply wipe all your files (including any password databases) before it unlocks the phone - leaving the OS intact.

      Maybe it could also add a couple photos of Donald J. Trump to your photo library at the same time.

    • There should be an option for a password which unlocks the phone in a separate sandbox which is benign.

      Of course, if the government has a warrant, even this will get you into trouble.

      I think the most plausibly-deniable strategy is to put the phone into a state where it shows the OS setup wizard when powered on, making it look like you wiped it and powered it down just before going through the border checkpoint. Then to reactivate it you have to go through the "setup" process and when you get to the password configuration if you enter the correct password it unlocks and returns to normal. If not, it boots to an apparently freshly-setup state. I think this would be much easier to corre

  • Good for him! (Score:5, Insightful)

    by Local ID10T ( 790134 ) <ID10T.L.USER@gmail.com> on Friday July 24, 2026 @06:06PM (#66255442) Homepage

    If he actually did what he is accused of, then good for him! I hope the ACLU steps in to provide for his defense.

    I would wish that the court would find "Fuck you, he has the right to privacy" (wishful thinking, I know...)

    Even if he wins in the end, they are going to make his life hell.

    • Yeah, on reading the links, it looks like his lawyers already have a lot of that covered.

      The law they are using is 18 U.S. Code 2232 [cornell.edu], and it's on pretty shaky ground. If you're reading it at non-lawyer eyes, sure the law uses words that seem to fit.

      For the current administration, that's all they need to make the accusations.

      For the defense lawyers there's going to be a long list of reasons that law doesn't apply, and it's got all kinds of reasons the judge is going to dismiss it. The "Terrorism Respons

      • For the current administration, that's all they need to make the accusations.

        That's one of the reasons they keep losing in court - they don't really have any competent lawyers in this administration.

      • Maybe. There are multiple SCOTUS rulings that basically declare border checkpoints to be a 4th amendment-free zone. If that means that the agents are "authorized to make such search or seizure", then 18USC2232(a) looks like a problem for him to me.

        • Oh, it's not just that, they claim 100 miles from any border now.

          Since I'm in New Hampshire and there's no part of the state further than 100 miles from a border, I've had to inform my friends that we've been kicked out of the United States.

          Our ratification of the Constitution by the Legislature is what makes New Hampshire part of the United States. If the Constitution doesn't apply, well then the ratification has been nullified by DC. Unfortunate, but not our choosing.

          This would apply to any of the Thirte

        • Exactly, his lawyer raising the warrant issue in this context is like shouting, "I got nothing!" They're required to make some sort of defense.

          There's about a Planck's_Constant% chance that the current SCOTUS overrules precedent to require warrants for border inspections. With a Hail Mary, you expect they're some chance of it being caught and affecting the outcome. Here, it's like a runner who is a lap behind diving forwards when they see another runner about to cross the finish line. All they did was fall

        • by dfghjk ( 711126 )

          '...agents are "authorized to make such search or seizure"...'

          How can they be authorized when they are not on US soil? Who authorizes them?

      • Not sure why you think that link supports the defense, it seems like a slam-dunk for the prosecution.

        A long list of reasons why federal law doesn't apply? Name one reason why this law doesn't apply in this case. Even just one.

        You're implying you're a lawyer with your phrasing, but your words are so stupid I suspect you're just a word-lawyer out of his depth.

        Why would this be any different than running to the bathroom and flushing something down the toilet while there's a cop at your door shouting, "Search w

        • Name one reason why this law doesn't apply in this case. Even just one.

          Here's one - The law only refers to property, not digital information. The physical item was not damaged in any way.

  • by gweihir ( 88907 ) on Friday July 24, 2026 @06:16PM (#66255448)

    I and many others have argued here and in other places against this stupidity time and again. But people do not listen and think they have it all figured out...

    The real solution is to not have any problematic data on your devices. You may want to do a secure wipe after they got their hands on on them though, or discard them entirely. No telling what kinds of malware they will put on there.

  • Keep doing it (Score:3, Insightful)

    by Bahbus ( 1180627 ) on Friday July 24, 2026 @06:26PM (#66255456) Homepage

    Fuck the US Justice Dept and fuck the border authorities. It's not their device. And the information contained within it, whatever it may be, isn't theirs either. Either you already have some sort of proof of a crime, which makes them stupid for asking for the passcode; or, they're seizing the phone to go on a fishing expedition to find something worth arresting over.

    I setup my phone to do the same thing. Doesn't matter that I don't have anything illegal on it, they have no right to see or access any data stored on it. If I ever might need to deal with these types of shitty rent-a-cops, I'd probably go a step further and set it up so that if I don't type in the normal password at regular intervals, it automatically wipes itself. If it spends to much time powered down, wipes itself on boot. Etc.

    • Border inspections are fundamentally fishing expeditions. By design.

      Just because you don't know who the smugglers are, you don't check anything? Probable cause makes sense in daily life, but when crossing from one country to another it makes sense for them to be allowed to do inspections. Those are legal searches.

      The fact that cops are assholes and being searched creates a danger even to those obeying the law is a problem, and it would be great if society could find some way to address it. However, looking

      • by Bahbus ( 1180627 )

        Just because you don't know who the smugglers are, you don't check anything?

        They can physically inspect all my stuff as much as they like. Unless I am under arrest they do not get to also access my digital information.

        However, looking down on federal agents won't keep you from going to prison for being a moron. Which is what you're describing in having this type of setup.

        I don't care. I can recover my data, they cannot.

        Another approach is not to even bring your regular phone with you on international travel.

        While it may be the technically better legal way around this shit, it's also the more expensive and boring way.

  • Then you have fuck all right to complain about what people do on it.

    I know consistency is out of fashion in the US, but people really should demand that their constitutional rights actually be inviolable, and not magically irrelevant because a power-tripping fascist says they don't apply under certain circumstances.

    • by Mascot ( 120795 ) on Friday July 24, 2026 @06:31PM (#66255470)

      I was thinking something similar. If it's not US soil, then US officials have no jurisdiction there and no basis for complaining about what anyone does there.

      • Re: (Score:3, Interesting)

        by cusco ( 717999 )

        Maybe not, but Presidiots since Shrub have decided they have the right to KILL you for your activities in other countries, US citizen or not, and will send a drone to fire a million dollar missile to take out you and everyone in your vicinity. No trial or even any evidence necessary.

    • by dfghjk ( 711126 )

      The Constitution has been rendered moot by the Supreme Court. The President, and by extension the executive branch, is immune from law. You have no constitutional rights, only constitutional suggestions that federal law enforcement can ignore (and are instructed to do so). Citizens are now shot in the streets.

    • And the “border” has been expanded in definition to bootstrap our lack of rights to everything within 100 miles of the actual border, never mind the millions and millions of citizens within that boundary, including our coasts. 2/3 of the US population is subject to these reduced rights, including entire states, well over 90% of the California population.

      You can be warrantlessly detained in this region, allowing a border patrol agent to hold you, question you, and attempt to find (or fabricate)

  • by BrightCandle ( 636365 ) on Friday July 24, 2026 @06:30PM (#66255468)
    The problem is there isn't any difference between a phone you cleared before you travelled or just before landing compared to one that is cleared with a duress pin. They can't prove a duress pin was used only that the phone is now indeed empty and there is no reasonable law requiring people to have their entire lives documented in their phone. Given the state of the USA right now I would fly with an empty phone too, not that I fly to countries run by dangerous dictators.
  • by gurps_npc ( 621217 ) on Friday July 24, 2026 @06:34PM (#66255476) Homepage

    I thought they needed a warrant or other court order to make destruction of evidence a crime. Having a cop merely ask to see your phone does not establish a right to see it.
    Would it have been a crime to do it before they asked for it?
    Would it matter if they did it 5 seconds before they asked, or 5 days before they asked?

    I am not a lawyer, but I do know that corporations routinely destroy evidence. For it to be a crime, they need to have been served with a warrant BEFORE they destroy the evidence.

    • He didn't wipe it, he was in custody. He was handcuffed and prevented from accessing it. Any data provided *could* and *was* used to defend him, including providing orders to his digital attorney.

    • So, I'm totally not a lawyer, but I find the vagaries and nuances of law fascinating. Perhaps I can help clarify some details.

      First, he was at an airport and had not yet been permitted entry to the USA - in a sense, they were still in "international waters." The government maintains that anyone entering the country at a border may be subject to warrantless search by 19 USC 482 which was originally to allow searching of boats to seize any contraband. CBP doesn't need to have probable cause for the search. Fu

      • by Bahbus ( 1180627 )

        18 USC 2232(a) "Destruction of Property to Prevent Seizure."

        And this is easy to argue out of. Personal digital data is not property. There was no destruction, damage, waste, disposal of, transfer, or otherwise any action preventing or impairing the Government’s lawful authority to take such property [the phone] into its custody or control. They had the phone. They could keep it if they wanted and try to recover the data - which, if at all possible, I would try to make sure the only thing recoverable is a picture of a middle finger.

        • You make good point. As an intellectual exercise if I were arguing for the government I'd establish that digital data such as files are considered property, specifically, intangible property. By providing the duress-code, the defendant knowingly destroyed digital data stored within the device to be searched preventing that data from being seized. I'd cite Yates v. United States (2015)[1] regarding how narrowly the word "property" should be interpreted. The legal principle of noscitur a sociis (a word is kno

  • Oh Hell No! (Score:5, Interesting)

    by RitchCraft ( 6454710 ) on Friday July 24, 2026 @06:39PM (#66255484)

    I didn't serve my country for six years, in a war to boot, to have this kind of fuckery going on. Searching an American citizen, wanting to enter their home country, without a warrant is bull shit. Authorities can argue all day long about what pretext they believe this falls under, but in the end our rights win above all. This had better get thrown out and a precedent set.

    • Well, If a president can order people to be arrested anywhere in the country for the sake of the border just because their skin and hair is too dark.... If another president's very discussion of the topic because his/her skin and hair is too dark causes the individuals carrying out the orders in the first case to cry "unconstitutional!" in the second case.... We already lost the argument over "who's data" a long time ago.

    • Yes you did. This kind of fuckery has been going on for a very long time in one form or another.

  • Download? (Score:2, Interesting)

    by PPH ( 736903 )

    "With a little planning ahead of time, you can always download the data you need once you get to where you're going," said Sandvik.

    From where? Remember; the cloud is nothing more than someone else's computer.

    • From an encrypted container file that was uploaded from your device to anywhere convenient.

      • by PPH ( 736903 )

        Good. Then after wiping his phone and placing him in detention, CBP can grab a copy of that upload and he can try again. But this time, with the correct password. Wiped it again? Another copy, rinse and repeat.

        Tunick's case also raises ongoing questions about what constitutional rights can be invoked at the border, which the U.S. government has long asserted is not U.S. soil until a person is authorized to enter.

        So he's not even back on US soil yet? Habeas corpus does not yet apply.

        • How does CBP know where the upload is? Is the uploaded file publicly accessible or would they need another password to even get their hands on it?

          So he's not even back on US soil yet? Habeas corpus does not yet apply.

          Defending the concept of a constitution-free tyranny zone for foreigners (where US border patrol somehow still has legal authority?) is fashy enough, but it's really freaking bad when you use it to strip an American citizen of the rights their own country affords them.

          • by PPH ( 736903 )

            How does CBP know where the upload is? Is the uploaded file publicly accessible or would they need another password to even get their hands on it?

            Because he tells them through the jail cell bars as they enter the address and passwords into the phone. Give them a code that wipes the backup and he's going to be there for a loooong time.

    • by Striek ( 1811980 )

      It really doesn't matter. The point is that border agents can't.

    • Another option is to use software like VeraCrypt to encrypt sensitive data into a file on your PC. Make it look like an innocuous system file and put it in the system folder somewhere. Don't leave VeraCrypt installed - it will run installer-free, download it at your destination and remove it before traveling again.

      There's a double level of security if you use the option where it has a second dummy decryption container in the same file that you can give away.

      But yea, if you can securely download what you

    • "the cloud is nothing more than someone else's computer."

      The cloud can also be your own computer at home, while you're on the road.

  • Thought experiment (Score:4, Insightful)

    by 93 Escort Wagon ( 326346 ) on Friday July 24, 2026 @07:45PM (#66255546)

    If the Border Patrol can claim you aren't (yet) on US soil, I'd think they also have no jurisdiction over you yet because you're not on US soil.

  • So claiming 5th is no longer legal or applicable in this case? Does it note extend to supplying whit self-incriminating evidence?

    • by PPH ( 736903 )

      CBP may have no interest in bringing a court case. They might be happy with the intel alone.

      • Yea, after some research: the 5th protects your brain - that is pins/passwords etc. you'd rendered and these would lead to self incrimination. These necessarily you'd have to 'retrieved' from your brain. Apparently, they can unlock the phone legally with your face and perhaps with fingertip. So the advice was to power off the phone so the pin is necessary. However, not unlocking the phone would make them to impound it for some time, weeks likely. They still have to make a 'reasonable cause' to do so, and

  • "This big, ugly Boarder Officer was in my face and frightened me. My brain/memory did not work properly, the stress of it all made me remember the wrong password which wiped my 'phone."

    This may be true. However if they have it in for you they will get you.

  • What? Knowingly destroying data? He is in their custody. How could he do anything?

    Do you mean he setup a device to honor him against illegal searches and it functioned as intended? He set that up before he knew about the illegal search so he hasn't done anything since except provide some speech which *can* and *will* be used to defend him.

    Where does this end? Not being allowed to have a password? Not being allowed to say "$AGENT lock my phone" when you see police walking up? Not being allowed to store data

  • by kiore ( 734594 ) on Saturday July 25, 2026 @02:35AM (#66255882) Homepage Journal

    Before leaving, buy a cheap phone and load onto it:

    • Photos of your passport's identity page
    • Photos of your tickets
    • A copy of any hotel reservations, etc.
    • Credit card numbers and international phone numbers for your card company's service desk. NB: 1800 may not work internationally.
    • A limited selection of other phone numbers you may need to call.
    • A fairly new social media account connected to with friends and family.

    While travelling, if the phone is ever out of your sight, assume it has had spyware installed.

    On returning home, save your holiday photos and ditch this phone

  • by Smonster ( 2884001 ) on Saturday July 25, 2026 @08:56AM (#66256038)
    If you are that concerned about hiding your content from the government, it seems it would be less suspicious to back up the device, wipe it. Install minimalist backup designed to look like the phone is still actually used. Then reinstall it with your full backup afterwards.

    It is more of a pain to be proactive than reactive, but it would have avoided the mess this person now has to deal with. Obviously we shouldn’t have to worry about any of this in the first place, but unfortunately that isn’t the world we live in. I don’t have any sensitive data on my phone or laptop hd, so for me personally I don’t care. But on principle I do think it is excessive. And if I were a reporter or activist I would definitely be proactive about it instead of reactive.
  • by glum64 ( 8102266 ) on Saturday July 25, 2026 @11:34AM (#66256198)

    A smart person knows how how to get of of trouble; a wise one avoids it.

    The moment you provide a wipeout password or plausibly deny a fact (i.e., basically, you tell a lie that you think sounds good enough), you start a game with an extremely powerful organisation [wikipedia.org] that has a proven history of bending rules of all games. You also foolishly make a mistake of thinking that you know that special trick that helps you win the game. You also foolishly ignore clear warnings about the jurisdiction in effect. You start the game being in a tremendous disadvantage that you fail to recognise.

    Wise people follow a set of rules:

    1. Have your papers in order; do not carry anything incriminating across the border. This is a non-negotiable rule.
    2. Be 100% sober. Getting stoned or drunk en route is a terrible idea anyway.
    3. Look plain and unassuming. Live that Mr. Robot hoodie at home. Dress as an average boring commoner of your age and sex would. Be clean and look clean. Smell good. Wear appropriate footwear, always prefer closed footwear. Do not carry items that attract attention, e.g. a dirty laptop with political slogans all over it does attract attention. Items that do not look the way you look do attract attention (e.g., you wear a business suit and hold a dirty and beaten Nokia 3220 [wikipedia.org]). Carry an appropriate amount of luggage (entering with a slim backpack after being away for 90 days does attract attention).
    4. Do not carry anything that looks strange or curious. The use or purpose of anything you have with you should be easily recognisable.
    5. Put on your best behaviour. Spitting on the floor, yelling across the hall, etc. will get you noticed. Remember: in most large ports of entry you are being watched, both remotely and by plainclothes security personnel.
    6. Be attentive, serious, polite, reserved, and respectful. Take out both of your earbuds or take off headphones immediately when addressed. Do the same before addressing others. Do not eat, drink, or chew. Do not speak unless you are spoken to or unless speaking is absolutely necessary for crossing the border. Greet and address all personnel appropriately: Madam, Sir, Officer. Being cocky will surely get you noticed. Do not attempt making jokes — security personnel may not share your wonderful sense of humour.
    7. Cooperate. Cooperate. Cooperate. Remember that you deal with people that perform boring, repetitive work. Do not be that person that makes their work any harder. If an officer is overly curious, feed that curiosity readily but in small portions, without making a scene.
    8. Being sad or mildly upset is OK. Being outraged and indignant is NOT OK. Do not ever raise your voice. Be calm.
    9. Answer all questions but do not volunteer information. When asked Do you go to a college?, the proper answer is either Yes or No, depending on your circumstances. The improper answer would be the complete details of the place followed by a prolonged rant how you hate that professor. You should provide further details if and only if asked about them.
    10. Remember, your main purpose is to leave the port of entry ASAP and continue freely to your destination.

    • The fact that these rules need to be written at all should tell us that we now live in a police state. I took an oath at age 19 when I was inducted into the Army, that binds me to support and DEFEND the Constitution, I've never been relieved of that oath. The fact that a group of unelected bureaucrats somewhere in DC has decreed that I, as a citizen of this nation MUST allow access to my most PRIVATE communications when returning from a foreign country is FAR BEYOND UNCONSTITUTIONAL. And if I contrive a way

Truly simple systems... require infinite testing. -- Norman Augustine

Working...