GrapheneOS has asserted that its operating system is “completely legal” and constitutionally protected, a stance that comes as Samuel Tunick faces federal charges for allegedly using the system’s duress PIN feature, which reportedly wiped his phone during a border search. The prosecution, under 18 U.S.C. § 2232, raises significant questions about digital privacy rights, the legality of data-wiping security features, and the potential for such cases to set legal precedents.
Tunick was arrested in January 2025 and is charged under a statute related to the destruction or concealment of records. His federal public defender, Matthew Dodge, stated that Department of Homeland Security (DHS) officers had allegedly called ahead to the airport, requesting Tunick be stopped and his phone searched. Agents reportedly searched his bags and person over his objections, finding nothing. Dodge indicated that agents could have sought a warrant for the search.
Tunick has pleaded not guilty to the charges and faces a maximum of five years in federal prison. He told 404 Media that the charges are “meant to intimidate people against protecting their data” and that the government “hopes to set a precedent that no one has the right to privacy.” Dodge described the charge as “extraordinarily rare,” noting he found only one other prosecution under the same statute, which was in a drug trafficking investigation.
GrapheneOS, a privacy-focused mobile operating system, added the duress PIN feature in June 2024. The company stated on July 27, 2026, that its operating system is “completely legal” and constitutionally protected. GrapheneOS maintains it has “no obligation to weaken any of the security protections it provides” and that any laws attempting to compel such weakening would be unconstitutional. The company also noted that once data is wiped, “there’s nothing we can do to assist with it,” and that bypassing encryption is “not possible” by design.
Tunick described a year of alleged surveillance prior to his indictment, including a tracker on his car and subpoenas for his phone records and Gmail account. His federal public defender, Matthew Dodge, suggested that the government could have sought a warrant but did not.
Customs and Border Protection (CBP) stated that all travelers are subject to inspection, and that searches of electronic devices are rare and decided on a case-by-case basis, taking into account factors such as travel history and law enforcement alerts.
A judge is expected to rule on Tunick’s motion to suppress evidence no earlier than the end of October. The outcome of this motion and the broader case could have significant implications for the legal standing of data protection features in operating systems and the scope of digital privacy rights at borders.
Broader Context
The statement came in a thread about the prosecution, after a user asked whether the project was refusing to cooperate with Homeland Security.
Leave a Reply