‘Completely Legal’: GrapheneOS Pushes Back as Duress Password Case Proceeds

Privacy software firm GrapheneOS has said its smartphone operating system is “completely legal” and constitutionally protected, as the first U.S. prosecution involving one of its features moves through the courts. “We have no obligation to weaken any of the security protections it provides,” the project tweeted on July 27, adding that laws requiring it to do so “would be unconstitutional.”

The statement came in a thread about the prosecution, after a user asked whether the project was refusing to cooperate with Homeland Security. GrapheneOS said it could not. Once key material is wiped, “there’s nothing we can do to assist with it,” it wrote, and bypassing encryption is “not possible” by design.

Samuel Tunick, an Atlanta activist, is charged under 18 U.S.C. § 2232 after allegedly entering a duress code that wiped his Google Pixel during a warrantless border search in January 2025. He has pleaded not guilty and faces up to five years in federal prison. A judge is expected to rule on his motion to suppress no earlier than the end of October.

‘Meant to intimidate’

Tunick told 404 Media the case is aimed at deterring others. The charges are “meant to intimidate people against protecting their data,” he said, and the government “hopes to set a precedent that no one has the right to privacy.” He described a year of surveillance before the indictment, including a tracker on his car and subpoenas for his phone records and Gmail account.

His federal public defender, Matthew Dodge, said DHS officers called ahead to the airport and asked that Tunick be stopped and his phone searched. Agents searched his bags and person over his objections and found nothing, Dodge said, and could have sought a warrant. “They didn’t do that,” he said. Dodge found one other prosecution under the same statute, in a drug trafficking investigation, calling the charge “extraordinarily rare.”

The government’s position

A CBP spokesperson told 404 Media that all travelers are subject to inspection, and that searches of electronic devices are rare and decided case by case, taking account of travel history and law enforcement alerts. The U.S. Attorney’s Office declined to comment.

GrapheneOS added the duress PIN in June 2024 for exactly the scenario Tunick describes, with its founder Daniel Micay pointing to a published overview of the system’s defenses against data extraction. In a tweet it said that the secure element in the Google Pixel phone recommended by GrapheneOS firmware updates only after the owner authenticates, a defense against “state coercion.”