GrapheneOS says its data-wiping "duress" password is perfectly legal, after user faces federal charges

[Alfonso Maruccia]

Get Off My Phone: The recently unveiled case brought by the US Department of Justice against a GrapheneOS user is rekindling debate around privacy and effective operational security on mobile devices. The GrapheneOS Foundation has joined that debate, reaffirming some key points about the operating system's security features and whether previously deleted data can ever be recovered.

According to the GrapheneOS Foundation, the operating system that got Sam Tunick prosecuted by the US government has nothing to do with unlawful practices. The Toronto, Canada-based non-profit joined the fray to defend its open-source OS, which it maintains is a completely legal platform under US law.

The foundation says it has no obligation to weaken GrapheneOS features designed to improve user and data security. The Android-based OS, it argues, is protected by the US Constitution, meaning no one can (theoretically) be prosecuted for creating, developing, or even using the platform on their devices.

– GrapheneOS (@GrapheneOS) July 27, 2026

The foundation also believes any new law designed to make the software or its security features illegal would likely be unconstitutional. Similarly, the organization confirmed that once data has been wiped from a GrapheneOS-powered phone, there's no way to recover any of it.

The software, and the hardware it's compatible with (Google Pixel phones for now) is designed specifically to prevent attempts to bypass or tamper with data encryption.

Tunick ran into trouble after providing a US Customs and Border Protection officer with a "duress password," one of GrapheneOS' options for strengthening a user's right to privacy. Once used to forcibly unlock a phone, the duress password/PIN wipes all data on the device, including eSIM content. The process happens instantly, can't be stopped, and is irreversible.

The GrapheneOS Foundation has since tried to downplay the importance of duress passwords for the platform's security. The feature, the organization said, is just a minor option within a much broader security model. It can also carry physical or legal consequences, which is why users should carefully weigh whether it's the right approach for outsmarting attackers or coercive enforcement attempts by federal agents.

The lawyer representing Tunick against the US government said the border agent failed to read Tunick his Miranda rights, as required, and ignored his requests to speak with a lawyer. The lawyer is now trying to get a US judge to dismiss all evidence recovered in the case, arguing that Tunick's constitutional rights were violated.

Permalink to story:

GrapheneOS says its data-wiping "duress" password is perfectly legal, after user faces federal charges

 

[LordVile95]

Would be interesting to see which part of the constitution they believe protects it.

 

[Dreadcthulhu]

Would be interesting to see which part of the constitution they believe protects it.

My opinion is that Graphene OS should be able to offer that "duress password" as an option; free speech protects the code needed to write those functions. If it is your phone, you should be able to wipe it whenever you choose too, or set the wipe command to be whatever you want it to be. However, if someone uses that option to wipe the phone before a legitimate government investigation then that person should subject to the same penalty they would get if they destroyed potential evidence by other methods, like slamming the phone into the ground.

 

[yRaz]

A few things I love about this case
>this did not happen on US land so US law shouldn't apply
>he did not destroy evidence, the investigators did. He just gave them a code and the investigators entered it
>it can't be proven that the investigators didn't enter the code incorrectly

There is protocol for how these devices are supposed to be handled and the investigators screwed up in basically every step of the process.

But here is the thing about grapheneOS, it encrypts itself after a few hours of not being used

 

[Squid Surprise]

A few things I love about this case
>this did not happen on US land so US law shouldn't apply
>he did not destroy evidence, the investigators did. He just gave them a code and the investigators entered it
>it can't be proven that the investigators didn't enter the code incorrectly

It was in Atlanta’s airport - so it was on US land.
And the only way for all the data to be deleted would have been using the duress password - an “incorrect password” would simply have encrypted the data.

Of course, by not allowing a lawyer and reading rights, they messed up… and I still don’t think it should be illegal to wipe your phone - although in this case, it probably was.

 

[yRaz]

It was in Atlanta’s airport - so it was on US land.
And the only way for all the data to be deleted would have been using the duress password - an “incorrect password” would simply have encrypted the data.

Of course, by not allowing a lawyer and reading rights, they messed up… and I still don’t think it should be illegal to wipe your phone - although in this case, it probably was.

What im saying is that we don't know if the real password and duress password were similar enough that a typeo could have activated it. I also saw somewhere that airports are not sovereign land. You dont technically enter the country until you leave the airport

 

[Squid Surprise]

What im saying is that we don't know if the real password and duress password were similar enough that a typeo could have activated it. I also saw somewhere that airports are not sovereign land. You dont technically enter the country until you leave the airport

Once you hit customs, you are on US soil…

 

[Endymio]

A few things I love about this case
>this did not happen on US land so US law shouldn't apply

Get ready to post another refrigerator photo, as you have again made an absurd factual error: this happened at Atlanta International Airport.

>he did not destroy evidence, the investigators did.

Oops again! It was his act of providing a self-destruct code that led to the destruction. Your juvenile argument is like claiming had he handed the police a booby-trapped briefcase, rigged to explode, that whoever opened the case was guilty of the deaths and destruction that resulted, not him.

>it can't be proven that the investigators didn't enter the code incorrectly

Of course it can.

There is protocol for how these devices are supposed to be handled and the investigators screwed up in basically every step of the process.

Who told you something so absurd? You're confusing a routine border search with a criminal investigation.

 

[axiomatic13]

I now have GrapheneOS running on my Pixel. The duress password is 8647.

 

[yRaz]

Once you hit customs, you are on US soil…

My point is that the case lacks consistency. Either he didn't have 4th amendment rights because he wasn't in the US meaning the US can't charge him for a crime or he was on US soil requiring a warrant to search his phone. Either way, the strength of what he is charged with is in question

 

[Endymio]

My point is that the case lacks consistency. Either he didn't have 4th amendment rights because he wasn't in the US ...

He was in the US. Do you believe Atlanta is located in Zimbabwe?

...or he was on US soil requiring a warrant to search his phone.

Hello, and welcome to Planet Earth. Hope you enjoy your stay:

"....The border search exception allows federal authorities to conduct routine, warrantless searches and inspections of people and property entering or leaving the United States without any individualized suspicion, probable cause, or a warrant...."

https://constitution.congress.gov/browse/essay/amdt4-6-6-3/ALDE_00000239/

 

[yRaz]

He was in the US. Do you believe Atlanta is located in Zimbabwe?


Hello, and welcome to Planet Earth. Hope you enjoy your stay:

"....The border search exception allows federal authorities to conduct routine, warrantless searches and inspections of people and property entering or leaving the United States without any individualized suspicion, probable cause, or a warrant...."

https://constitution.congress.gov/browse/essay/amdt4-6-6-3/ALDE_00000239/

Get ready to post another refrigerator photo, as you have again made an absurd factual error: this happened at Atlanta International Airport.


Oops again! It was his act of providing a self-destruct code that led to the destruction. Your juvenile argument is like claiming had he handed the police a booby-trapped briefcase, rigged to explode, that whoever opened the case was guilty of the deaths and destruction that resulted, not him.


Of course it can.


Who told you something so absurd? You're confusing a routine border search with a criminal investigation.

 

[Theinsanegamer]

My point is that the case lacks consistency. Either he didn't have 4th amendment rights because he wasn't in the US meaning the US can't charge him for a crime or he was on US soil requiring a warrant to search his phone. Either way, the strength of what he is charged with is in question

It does not lack consistency. There is a border exemption to the 4th amendment, which has existed since 1789.

It was literally written in there by the founding fathers themselves. It is not unconstitutional to search your device at a border crossing without a warrant. When you travel into the us via airplane, that airport is considered a border crossing.

 

[Dreadcthulhu]

It does not lack consistency. There is a border exemption to the 4th amendment, which has existed since 1789.

It was literally written in there by the founding fathers themselves. It is not unconstitutional to search your device at a border crossing without a warrant. When you travel into the us via airplane, that airport is considered a border crossing.

This here; the 4th amendment specifically protects against "unreasonable searches and seizures"; that of course has lead to a long case history on what sort of searches are reasonable and not reasonable. Time & place play a big part of it; the Supreme Court has long held that searches at border crossings have a lower bar for what is considered reasonable than searches outside of border crossings.

 

[tanishq666]

Sad Part is that it is like double edge sword can we used by good and bad people

 

[p51d007]

I see this on videos all the time. "You didn't read me my rights". If/when arrested, the officer does not have to read you your rights UNLESS they are going to ask you questions.
I'm for law & order but unless they had an arrest warrant to search his phone etc, they have no "right" to go snooping around on his phone. Now, if they had an arrest warrant that said to take possession of the phone and all data, and he erased it while the officers were trying to look at it, that would be destruction of evidence.

 

[BuckarooBonzaii]

I agree with Graphene. Nothing wrong with owning and using Graphene but it's the individual responsibility how they use it. Use it to destroy evidence, then you had intention. There are many things you can legally and illegally buy and own, but it's how you use it.

In simple terms, Reasonable Suspicion which was passed by the Supreme Court does give police a warrantless search power based on suspicion. You cannot be arrested under Reasonable Suspicion, but it can turn into probable cause which will lead to an arrest. I think the defense knows he intentionally erased data which is a crime, but if the agents failed on their part to which the defense claimed, then the agents messed up.

 

[Theinsanegamer]

I see this on videos all the time. "You didn't read me my rights". If/when arrested, the officer does not have to read you your rights UNLESS they are going to ask you questions.
I'm for law & order but unless they had an arrest warrant to search his phone etc, they have no "right" to go snooping around on his phone. Now, if they had an arrest warrant that said to take possession of the phone and all data, and he erased it while the officers were trying to look at it, that would be destruction of evidence.

They do not need a warrant at the border. This has been covered many times.

I agree with Graphene. Nothing wrong with owning and using Graphene but it's the individual responsibility how they use it. Use it to destroy evidence, then you had intention. There are many things you can legally and illegally buy and own, but it's how you use it.

In simple terms, Reasonable Suspicion which was passed by the Supreme Court does give police a warrantless search power based on suspicion. You cannot be arrested under Reasonable Suspicion, but it can turn into probable cause which will lead to an arrest. I think the defense knows he intentionally erased data which is a crime, but if the agents failed on their part to which the defense claimed, then the agents messed up.

The defense claims they did not have a warrant. You do not need a warrant at a border crossing. And given he was flagged for potential terrorist activity, they already had justification.

The defendant is screwed. There are lots of things that are legal to own and use, but have restrictions on how and when. Firearms are the easiest example. There is nothing illegal about having or using a reset code, unless you use that code after officers request your code to unlock your device to search for evidence. Destruction of digital documents on a device counts as destruction of evidence.

 

[Amythist]

And given he was flagged for potential terrorist activity, they already had justification.

Where did you see that? Everything I have seen said they went to seize/search the phone because they suspected it of containing child sexual abuse material, which last I checked is reprehensible, but not terrorism

As well if that was the crime then shouldn't be have been detained then handed off to the local police to be arrested/investigated under the relevant body?

 

[MasterAce]

I think people over 100y ago wrote the border search law to search pockets and bags. They could not imagine a world where a small block of glass carry our intimate lives from child birth to death.

 

[MasterAce]

I think people over 100y ago wrote the border search law to search pockets and bags. They could not imagine a world where a small block of glass carry our intimate lives from child birth to death.

 

[JamesBlond]

If you for 1 second think Graphene OS is not backed up in the cloud by google I think you will believe peter pan is real

 

[JamesBlond]

Would be interesting to see which part of the constitution they believe protects it.

The Fourth Amendment's Modern Application
The Supreme Court has interpreted the Fourth Amendment to mean that the government generally needs a warrant based on probable cause to search the digital contents of a device. Here’s how this plays out:

A "Private Diary" Standard: The Supreme Court has recognized the vast amount of personal information on a smartphone, effectively treating it as a "private diary" that is off-limits to warrantless police searches.

Location Data: The Court has also ruled that police must obtain a warrant to access historical cell-site location information (CSLI) from a service provider, which can reveal a person's movements over time.

 

[LordVile95]

The Fourth Amendment's Modern Application
The Supreme Court has interpreted the Fourth Amendment to mean that the government generally needs a warrant based on probable cause to search the digital contents of a device. Here’s how this plays out:

A "Private Diary" Standard: The Supreme Court has recognized the vast amount of personal information on a smartphone, effectively treating it as a "private diary" that is off-limits to warrantless police searches.

Location Data: The Court has also ruled that police must obtain a warrant to access historical cell-site location information (CSLI) from a service provider, which can reveal a person's movements over time.

Which doesn’t really matter here as the issue is deleting evidence off a device that they do have a warrant for

 

[Paul Dougherty]

Make up your mind about what your bootlicking "argument" is. If he's at the border or an airport they don't need a warrant, but they had one (that I have seen nobody except you mention them having)?

I assume from your rapacious attitude and hostility towards individual rights you're probably actually into the CSAM stuff CBP baselessly accused the guy they wanted to hassle and spy on of having?