Get Off My Phone: The recently unveiled case brought by the US Department of Justice against a GrapheneOS user is rekindling debate around privacy and effective operational security on mobile devices. The GrapheneOS Foundation has joined that debate, reaffirming some key points about the operating system's security features and whether previously deleted data can ever be recovered.
According to the GrapheneOS Foundation, the operating system that got Sam Tunick prosecuted by the US government has nothing to do with unlawful practices. The Toronto, Canada-based non-profit joined the fray to defend its open-source OS, which it maintains is a completely legal platform under US law.
The foundation says it has no obligation to weaken GrapheneOS features designed to improve user and data security. The Android-based OS, it argues, is protected by the US Constitution, meaning no one can (theoretically) be prosecuted for creating, developing, or even using the platform on their devices.
– GrapheneOS (@GrapheneOS) July 27, 2026
The foundation also believes any new law designed to make the software or its security features illegal would likely be unconstitutional. Similarly, the organization confirmed that once data has been wiped from a GrapheneOS-powered phone, there's no way to recover any of it.
The software, and the hardware it's compatible with (Google Pixel phones for now) is designed specifically to prevent attempts to bypass or tamper with data encryption.
Tunick ran into trouble after providing a US Customs and Border Protection officer with a "duress password," one of GrapheneOS' options for strengthening a user's right to privacy. Once used to forcibly unlock a phone, the duress password/PIN wipes all data on the device, including eSIM content. The process happens instantly, can't be stopped, and is irreversible.
The GrapheneOS Foundation has since tried to downplay the importance of duress passwords for the platform's security. The feature, the organization said, is just a minor option within a much broader security model. It can also carry physical or legal consequences, which is why users should carefully weigh whether it's the right approach for outsmarting attackers or coercive enforcement attempts by federal agents.
The lawyer representing Tunick against the US government said the border agent failed to read Tunick his Miranda rights, as required, and ignored his requests to speak with a lawyer. The lawyer is now trying to get a US judge to dismiss all evidence recovered in the case, arguing that Tunick's constitutional rights were violated.