Atlanta man wipes phone during airport search: Federal agents say device data disappeared after special passcode entry; privacy-focused GrapheneOS draws attention

A federal case unfolding in Atlanta is asking a question that privacy advocates, cybersecurity researchers, and civil liberties lawyers have long feared would end up in a courtroom: can choosing to run a privacy-focused operating system on your phone be used as evidence that you have something to hide?

The case centres on Samuel Tunick, an Atlanta resident who returned from the Dominican Republic through Hartsfield-Jackson Atlanta International Airport on 24 January last year. By the time he walked out of that airport, his phone had wiped itself during a customs search, and federal prosecutors had decided that was a crime.

What happened at the airport


Federal agents pulled Tunick aside for secondary screening after his name and photograph had been circulated internally, according to court testimony cited by The Guardian, which first reported the case. Agents reportedly flagged him over alleged associations with the movement opposing the construction of Atlanta's police training facility, widely referred to as Cop City.

During the search, agents repeatedly asked Tunick to unlock his phone and warned it would be seized if he did not comply. He eventually provided a passcode. What followed, according to a defence filing, was that the screen went blank, flashed several times, and the phone restarted. The data on the device was gone.

Prosecutors say it was deliberate. They are charging Tunick under a federal law that makes it a crime to destroy property to prevent its seizure. His lawyers say the entire search was unconstitutional to begin with, and are seeking to have the case dismissed and any evidence from the incident suppressed.

A defence filing also alleged that questions about child sexual abuse material were raised during the interrogation as a pretext to investigate Tunick's political associations rather than any actual suspicion of such material.

The OS at the centre of it all

Tunick's attorneys confirmed that his phone was running GrapheneOS, a custom Android-based operating system built specifically for privacy and security. It runs primarily on Google Pixel devices and replaces the standard Android software that comes pre-installed.

GrapheneOS includes a feature that allows a user to set a secondary passcode that, when entered, wipes the device instead of unlocking it. The idea is to give users a way to protect their data under coercion, the kind of situation where someone is forced to hand over a passcode against their will. Prosecutors allege that this is precisely what Tunick used it for.

GrapheneOS also includes other hardened security features. By default, devices running the OS automatically return to an encrypted, locked state if they are not unlocked within 18 hours. Users can set that window as low as ten minutes. The OS also incorporates protections against physical attacks and exploit-based extraction attempts.

GrapheneOS pushes back

Following news of the arrest, GrapheneOS published a detailed response making its position clear. The OS is entirely legal, it said, and it has no obligation to weaken its security protections for anyone.

"GrapheneOS is completely legal. We have no obligation to weaken any of the security protections it provides. Creating and using GrapheneOS is strongly protected by the US constitution. Laws attempting to make it illegal or require weakening the security would be unconstitutional," the organisation wrote.

On the question of data erasure specifically, GrapheneOS noted that its primary security model relies on strong encryption rather than on wiping features, and that there is no way to bypass a strong encryption passphrase once data is at rest.

What researchers and experts say

Cybersecurity experts told The Guardian that the prosecution's approach appeared to be without precedent. Christophe Boutry, a cybersecurity and surveillance expert, said the case sent a troubling signal. "It's concerning, and sends the message that GrapheneOS is criminal by default," he told the publication.

That concern goes beyond the United States. In Catalonia, Spain, police have reportedly been profiling people found carrying Google Pixel phones on the assumption that they are running GrapheneOS and are therefore involved in drug dealing or gang activity. The logic, privacy advocates argue, is circular and dangerous: a tool designed to protect ordinary users from surveillance is being treated as proof of wrongdoing by the very act of using it.

Why this case matters

The Tunick case is arriving at a moment when the boundaries of digital privacy during border searches are already deeply contested. In the United States, customs agents have broad authority to search electronic devices at ports of entry without a warrant, a power that has been challenged repeatedly in courts with mixed results.

What makes this case different is that prosecutors are not just seeking access to the phone. They are arguing that the act of protecting the phone, through a feature that the OS was explicitly designed to include, was itself a criminal act.

If that argument succeeds, it would mark the first time in the United States that using a legally available privacy tool has been treated as evidence of guilt. That is the line that privacy advocates say must not be crossed, and it is now a question for a federal court in Atlanta to answer.

(With TOI inputs)