Law & Regulation

Wiping a Phone at the Border Is Now a Criminal Charge

US prosecutors charged a traveller under 18 U.S.C. 2232 after a duress passcode wiped his phone at Atlanta airport. What it changes for European travel policy.

Law & RegulationBy Servola Tech Desk2026-07-244 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Wiping a Phone at the Border Is Now a Criminal Charge

The screen went blank at Hartsfield-Jackson

Samuel Tunick landed at Hartsfield-Jackson airport in Atlanta on 24 January 2025, returning from a holiday in the Dominican Republic, and was taken into secondary inspection. Border agents demanded access to his phone, citing a concern about child exploitation that his lawyers say arrived with no supporting evidence. He entered a passcode. The screen went blank, flashed several times, and the phone appeared to restart.

The phone ran GrapheneOS, a hardened Android build used in place of the stock software on Google Pixel devices. GrapheneOS documents a duress feature openly: a separate PIN or password that, entered anywhere the device asks for credentials, irreversibly wipes the device along with any installed eSIMs. It runs immediately, without a reboot, and once started it cannot be stopped. What the agents watched was the feature working exactly as designed.

The statute is about property, not privacy

The charge is a property charge. Prosecutors did not build this on privacy or on lying to an officer. They used 18 U.S.C. 2232, which makes it unlawful to knowingly destroy or damage property to prevent the authorities from seizing it. The indictment says Tunick caused the phone to delete its digital contents before it was seized. He has pleaded not guilty.

Researchers who follow border-search litigation say this is the first known US federal prosecution over data destroyed by a duress password built into the operating system. Bill Budington, a senior staff technologist at the Electronic Frontier Foundation, and Runa Sandvik, who founded the security consultancy Granitt, both said they had not encountered a comparable case. Tunick's defence, which includes assistant federal public defender Matthew Dodge, has moved to suppress the evidence, arguing the detention and seizure were unlawful, that he was denied access to a lawyer, and that the real subject of the investigation was his association with Defend the Atlanta Forest, the movement opposing the police training campus known as Cop City. The Justice Department declined to comment. The Atlanta federal court is expected to rule later in 2026.

What the border rule does to your staff

Yes, but the border is the part that applies to you. The government argued that no warrant was needed because Tunick had not yet been admitted to the United States. That rests on a long-standing US claim that it may search and seize devices at the border, before entry, without a warrant or a court order. Nothing in that claim depends on the traveller being an activist. It reads the same way for a sales director carrying a laptop to a conference in Chicago.

For a European company the two duties now point in opposite directions. The material on a staff device is personal data, and the GDPR obliges you to protect it wherever that device travels. At a US border, the measure that protects it best is the one prosecutors have just described as destruction of property. And the person who would face the charge is the traveller holding the device, not the company that wrote the policy.

The fix is an empty device, not a better wipe

The bottom line. The answer is not a cleverer wipe. It is a device with nothing on it. Sandvik put the practical version plainly: "With a little planning ahead of time, you can always download the data you need once you get to where you're going." A loaner phone with a fresh profile, mail and files pulled down after arrival and nothing cached locally removes the confrontation altogether, because there is no dataset to defend and no reason to reach for a second passcode.

So make three changes before the next trip. Remove any instruction to trigger a duress wipe from the travel policy, in writing, so that no employee can read it as an obligation. Issue clean devices for US travel and treat re-download on arrival as the normal working method rather than an inconvenience. And give travelling staff one written instruction for the moment a device is taken: hand it over, identify yourself and say nothing further, then call the company's lawyer. That instruction is worth more than any setting in the operating system.

Frequently asked questions

Is it illegal to use a duress password?

No. GrapheneOS ships the feature and configuring it is lawful. The charge in this case is narrower: causing data to be destroyed in order to prevent a seizure that was already under way, under 18 U.S.C. 2232. The case has not been decided and the defendant has pleaded not guilty.

Can US border agents search a company laptop without a warrant?

The US government's position, argued in this case, is that it may search and seize devices at the border before a traveller has been admitted, without a warrant or a court order. Plan on the basis that any device presented at a US border can be inspected.

What should a European employer change now?

Issue devices that carry no data for US trips, delete any policy wording that tells staff to trigger a wipe, and give travellers a written instruction to hand the device over and contact the company's lawyer rather than to act on the device themselves.

A feature built to protect people has become the central fact in a federal indictment. The companies that treat the border as a place where data should not be, rather than a place where data must be defended, will never need to learn how this court rules.

GrapheneOSborder searchdevice securityGDPRtravel policyUS Department of JusticeElectronic Frontier Foundation

Google Will Reopen Your Account With a Face Video

Google switched on selfie-video account recovery on July 23. It skips Workspace and child accounts, and in the EU the stored clip counts as biometric data.

3 min read

Cybersecurity

The Tax Files Left Through the Help Desk

EY says an intruder sat in a third-party ITSM platform for two weeks and took client tax documents. The lesson for owners is the ticket queue, not the tax system.

5 min read