GrapheneOS duress PIN could land a man in prison

GrapheneOS offers one of the more drastic privacy tools available on an Android phone. Known as a duress PIN, the dummy PIN wipes the device instead of unlocking it, for use in situations when you may be forced to hand over access to your device against your will. We’ve previously seen the value in such a code, but we did wonder if using the feature around law enforcement could create a legal minefield. It appears that a US prosecution is in the process of giving us an answer.

According to The Guardian, the US Department of Justice is prosecuting Atlanta resident Samuel Tunick after he allegedly gave a GrapheneOS duress PIN while border agents were trying to search his Google Pixel phone. Experts told the publication that they had not seen a similar case brought over the feature before.

GrapheneOS lets users configure a duress PIN or password that looks like a normal authentication code but triggers an irreversible wipe when entered. It is designed for situations where someone is being forced to unlock a device, and there is no confirmation prompt or other clue that would give away what the alternative code is doing.

The indictment alleges that Tunick knowingly deleted the phone’s digital contents to stop the government from taking control of the property. He has been charged under a federal law that covers the destruction of property to prevent its seizure, effectively placing the alleged use of the duress PIN at the heart of the case.

The incident took place at Atlanta’s Hartsfield-Jackson airport in January 2025, when Tunick was returning from the Dominican Republic. His attorneys say border agents repeatedly demanded access to his phone and told him they did not need a warrant. After a passcode was entered, the screen reportedly went blank, flashed several times, and appeared to restart.

Tunick’s legal team is now trying to have the evidence thrown out. It argues that he was questioned without being read his Miranda rights, that agents repeatedly refused his requests to speak with a lawyer, and that the phone search was an unreasonable seizure. His lawyers also say questions about child sexual abuse material were used as a pretext to investigate his alleged links to the movement opposing Atlanta’s police training center, commonly known as Cop City.

A judge is not expected to rule on the motion until at least the end of October. Until then, the case leaves one of GrapheneOS’s most attention-grabbing security features under scrutiny. A duress PIN could certainly be reassuring if you’re getting mugged, but its use with law enforcement raises other questions. For example, would it be considered destruction of evidence if a defendant had written it on the back of the phone and the officers assumed it was the correct PIN? That’s just a hypothetical, but digital privacy experts will certainly be keeping an eye on these particular proceedings — as will we.