Field Notes

event

United States v. Tunick

StatusWorkingReviewdue UpdatedStands on2 sourcesSupportsnotes

United States v. Tunick, No. 1:25-cr-00499-ELR-CCB (N.D. Ga.), is a federal prosecution in which the US Department of Justice charged Atlanta resident Samuel Tunick under 18 U.S.C. § 2232(a) — knowingly destroying property to prevent or impair its seizure — because his GrapheneOS phone wiped itself after he provided a passcode to CBP agents at Hartsfield-Jackson airport on 24 January 2025. The indictment was returned under seal on 13 November 2025; Tunick has pleaded not guilty. Experts quoted in the reporting believe it is the first known US case charging someone for destroying data through a phone’s built-in duress password, and the first documented instance of a duress-style phone wipe producing a standalone US criminal charge. The case became public through the Guardian’s hearing coverage in US government targets Cop City protester over phone operating system and TechCrunch’s follow-up in TechCrunch on Tunick duress-password prosecution, which published the two filings preserved as United States v. Tunick case filings.

The stop

Tunick was returning from a vacation in the Dominican Republic when agents pulled him into secondary inspection. The defense motion records that FBI Atlanta joint-terrorism-taskforce personnel coordinated the interception with CBP in advance, and that federal authorities had placed him on a terrorism watchlist over his alleged association with Defend the Atlanta Forest, the movement against the Cop City police training center in the South River Forest — a movement the government internally classifies as an “Anti-Government, Anti-Authority Violent Extremist Group” without, per the motion, evidence that Tunick committed any crime. A homeland security agent circulated his name and photo to a CBP Tactical Terrorism Response Team and an FBI joint-terrorism taskforce officer three hours before his flight landed.

According to the defense motion and its transcript timestamps, the agents introduced themselves as “looking for people who are pedophiles” [19:49:00], never read Tunick his Miranda rights, and ignored his repeated requests for a lawyer, telling him “because you’re refusing to talk, which is your right, we have the authority to go through your phone” [20:00:40] and “when it comes to immigration and customs, right, it’s a whole different ballgame . . . we have search authority, we don’t need a warrant” [20:05:09]. The defense calls the child-exploitation framing a pretext for a fishing expedition into his protest connections. Tunick eventually gave officers passwords to both his phone and an e-reader; when agents entered the phone’s passcode, “the screen went blank, flashed several times and the phone appeared to restart” — the duress-credential behavior described in Duress credentials and coercive extraction. A DHS agent then told him his devices would be returned after thirty days and that he was “not under arrest but once these gentleman are done with you . . . you’re free to leave” [20:35:15]. The phone was seized; Tunick was released.

The charge’s novel timing theory

The indictment charges that Tunick acted “before and during the search for and seizure of property.” That framing is the government’s own answer to § 2232(a)’s scope question: the statute speaks of destroying property to prevent its seizure, and the government reads it to reach a wipe that precedes physical seizure. His attorneys confirmed the phone ran GrapheneOS, but the public record does not establish that Tunick knowingly entered the duress credential rather than his ordinary passcode — a factual gap that matters, since § 2232(a) requires knowing destruction for the purpose of impairing seizure.

Procedural posture

The defense moved to suppress in March 2026 on three grounds: un-Mirandized custodial interrogation in violation of the Fifth and Sixth Amendments, the wiped phone as fruit of that interrogation (distinguishing United States v. Patane because a compelled passcode is testimonial under In re Grand Jury Subpoena Duces Tecum, 11th Cir. 2012), and an unreasonable warrantless search under the Fourth Amendment. The Fourth Amendment argument attacks the Eleventh Circuit’s suspicionless-device-search rule (United States v. Touset) through the contrary circuit line — Aigbekaen and Kolsuz (4th Cir.), Qin (1st Cir.), Cano (9th Cir.) — which holds that the Border search exception is not a vehicle for investigating domestic crime. The case’s first hearing, on 20 July 2026, took testimony on that motion; a ruling is not expected before the end of October 2026. The prosecution is the second recent federal case against Cop City protesters, after a separate indictment announced in June 2026; several earlier state prosecutions of Cop City protesters foundered.

Why the case matters to this wiki

The case sits at the intersection of three lines of analysis the vault already maintains:

  • A third US mechanism for punishing non-cooperation. The US paths for Encryption key disclosure compulsion are compelled decryption under the foregone-conclusion doctrine and open-ended civil contempt; Tunick adds prosecution of the destruction itself as a discrete process crime, closer in form to the UK’s bounded section 53 offense than to Rawls-style contempt. The defense’s reliance on the Eleventh Circuit’s 2012 decryption case ties the two doctrines together in one docket. Why a known harsher penalty can beat an uncertain lesser one evaluates that comparison.
  • Duress wipes carry detectable legal exposure. Duress credentials and coercive extraction warns that using a duress credential can be prosecuted as evidence destruction; this case is that warning made concrete, including the prosecution’s use of the wipe’s visible device behavior as the incriminating act. EFF’s Bill Budington and Granitt’s Runa Sandvik both told reporters they had seen no comparable case; Sandvik’s operational conclusion is that travelers should expect a wipe to be characterized as knowing destruction and so should not carry the data across the border at all.
  • Watchlisting of an uncharged protester. The terrorism-watchlist placement, the “violent extremist group” classification of a protest movement, and the pre-planned airport interception together form a named US instance of the informal-retention mechanism the synthesis above had recorded as an open gap for the United States.

It also feeds the profiling concern in GrapheneOS: treating the operating system itself as evidence of criminality, a pattern already documented in Catalan police profiling of Pixel owners.

Open points

  • Whether the court suppresses the stop’s fruits, and on which theory (ruling expected after October 2026).
  • Whether § 2232(a) reaches wiping one’s own device in the interval between a seizure threat and actual seizure; the indictment’s “before and during” language stakes out the government’s position, but no court has ruled on it.
  • Whether the government can prove Tunick knowingly entered a duress credential, the mens rea the statute requires and the public record does not yet supply.

Built on 2 sources (2 external).

Working out connections…