GrapheneOS Duress Claim: What the Court Record Supports

The primary court record in United States v. Christopher Sam Tunick supports a narrow claim: federal prosecutors allege that Tunick took action to delete the contents of a Google Pixel during a border search. The reviewed filings do not name GrapheneOS, use the term duress, or establish in a court ruling what credential was entered. Indictment. Retrieved 9 August 2026. Defence suppression motion. Retrieved 9 August 2026.

What the charging document alleges

The indictment was filed in the United States District Court for the Northern District of Georgia, Atlanta Division, under case number 1:25-cr-00499-ELR-CCB. It alleges that on 24 January 2025, before and during a search by a Customs and Border Protection officer, Tunick knowingly took action to delete digital contents of a Google Pixel to prevent or impair the United States from taking that property into lawful custody. It charges one count under 18 U.S.C. § 2232(a). These are charging allegations, not findings. Indictment, pages 1 to 2. Retrieved 9 August 2026.

Section 2232(a) addresses knowingly destroying, damaging, wasting, disposing of, or transferring property before, during, or after an authorised search or seizure for the purpose of preventing or impairing government custody. The indictment cites that text; the statute does not identify any operating system or credential feature. Official United States Code text. Retrieved 9 August 2026.

What the defence filing says happened

A suppression motion filed on 17 March 2026 says Tunick was referred to secondary inspection after returning from the Dominican Republic. It says officers repeatedly requested the phone password. Describing the government's account, the motion says that after the password was entered, the screen went blank, flashed several times, and appeared to restart. The motion characterises the government's theory as an alleged wipe or encryption caused through a specific password. Defence motion, pages 2 to 5. Retrieved 9 August 2026.

That filing contests the government's account and seeks suppression. It does not say that the phone ran GrapheneOS, that a GrapheneOS duress credential had been configured, or that a forensic examination established which feature ran. Its description of a blank screen and apparent restart is an observation attributed to officers, not a technical identification of the operating system. Defence motion. Retrieved 9 August 2026.

What the GrapheneOS feature actually does

GrapheneOS separately documents an optional duress PIN or password. When entered where the operating system requests a normal credential, it irreversibly wipes the device and installed eSIMs. The project says the wipe is prioritised, cannot be interrupted through a reboot, and does not itself require a reboot. Those are product-documentation facts; they do not identify what occurred in the Tunick case. GrapheneOS duress documentation. Retrieved 9 August 2026.

On 26 July 2026, the GrapheneOS project published a general statement about locked-device extraction and its duress feature. It told users to consider physical or legal consequences in an actual duress situation. The statement does not name Tunick and does not claim that its feature was used in his case. GrapheneOS project statement. Retrieved 9 August 2026.

What remains unproven

• The reviewed court filings do not identify the phone's operating system or use the terms GrapheneOS, duress PIN, or duress password. Indictment. Motion. Retrieved 9 August 2026.
• The reviewed record does not establish that a duress feature was configured, that eSIMs were erased, or what data was recoverable after the device appeared to restart. Motion. Retrieved 9 August 2026.
• The indictment alleges knowing conduct and a purpose to impair government custody; the minute sheet does not record a judicial finding on those allegations. Indictment. Minute sheet. Retrieved 9 August 2026.
• The GrapheneOS statement explains the project's feature and interpretation. It is not a court finding and does not connect the feature to this defendant. Project statement. Retrieved 9 August 2026.

Procedural status

The court held an evidentiary hearing on 20 July 2026. Its minute sheet says the hearing remained open to supplement testimony and set post-hearing briefing dates. The docket reviewed through 9 August did not show a ruling on the suppression motion. The case is therefore an open prosecution, not a judgment establishing that a GrapheneOS feature was used or that its use was unlawful. 20 July minute sheet. Retrieved 9 August 2026. CourtListener docket. Retrieved 9 August 2026.

Narrow takeaway

The supportable statement is that a federal prosecution alleges deletion of Pixel data after a password was entered during a border search. The stronger statement that a GrapheneOS duress password caused the deletion is not supported by the reviewed primary filings. Cunicula has retained the GrapheneOS listingwithout a risk downgrade and added the documented duress credential as a feature.

This is a source review of one open United States criminal case. It does not establish a general rule for border searches, compelled credentials, or device-wipe features.

Primary sources

1. United States v. Tunick, indictment, filed 13 November 2025. Retrieved 9 August 2026.
2. Defence motion to suppress statements and physical evidence, filed 17 March 2026. Retrieved 9 August 2026.
3. Minute sheet for the 20 July 2026 evidentiary hearing. Retrieved 9 August 2026.
4. CourtListener docket for United States v. Tunick. Retrieved 9 August 2026.
5. 18 U.S.C. § 2232, official United States Code PDF. Retrieved 9 August 2026.
6. GrapheneOS duress PIN/password documentation. Retrieved 9 August 2026.
7. GrapheneOS project statement on locked-device extraction and duress. Retrieved 9 August 2026.