Prosecutors argue the wipe was not incidental but a deliberate, premeditated act: the user configured a duress PIN in advance specifically to destroy encryption keys when compelled to unlock. In their theory, typing that PIN in front of a CBP agent is legally indistinguishable from smashing a laptop with a hammer — an intentional destruction of evidence subject to obstruction charges.
The editorial frames the defense position as one of constitutional consistency: if entering a passcode is a lawful act, the government shouldn't be able to turn it into a felony based on which four digits the user chose. Treating a pre-configured duress PIN as obstruction effectively criminalizes the exercise of a privacy-protective choice made before any encounter with law enforcement.
The editorial highlights that while CBP's warrantless search authority is broad and only lightly constrained (e.g., the Ninth Circuit's Cano decision requiring reasonable suspicion for forensic searches), no court has squarely ruled on what happens when a traveler pre-configures a 'booby trap' like a duress PIN. This case is a novel test of whether privacy engineering can survive the border exception.
Clarifies for readers unfamiliar with GrapheneOS that the wipe wasn't triggered by failed attempts or inactivity but by the deliberate entry of a pre-configured second passcode. This distinction is central to the prosecution's case, since it establishes intent rather than an incidental security feature firing on its own.
Pushes back on the naive online refrain that 'the government can't make X illegal,' suggesting the reality is messier — the government can and does prosecute conduct that users assume is protected. The comment implies that relying on privacy tools to defeat law enforcement is more legally fraught than the security community often admits.
A US citizen returning through Hartsfield-Jackson in Atlanta handed his phone to Customs and Border Protection agents during a secondary inspection. The device, running GrapheneOS, wiped itself. Federal prosecutors have now charged him with obstruction, arguing that the wipe was not an accident but the deliberate entry of a duress PIN — a GrapheneOS feature that lets a user configure a second passcode which, when entered, factory-resets the device and destroys the encryption keys.
GrapheneOS's duress PIN is not an auto-wipe after failed attempts, and it's not triggered by inactivity. It is intentional. You set it up in advance, you type it in the moment, and the phone erases itself. That distinction is the entire case. As HN commenter `rock_artist` summarized for the iPhone crowd: "It's not auto wipe or wipe after several failed attempts but intentional wipe of device."
The government's theory is that punching in a duress PIN at a CBP checkpoint is legally indistinguishable from smashing a laptop with a hammer in front of an agent. The defense's theory, roughly, is that a passcode is a passcode — the Fifth Amendment implications of *which* four digits you chose to type shouldn't turn a lawful act into a felony.
The border search exception is one of the widest carve-outs in American constitutional law. CBP can inspect devices without a warrant and, under current DHS policy, can perform a "basic" search without any suspicion at all. Courts have chipped at the edges — the Ninth Circuit's *Cano* decision requires reasonable suspicion of digital contraband for forensic searches — but the baseline authority to demand your phone is intact. What has *not* been squarely tested until now is what happens when the traveler pre-arms a booby trap.
HN commenter `cameldrv` put the naive version of the counter-argument bluntly: "I've seen a lot of people on the internet over the years say things like 'the government can't make x illegal, it's just y.' For example, the government can't make wiping your phone at the border illegal, it's just punching four numbers into your phone, just like a pin, only a different four numbers." The reply from `sfRattan` is the one worth internalizing: "when you choose to enter a duress PIN that will wipe your device, you have to recognize that choice may have legal consequences." The mechanical simplicity of the act doesn't inoculate it. Obstruction statutes have always been about intent, not muscle movement.
The interesting technical question is what CBP actually observed. To charge obstruction rather than shrug at a coincidence, prosecutors need to show the wipe was volitional — that the agent watched the defendant enter a passcode and the device then died, rather than the phone timing out or hitting a failed-attempt threshold on its own. GrapheneOS's duress PIN behavior helps the government here: because it's a distinct, pre-configured code, its use implies premeditation. A regular auto-wipe-after-10-attempts policy would be much harder to prosecute; that's a default hardening choice, not an affirmative act.
There's a broader precedent problem lurking. If a court accepts that entering a duress PIN is obstruction, the doctrine won't stay narrowly scoped to GrapheneOS. iOS's SOS mode temporarily disables biometrics and forces passcode entry. Android's Lockdown Mode does the same. Any deliberate action taken specifically to make a device harder to search — even actions the vendor ships and documents — becomes potentially chargeable if the government can show you took it in response to the search itself. That's a much larger surface than the Graphene community.
If you carry data across borders — client source code under NDA, unreleased security research, journalism source material, medical records — the operational answer has not changed and this case reinforces it. Don't rely on clever local defenses at the checkpoint. Cross the border with a phone that has nothing on it worth taking, and pull your real environment down from an encrypted remote after you've cleared inspection. HN commenter `DanHulton` said it plainly: "wipe the damn thing yourself before crossing the border and restore it from an encrypted online backup on the other side. You're just carrying a blank phone that you intend to set up and use later, and they can't force you to do anything with a blank phone."
That's the mundane, boring, effective threat model. It survives obstruction charges because there is nothing to obstruct. A clean device with a fresh install and no accounts logged in presents CBP with a phone, not evidence. The plausible-deniability approach — VeraCrypt hidden volumes, Graphene profiles, decoy passwords — is technically elegant and legally fragile the moment a prosecutor can prove you knew what you were doing. Grimblewald's VeraCrypt hidden-volume trick that got upvoted in the thread is a great party demo and a terrible border strategy: if the agent knows the feature exists (they do; it's been in DEF CON talks for a decade), the mere accusation shifts you into a fight you didn't want.
For teams: this is worth a paragraph in your travel policy. Not "install GrapheneOS," not "use a duress PIN," but a concrete procedure — dedicated travel device, corporate MDM profile that provisions after landing, cloud-based dev environments (Codespaces, Cloud Workstations, jump host) so the local machine is a thin client. The engineering answer is architectural, not cryptographic.
This case will get watched carefully because it's one of the first where a hardened-Android privacy feature — not encryption in the abstract, but a specific documented function shipped by an open-source project — is being characterized as a tool for obstruction. If prosecutors win, expect vendors to think harder about how they surface duress features (in-menu vs. hidden, default-off vs. opt-in, and how documentation is worded). If the defense wins, expect CBP to lean harder on compelled unlock orders and to detain devices longer for forensic imaging before travelers can touch them. Either outcome pushes the practical center of gravity toward the same conclusion: your border-crossing device should be one you can afford to hand over, wiped or not.
I’ve seen a lot of people on the internet over the years say things like “the government can’t make x illegal, it’s just y.” For example, the government can’t make wiping your phone at the border illegal, it’s just punching four numbers into your phone, just like a pin, only a different four numbers
Ultimately, when you choose to enter a duress PIN that will wipe your device, you have to recognize that choice may have legal consequences. I don't like the amount of power our government has at the national border when it comes to detaining and pressuring citizens, but our Constitution explic
VeraCrypt has a cool function which is a reserved space for a decoy OS.[1] Everything else registers as free space while decrypting to dummy volume. You make the dummy volume look lived in, and forget. provide dummy password, volume decrypts such that only dummy is accessible/readable. give pro
Here is the indictment: https://www.documentcloud.org/documents/28513012-samuel-tuni...Here is the statute Tunick is indicted under: https://www.law.cornell.edu/uscode/text/18/2232There is an immediate problem: the device was being searched, and this
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
I co-wrote a border search guide for EFF some years ago. I was very interested in finding clever technical approaches but I later ended up feeling that I hadn't given enough thought to the overall threat model questions (even though the guide did address them, perhaps even somewhat usefully).Th