The indictment landed Friday: Samuel Tunick, an Atlanta activist, faces a federal obstruction charge for handing Customs and Border Protection agents a passcode that wiped his GrapheneOS-powered Pixel during a border search at Hartsfield-Jackson last year. The New York Times reported the charge on August 21. Tunick’s lawyers say the agents claimed to be hunting for child pornography; they believe the real target was his connection to Defend the Atlanta Forest, the movement opposing the city’s police training facility that critics call “Cop City.”

The predictable responses are already forming. Civil libertarians will call it proof that the border search exception has swallowed the Fourth Amendment. Law-and-order types will shrug: if you have nothing to hide, you have nothing to fear. Both are wrong, but the second is wrong in a way that matters more.

The “Nothing to Hide” Principle Requires Trust

The “nothing to hide” argument only works if you trust the person doing the searching. And the government’s own filings in this case give you reason not to. CBP agents told Tunick they were looking for evidence of child pornography offenses — a claim his legal team, in a motion to suppress, calls a pretext for a fishing expedition into his political associations. Whether or not that’s proven in court, the sequence is familiar: agents can detain you at the border without probable cause, without a warrant, without a lawyer present, and without telling you what they’re actually looking for.

In that context, “nothing to hide” stops being a principle and starts being a gamble. You’re not betting that you’re innocent. You’re betting that the agent examining your phone will interpret everything they find the way you would. That’s a bad bet, and everyone who has ever been through a secondary inspection knows it.

The Duress Passcode Is a Market Response

GrapheneOS — the privacy-focused Android fork Tunick had installed — includes a feature that wipes the device when a duress passcode is entered. It exists because a market exists: ordinary people who want to keep their data out of the hands of anyone who happens to demand it. Not just border agents. Abusive partners. Thieves. Overreaching employers.

“I’m a nurse,” one GrapheneOS user wrote in a forum thread about the Tunick case this week. “I have patients’ messages on my phone. If a border agent asks for my passcode, I’m giving them the duress code too.” That’s not obstruction. That’s basic data hygiene.

The prosecution is trying to criminalize that. The charge against Tunick is obstruction — destroying evidence. But the evidence he destroyed was his own data, on his own device, before anyone had told him he was under investigation. If that’s obstruction, then every person who has ever deleted a text message before handing over a phone has committed a felony. The government is drawing a line that doesn’t exist in practice.

The Backfire

Here’s what the prosecutors haven’t considered: this case will do more to popularize duress passcodes than any privacy advocacy ever could. Dozens of people were arrested during the protests against the Atlanta training facility, and the Tunick case is now a national story. Every privacy-focused developer in the country is watching. Every ordinary person who reads about this will wonder: if I’m ever in that situation, what would I do?

The answer, increasingly, is: use the duress code. The government is trying to make an example of Tunick, but the example it’s actually setting is that the border search is adversarial, that the pretexts are real, and that your only defense is technological. That’s not a lesson the government wants to teach.

The deeper problem is that the state has already decided to treat its own citizens as adversaries at the border. The duress passcode didn’t create that adversarial relationship. It responded to it. And by prosecuting the response, the government is confirming that the relationship is exactly as bad as the privacy advocates say it is. The irony is that the government’s own argument makes the privacy case for it: if the state can charge you with obstruction for deleting your own files, then the state is claiming a property interest in your data that it has never bothered to articulate. That’s not a legal theory. That’s an assertion of power.

Sources