The Justice Department is asking a federal court to treat a privacy feature built into an open-source phone operating system as a federal crime — a legal theory that cybersecurity experts say has no precedent and that could give prosecutors a new tool to criminalize the use of encryption tools at borders.

The case turns on a 1934 statute, 18 U.S.C. § 2232, that makes it a crime to destroy property to prevent its seizure. The statute was written for a world where “property” meant documents, weapons, and contraband — physical objects that a person could intentionally shred, burn, or smash. The government is now applying it to an automated data-erasure function in GrapheneOS, a privacy-focused operating system that runs on Google Pixel phones.

The defendant, Sam Tunick, was stopped at Hartsfield-Jackson Atlanta International Airport on January 24, 2025, after returning from a vacation in the Dominican Republic. Federal authorities had placed him on a terrorism watchlist because of his alleged association with the movement against Cop City — the $109 million Atlanta police training center whose opening last spring drew nationwide opposition over police militarization and forest-clearing. He did not know he was on the watchlist.

Three hours before his plane landed, a Homeland Security agent circulated an email to the Customs and Border Patrol tactical terrorism response team and an FBI Atlanta joint-terrorism task force officer. The email contained Tunick’s name, his photograph, and a designation: he was being investigated for “suspected terrorism activities.”

When Tunick arrived, agents took him to an interrogation room — a table, several chairs, a camera, a microphone — for what CBP officer Larry Findley later testified was “a routine interrogation at an international airport, looking for anything that’s prohibited.” The questions centered on child sexual abuse images. Tunick’s defense motion describes the CSAM framing as “a pretext for a fishing expedition into Mr Tunick’s connections” to the anti-Cop City movement.

Tunick asked four times during the interrogation to speak with a lawyer. Each request was denied. The agents produced no warrant and did not read him his rights. They repeatedly demanded his phone’s passcode, telling him they would seize the device if he refused. When he provided it, according to the defense motion, “the screen went blank, flashed several times and the phone appeared to restart.” GrapheneOS had done what it was designed to do: wipe a device’s data when entered under duress.

The Justice Department charged Tunick under the anti-destruction statute, treating the automated wipe as the actus reus of destroying property to prevent seizure. Christophe Boutry, a cybersecurity and surveillance expert and former judicial investigator specializing in counter-terrorism, said the case “sends the message that [GrapheneOS] is criminal by default.” Bill Buddington, senior staff technologist at the Electronic Frontier Foundation, said he had not seen a similar prosecution. Both experts confirmed the novelty of the legal theory.

The causal chain from protest association to federal charge

The path from Tunick’s presence in an opposition movement to a federal indictment runs through six links, each documented in courtroom testimony or the defense motion:

  1. Government-alleged association with the anti-Cop City movement triggered a terrorism watchlist designation.
  2. The watchlist generated a multi-agency pre-arrival briefing — the DHS email sent three hours before landing — that directed CBP’s tactical terrorism response team and an FBI joint-terrorism task force officer to intercept Tunick.
  3. The interception produced a warrantless secondary inspection at the airport, conducted under the border-search exception doctrine that reduces constitutional protections at ports of entry.
  4. During the inspection, agents demanded Tunick’s phone passcode under threat of seizure, creating the exact scenario that GrapheneOS’s privacy-erase feature is designed to protect against.
  5. The wipe feature triggered on passcode entry, rendering the phone’s data inaccessible.
  6. The DOJ filed charges under 18 U.S.C. § 2232, treating the automated OS-level deletion as destruction of property to prevent seizure.

The chain reveals a structural incompatibility in the government’s own framing. In court, DOJ attorneys characterized the encounter as a routine secondary inspection. The pre-arrival email, however, documented a targeted operation against a watchlisted individual designated for “suspected terrorism activities” — a designation based on his political association with a protest movement. One framing implies randomness; the other documents a pre-planned multi-agency interdiction. The two cannot both be true. The defense can exploit the contradiction directly.

The real roots of the prosecution

The root-cause analysis, using a 6M framework, identifies three distinct root causes at different depths beneath the surface event.

Root cause A — Statutory interpretation gap (Method). The novel application of a 1934 anti-destruction statute to an automated OS security feature is the interpretive step that converts a privacy feature functioning exactly as designed into evidence destruction. Remove this cause — decline to apply the statute to an OS feature — and the prosecution in its current form collapses. The interpretive step was made possible by the statute’s broad wording and by decades of legislative inertia that left the gap unaddressed.

Root cause B — Legislative inertia (Method), one level deeper. The statute’s broad language — “property,” “destruction” — gave prosecutors no surface-level reason to seek amendment. No high-profile case had forced the issue until now. Congressional inaction on digital-evidence gaps created the opening that the DOJ is now exploiting.

Root cause C — Watchlist classification system (Man / Mother Nature). The process by which political association triggers a terrorism label that reduces procedural protections at borders is foundational to the entire sequence. Remove the watchlist and Tunick would not have been subjected to the extended interrogation; the phone wipe would not have occurred in a law enforcement context. The watchlist system permits association-based designation without judicial review.

Three contributing factors amplify the probability of prosecution without by themselves producing it: the border-search exception framework that legally enables warrantless interrogation at ports of entry; GrapheneOS’s auto-wipe architecture that provides the factual predicate; and the repeated collapse of state-level Cop City prosecutions, which created institutional pressure for federal alternatives.

The state-to-federal pivot is worth particular scrutiny. RICO charges were dismissed against all 61 Cop City defendants in September 2025 when a Fulton County judge ruled the attorney general lacked authority to bring the case without prior authorization from the governor. A domestic terrorism charge was dismissed after a 29-month prosecutorial delay that violated due process and speedy trial rights. The Georgia attorney general appealed the dismissals in February 2026. Within months of these state-level failures, the DOJ announced its second federal Cop City-related indictment — this one targeting a protester not for any act of protest, but for carrying a phone with a privacy operating system. The timeline correlation is confirmed. The causation — that state failures drove the federal pivot — is inferred from the institutional logic of prosecutorial escalation but remains unconfirmed: the DOJ has not publicly stated that failed state cases drove its charging decision. The evidence for that link is inferential rather than mechanism-level.

The stakeholder landscape: who is driving, who is absent

The stakeholder mapping reveals a lopsided landscape in which the parties with the most at stake have the least power, and the parties with the most power are acting without the participation of those most affected by their decisions.

The definitive stakeholder is the U.S. Department of Justice. It holds high power, high legitimacy, and high urgency — full prosecutorial authority, a statutory mandate, and an active litigation timeline. Its want is straightforward: a precedent that user-initiated phone-wipes during border searches constitute property destruction under 18 U.S.C. § 2232, establishing encryption-enabled wipe functions as evidence obstruction. Its risk is a ruling that narrows the statute’s scope, exposing its agents’ warrantless conduct to judicial criticism and damaging institutional credibility. Its BATNA is to pursue the case on different constitutional grounds or seek legislation explicitly criminalizing phone-wipes at borders.

The demanding stakeholder is Sam Tunick. Low power, high legitimacy, high urgency — constitutional rights to counsel, against warrantless search, and against self-incrimination, with immediate liberty at stake. His interests: suppression of evidence and dismissal or avoidance of conviction. His loss scenario: personal liberty and non-convicted status. His BATNA: if evidence is suppressed, he walks free but the statute’s scope question remains unresolved; if convicted, he can appeal the statute’s scope or accept a plea that avoids a precedent-setting ruling.

The dormant stakeholders — those with low power and low urgency now who could be dramatically affected by the outcome — include:

  • The GrapheneOS developer community: high legitimacy (the OS’s design intent is privacy protection), low power (no standing in the case), low urgency (no immediate precedent until the ruling). The prosecution’s theory directly criminalizes their design decision. A silent-power-mirroring failure runs through the entire legal frame: the statute assumes phone contents are government property-in-waiting, a premise the developer community would contest but cannot litigate. No party in the case represents their interest.

  • Future device users: no current power, high legitimacy, zero urgency — no standing until precedent materializes. A ruling that 18 U.S.C. § 2232 applies to user-initiated erasure during a warrantless border search would create a precedent that any passenger with a privacy-oriented OS can be charged with evidence destruction.

  • Google: high power as the hardware manufacturer whose Pixel phones run GrapheneOS, but low legitimacy in this specific dispute and low urgency — no stated involvement. The company faces exposure to a new federal restriction on privacy-focused use of its hardware if the case is lost.

  • CBP/FBI agents including Larry Findley: border-search authority is recognized, but their warrantless conduct is legally contested; the conduct is complete, and the urgency is low.

The dangerous stakeholder — a contested classification that surfaces a genuine analytical tension — is the DHS/FBI watchlisting authority. One analysis classifies it as Dangerous: high power, high urgency, contested legitimacy because the watchlisting was based on “alleged association” without a warrant and Tunick did not know he was on the list. The second analysis folds the watchlisting function into the CBP/FBI actor and classifies the combined entity as Dormant — past conduct. The substantive question is whether the watchlisting function, which preceded and triggered the interrogation, is analytically separable from the interrogation function. It matters because a ruling that the watchlisting basis was illegitimate would remove the targeting mechanism that made the sequence possible.

The missing parties — the groups who are affected but not represented in the proceeding — form a pattern. The GrapheneOS developer community, future device users, Indigenous communities and forest advocates whose land was cleared for the training center, Atlanta taxpayers who funded at least $67 million of the project’s public cost, civil liberties organizations beyond the EFF, and the technology industry broadly — none have a voice in the case. The legal questions — whether the border-search exception applies to this interrogation, whether the statute covers automated operating-system features — will be decided without representation of the interests most affected by the ruling.

The technology at the center

GrapheneOS is the hub node of the case. The relationship mapping identifies it as the connecting point between otherwise separate branches: the constitutional-rights question, the international-comparator pattern, and the criminal-charge theory all radiate from the technology’s dual identity as privacy tool and alleged evidence-destruction instrument.

The operating system’s architecture includes a passcode-entry mechanism that can trigger data erasure under specific authentication conditions — a duress wipe, a configurable threshold, or an encrypted-boot transition. The precise trigger mechanism in Tunick’s case is not specified in the source material, but the analysis treats the wipe as an architectural feature supported by expert testimony about GrapheneOS’s design intent. Boutry stated: “The main goal [of the operating system] is protection of privacy.”

That design intent stands in direct structural conflict with the DOJ’s criminalization framing. The OS’s core function — enabling users to wipe a device to protect data from unauthorized access — is the same behavior the prosecution treats as criminal. The structural conflict is the map’s central tension: the same feature that protects journalists and activists becomes the basis for prosecution when the state demands access to a device at a border.

The pattern is not isolated to the United States. In Catalonia, police profile Google Pixel phone owners, assuming GrapheneOS installation indicates drug-dealing or gang membership. A Catalonian police official was quoted saying: “Every time we see a Google Pixel, we suspect it might belong to a drug dealer.” Boutry drew parallels to France and Spain, where authorities have been frustrated in attempts to access GrapheneOS-protected phones belonging to journalists, lawyers, and political opponents. Two jurisdictions, different legal systems, the same reading of privacy technology as inherently suspect.

The constitutional questions the defense has raised

The defense motion asks the court to suppress all evidence obtained during the interrogation — including the phone wipe itself — citing violations of Tunick’s Fourth and Fifth Amendment rights. The strongest constitutional argument centers on what the agents did, not what the statute says: four denied requests for counsel, no warrant, no Miranda reading. These procedural deficits are documented through courtroom testimony.

The motion raises a question with consequences extending well beyond this case: which constitutional protections apply at national borders, including international airports? The border-search exception doctrine, which permits reduced protections at ports of entry, is the government’s likely counterargument. But the defense contests its application to the full sequence of events — a pre-targeted, multi-agency operation against a watchlisted individual, not a random luggage search or routine document check.

The case also surfaces an irony that the constitutional argument reveals. If the evidence is suppressed — if the court rules the interrogation was unconstitutional — the prosecution likely fails. But the statute’s scope question would remain unresolved. A conviction, by contrast, would establish a precedent with national implications for privacy technology, but it would rest on an interrogation that the defense argues violated the Constitution at every procedural turn. The judge’s ruling on the suppression motion, expected by the end of October 2026, may resolve this tension or deepen it.

Confidence and open questions

Confidence in the dominant causal chain — that the novel statutory interpretation is the load-bearing root — is moderate. The supports are strong: expert testimony from Boutry and Buddington confirming the absence of precedent, procedural facts well-documented through courtroom testimony and the defense motion, the pre-arrival email sequence documented in testimony, and both independent analyses converging on the statutory interpretation gap as the critical step. The moderating factors are the inferential nature of the state-to-federal causal link, the unavailability of DOJ’s internal charging memo, the pending judicial ruling that could restructure the causal chains, and the unresolved technical ambiguity about exactly how the GrapheneOS wipe was triggered.

Two open questions deserve attention as the case proceeds toward the October 2026 ruling.

The first is how the process determined that Tunick’s alleged association with a protest movement constituted “suspected terrorism activities.” The DHS email is documented; the basis for the designation is not. If the watchlisting was based on political association alone — without individualized, articulable suspicion — the targeting mechanism that initiated the entire sequence rests on a foundation the court may find constitutionally illegitimate.

The second is what happens after the ruling, regardless of outcome. If the suppression motion is granted and the prosecution collapses, does Congress address the statutory gap, or does law enforcement simply bring a different charge against the next person carrying a phone that can wipe itself? If the prosecution succeeds, has the court opened a new avenue for prosecuting privacy at borders, or will Congress act to close a statutory gap that was never designed for automated software features?

The answers will shape not just Sam Tunick’s case, but the legal basis for carrying a privacy-protective phone through any U.S. airport — and whether the Constitution’s protections at borders are rights that travelers actually possess, or privileges that disappear when the state designates someone as suspect.

Analytical techniques used in this piece

This analysis applies the methods below. Each links to a short, plain-English explainer you can read and reuse.

Relationship Mapping
Extracts the network of ties among people, institutions, and entities.
Root-Cause Analysis
Traces a symptom back along its causal chain to the conditions that actually generated it.
Stakeholder Mapping
Charts the parties to a situation — their interests, power, and alignments.