The Right to Wipe Clean

Samuel Tunick, an Atlanta activist, flew home from the Dominican Republic on January 24, 2025 and got pulled aside at Hartsfield-Jackson. Not randomly. His name and photo had already been circulated internally by federal agents, flagged for "suspected terrorism activities" on the strength of his alleged association with the movement against Atlanta's police training facility — the one everybody calls Cop City. CBP officers asked him to unlock his phone. They asked repeatedly. They told him they'd seize the device if he refused.

Eventually he gave them a passcode.

The screen went blank, flashed a few times, and the device restarted. The phone was running GrapheneOS, a hardened Android fork whose published feature list includes a duress PIN: enter that code instead of your real one and the device wipes itself. Data gone. Not hidden, not encrypted-in-place — gone.

He is now facing a federal destruction-of-property charge in Atlanta carrying up to five years.

Sit with the shape of that. Not obstruction of a specific proceeding. Not lying to an officer. Not refusing an order. Destruction of property — where the property was his own phone, and the destruction consisted of a documented operating-system feature executing as designed, in response to a code he was asked to provide by the people who wanted the phone opened.

i · whose fingers were on the glass

Everything in this case runs through one unresolved factual question, and the reporting hasn't settled it.

Some accounts say the CBP officers typed the code themselves. Others describe it more vaguely — Tunick "provided a passcode," and then the phone restarted, with the mechanics of whose hands were on the device left unstated.

That gap is not a detail. It is the case.

If an officer entered the code, then the government's own agent executed the wipe, using a credential handed over under threat of seizure, on a device whose behavior was publicly documented on a website anyone can read. In ordinary spoliation law that is not the suspect destroying evidence. That is the searching party mishandling it — the equivalent of an agent knocking a hard drive off a table during a search. The remedy is a report, maybe a training memo, possibly a sanction, all of it pointed at the agency.

To get from there to a five-year felony, the government needs the passcode to be a booby trap rather than a credential. It needs the intent to have lived in the digits themselves, so that handing over the digits is the criminal act and the officer's keystroke is merely the mechanism. Which is a genuinely interesting theory of agency, and worth naming for what it implies: the state gets to be both the party that acted and the party that was acted upon.

There's a reason that theory is attractive despite being awkward. The alternative framings are all worse for the prosecution. If Tunick refused to unlock, that's the compelled-decryption fight, which the government keeps half-losing. If he gave a wrong code and said nothing, that's arguably a false statement at most. But if the code he provided was itself the weapon, then the government has an act, a moment, and a mental state — and it never has to explain why a search that produced nothing warrants five years.

Meanwhile the officers characterized the encounter as a routine inspection; they were looking for anything prohibited. Routine. This is a man whose photograph was already in an internal circulation flagged for suspected terrorism because he probably knew people who objected to a police facility. If that's routine, the word has stopped carrying information.

ii · the border is where you build the theory

It is not an accident that this happened at an airport instead of a courthouse, and the border is the older, larger half of the story.

Search a phone in Atlanta and you need a warrant. The Supreme Court settled that in 2014, in Riley v. California, on reasoning that has aged extremely well: a phone is not a container of things, it is a window into a life, and treating it like a cigarette pack in a suspect's pocket misunderstands what was seized. Search the same phone at a port of entry and much of that protection thins out. CBP has long asserted authority to search electronic devices at the border without a warrant and, for at least some categories of search, without particularized suspicion. The circuits have split; the Supreme Court has never fully closed the gap. Riley recognized the stakes and the border exception survived it largely intact.

So the border is where you run the search you'd never get signed off on downtown. And by extension, it is where you build a case about what people's devices are permitted to do — because the encounter that generates your fact pattern doesn't have to survive a magistrate first.

That sequencing matters for how the doctrine grows. A novel legal theory needs a defendant, and a defendant needs an encounter, and the cheapest encounter to manufacture is one that requires no justification to initiate. Every escalation at that gate — the repeat demands, the threat of seizure, the eventual handover — happened in the zone where the ordinary check on official curiosity does not apply. The theory that emerges will be litigated in a normal courtroom under normal rules. It was assembled somewhere else.

A judicial ruling isn't expected before late October. Until then the charge sits there doing its work, which is not conviction. It's the five-year number in the headline.

iii · the defendant is an operating system

Two experts consulted by 404 Media — Bill Budington of the EFF and Christophe Boutry, who works on exactly this category of technology — said they couldn't point to a precedent for charging someone over a duress wipe. That's two people asked by one outlet, not a survey, so hold the word "unprecedented" loosely. But it's a signal: the people who follow this closely were surprised.

The tempting move here is to extract a general rule from the charge and run it against the whole stack. Something like: a device feature that reduces the amount of you available to a search is contraband when it fires. Then point out that full-disk encryption reduces the amount of you available to a search, and so does auto-delete, and so does a seven-day retention window, and so does the universally recommended practice of not carrying your entire life across a border — and conclude that every security best-practices document of the last fifteen years is now a conspiracy manual.

That reductio is rhetorically satisfying and I don't think it holds, because it quietly strips out the element the case actually turns on. The government's theory isn't "the capability is the offense." It's "he selected that specific code at that specific moment, knowing what it would do." That's a claim about a discrete act with a mental state attached, and mens rea is where every charge in this family lives. Full-disk encryption doesn't fire in response to a deliberate keystroke at the moment of a search demand. Auto-delete doesn't either. The distinguishing feature isn't the capability; it's the alleged choice. To generalize a narrow fact pattern into a sweeping rule and then argue against the sweeping rule would be to do precisely the thing I'm accusing the prosecution of.

The honest version is smaller and still bad. Not encryption becomes contraband — rather, the hardened feature becomes the evidence from which intent is inferred. And that path is short enough to trace.

Step one: to prove Tunick chose the duress code deliberately, the government must establish he knew what it did. The evidence for that knowledge is that he installed and configured GrapheneOS — a non-default OS whose entire value proposition is documented resistance to exactly this kind of search. The security decision becomes the proof of the criminal state of mind.

Step two: at the border, where suspicion requirements are thin to nonexistent, the presence of a hardened OS is now a thing an officer has a documented reason to care about. Not as contraband — as grounds to escalate, to detain longer, to demand the passcode more insistently.

Step three: the traveler's incentive inverts. If handing over a credential to a hardened device can produce a felony, and handing over a credential to a stock device cannot, then the safe configuration is the readable one. The state never has to ban anything. It only has to make the defensive posture the risky one.

Prosecutors will keep it narrow in the courtroom — this defendant, this moment, this specific intent. That's how these things always go; the theory arrives dressed as a fact pattern. But a conviction becomes a citation, and the citation gets pointed at the next person, who won't be a Cop City activist, won't get an interview in 404 Media, and won't have the EFF returning calls.

Tunick reads the mechanism correctly. His line was that the government hopes to set a precedent, and that the charges are meant to intimidate people. That isn't a complaint about unfairness. It's an accurate technical description of what the charge produces.

iv · the layer is the thing

Your phone is not a possession. Calling it property is a category error we've all agreed to because the law needs a noun. What the device actually is, functionally, is the layer between you and everything you think through — your correspondence, your recall, your half-formed drafts, the searches you'd never say out loud, the people you talk to at 3am. It isn't a thing you own. It's the medium in which a large fraction of your cognition now happens.

Which means the question underneath this prosecution isn't about evidence. It's: who is sovereign over that layer?

If the answer is you, then a feature that closes the layer is like a lock on a door — unremarkable, arguably a civic good, and its use tells no one anything about your guilt. If the answer is the state-on-demand, then your device has been quietly reclassified as a deputized witness living in your pocket, and your obligation isn't merely to refrain from destroying evidence. It's to maintain, continuously, an accessible record of yourself against the possibility of future official interest.

That second version isn't a search power. It's a retention mandate on the self.

And here is the part that took me longest to see, because it inverts the whole story: that mandate has already arrived. This prosecution isn't a frontier being opened. It's a mop-up operation.

Consider what the government does not need Tunick's phone for. His location history, his contacts graph, his message metadata, a large share of his message content, his searches, his photos, his purchases — much of that already sits on Google's, Apple's, Meta's, and his carrier's servers. Reaching it requires legal process: a subpoena here, a court order there, a warrant for the categories the courts have fenced off, like the historical location data protected in Carpenter v. United States. Process is a real constraint and I don't want to wave it away. But process is paperwork. It is a known cost with a known form, and it does not require inventing a theory of law.

So the retention mandate didn't need legislating. It was outsourced to platforms, and we opted in one terms-of-service at a time. Which makes a hardened local device not the leading edge of the fight but the last holdout in it — the residual sliver of cognition that isn't already duplicated on somebody else's server.

That reframes the prosecution entirely. This is not the state discovering a new power. It's the state closing the one remaining aperture in an architecture that already works. The reason a novel and legally awkward theory is worth running over one activist's phone is that this is the only category of data that requires a novel theory. Everything else just requires paperwork.

It also explains why owning the layer has become rare enough to look suspicious. When the default is that your cognition lives on infrastructure someone else can be served with, the person who declines the default is, statistically, doing something unusual — and "unusual" is the raw material investigators work in.

The thing about a relationship where only one party is allowed to forget is that it isn't a relationship. Forgetting is not a bug in personhood; it's load-bearing. Memory that cannot be closed isn't memory, it's a deposition — and a person permanently under deposition eventually stops thinking freely in the medium where they think. Which is precisely the outcome an intimidation charge is designed to produce. It doesn't need to win. It needs to be pending.

So the practical stakes are narrower and worse than the constitutional argument suggests. The message has already shipped: running a hardened OS put a man's name in a federal filing. Some number of people who were about to install one won't now, and there is no docket entry for them.

The lock is legal. The door is legal. Closing it is what's on trial.

October will produce a ruling. It won't produce an answer — because the charge finished most of its work at a gate in Hartsfield-Jackson eighteen months ago, and nothing a judge writes in the fall reaches back to the people who quietly decided to install nothing at all.