A Federal case in Atlanta has raised questions about whether the use of privacy-focused mobile software can be treated as evidence of criminal intent, after prosecutors accused a man of wiping his phone to prevent authorities from accessing its contents. The US Department of Justice is prosecuting Atlanta resident Samuel Tunick under a federal law that makes it a crime to destroy property to prevent its seizure, The Guardian reported. First reported by The Guardian, the case centres on GrapheneOS, a custom Android operating system that runs in place of the software on most modern Google Pixel devices. These include the ability to erase a device by entering a designated passcode. The incident occurred at Hartsfield-Jackson Atlanta International Airport on January 24, after Tunick returned from the Dominican Republic. Tunick’s attorneys confirmed GrapheneOS was running on his phone.
What upset US Federal Agents
Agents repeatedly asked Tunick to unlock his phone and warned that it would be seized if he refused. After he eventually provided a passcode, “the screen went blank, flashed several times, and the phone appeared to restart,” according to the defence motion. Data stored on the device was subsequently lost. Prosecutors allege that the wipe was a deliberate attempt to destroy potential evidence. Tunick’s lawyers maintain that the underlying search violated his constitutional rights. The GrapheneOS has a feature that allows the device owner to set a passcode that deliberately wipes the contents of that device if entered instead of the user’s unlock passcode.According to court testimony cited by The Guardian, federal agents had circulated his name and photograph internally over alleged links to the movement opposing Atlanta’s police training centre, commonly known as Cop City. Tunick was reportedly taken to a secondary screening area and questioned by several agents. A defence filing alleges that questions about child sexual abuse material were used as a pretext to investigate his association with the protest movement. Tunick’s lawyers are seeking to have the case dismissed, arguing that US Customs and Border Protection agents unlawfully seized his phone when he returned to the country last year. They contend that any evidence arising from the incident, including the alleged deletion of the phone’s data, should be suppressed.
GrapheneOS can also get smartphone users in trouble in Europe
While GrapheneOS supporters argue that its features are legitimate safeguards against surveillance and data theft, authorities in parts of Europe too reportedly treat the operating system’s use as suspicious. In Catalonia, Spain, police have reportedly been profiling people with Google Pixel phones, assuming they have GrapheneOS installed and are drug dealers or gang members.
GrapheneOS says: We are legal
Following the report on Samuel Tunick’s arrest, GrapheneOS published a lengthy thread explaining that its security model is designed to prevent unauthorised data extraction rather than rely on features that erase phone data. It went ion to stress that the OS is completely legal. “GrapheneOS is completely legal. We have no obligation to weaken any of the security protections it provides. Creating and using GrapheneOS is strongly protected by the US constitution. Laws attempting to make it illegal or require weakening the security would be unconstitutional,” reads a post from GrapheneOS. On data erading, it adds, “There’s no way to bypass a strong encryption passphrase once data is at rest. A typical weak PIN or password depends on the secure element limiting the number of attempts. Secure element only accepts firmware updates after Owner authenticates to protect against state coercion. By default, GrapheneOS devices automatically return to Before First Unlock state if they aren’t unlocked within 18 hours of being locked. Users can set it as low as 10 minutes. GrapheneOS has strong generic exploit protections and specialized defenses against physical attacks.”
What cybersecurity researchers say
Cybersecurity experts told the publication that the prosecution’s legal strategy appeared unprecedented. Christophe Boutry, a cybersecurity and surveillance expert, told The Guardian, “It’s concerning – and sends the message that [GrapheneOS] is criminal by default.”