The Justice Department is prosecuting an Atlanta man for using GrapheneOS, an open-source operating system that allows users to remotely wipe their phone clean. The case marks what experts say is likely the first time federal authorities have charged someone under an obscure statute criminalizing destruction of property to prevent seizure, solely on the basis of the operating system itself.
Sam Tunick was detained for questioning at Hartsfield-Jackson International Airport on January 24, 2023, after returning from a vacation in the Dominican Republic. He had been placed on a terrorism watchlist because of alleged connections to protests against Cop City, the $109 million police training facility that opened in Atlanta last spring.
What happened next has drawn sharp criticism from cybersecurity experts and civil liberties advocates. During what agents described as a routine border inspection, Tunick was taken to a room with a table, chairs, and surveillance equipment. Agents repeatedly asked him to unlock his phone, threatening to seize it if he refused. When he finally provided his passcode, his phone's screen went blank, flashed several times, and appeared to restart, erasing its contents entirely.
The case hinges on a federal statute long used in conventional property destruction cases but never, according to cybersecurity experts, applied to an operating system. Christophe Boutry, a cybersecurity and surveillance specialist, and Bill Buddington, a senior technologist at the Electronic Frontier Foundation, both said they were unaware of any similar prosecution.
Tunick's federal public defenders filed a motion to suppress all evidence obtained during the airport encounter, arguing his constitutional rights were violated. According to courtroom testimony, Tunick asked four times to speak with a lawyer but was denied each time. Agents did not produce a warrant or read him his rights before the interrogation, which focused heavily on questions about child sexual abuse images, not Cop City.
The detention raises fundamental questions about which constitutional protections apply at international borders. A judge's ruling on the suppression motion is not expected until at least the end of October.
Boutry expressed alarm at the prosecution's implications. "It's concerning and sends the message that GrapheneOS is criminal by default," he said. The operating system, which runs on Google Pixel phones, was designed specifically for privacy and security. That a tool built to protect user data is now being weaponized against a protester troubles both technologists and activists.
The Cop City facility itself became the flashpoint for a sprawling protest movement across Atlanta. Opponents, including local and national organizations, objected to the training center's focus on militarized policing and its construction on forested land. Atlanta police argued the facility was necessary for attracting and training officers to world-class standards.
State-level prosecutions of Cop City protesters have largely failed in recent years. The Tunick case is the second recent federal indictment related to the movement, signaling a shift toward federal resources and charges.
The precedent concerns Boutry, who is based in France. He noted that similar frustrations with encrypted phones have led to troubling patterns abroad. In Spain, Catalan police have begun profiling people carrying Google Pixel phones on the assumption they use GrapheneOS and are involved in drug trafficking or gang activity. French authorities have faced similar obstacles accessing the phones of journalists, lawyers, and political opponents.
Marlon Kautz of the Atlanta Solidarity Fund characterized the case as a larger threat. "We all have a right to secure our private data against unconstitutional searches," he said. "And we should, especially in a time of rising authoritarianism."
Author James Rodriguez: "This case sets a dangerous precedent that treats privacy technology itself as criminal, not the conduct of the person using it."
Comments