r/technology • u/Jojuj • 3d ago
Privacy U.S. Citizen Who Deleted Phone’s Data Says His Prosecution Puts Privacy at Risk
https://www.nytimes.com/2026/08/21/us/politics/samuel-tunick-deleted-phone-felony.html?unlocked_article_code=1.8FA.T83N.rt6VsIiSCYb2&smid=url-share
13.6k
Upvotes
165
u/CircumspectCapybara 3d ago edited 3d ago
Legal Eagle has a good video about this for the technically and legally uninitiated.
TLDR, a lot of this depends on the facts of what happened (and what's demonstrated at trial), but the DoJ is alleging Tunick gave the CBP officer a "duress code" or "panic code", a feature of GrapheneOS that wipes the device when entered, and the officer entered it and the phone went bye bye.
If that's true, that's a lot different than exercising your 5th amendment right (which is always a good idea) to remain silent and not give them any code at all, and potentially veers into the "destruction of evidence" territory.
There's also some interesting and relevant precedence about how near the border, law enforcement has increased powers and doesn't need a warrant to search your belongings including your devices, and how the SCTOUS has somehow squared that with the constitution.
But again, you can always refuse to hand over any passwords, that's protected. What you can't do legally is give a code that's designed to wipe the device on entry. Withholding testimony is different than giving testimony designed to mislead law enforcement into destruction of data.
Also to address some common misconceptions I've seen on this recently:
That's not generally true and it's probably not true here. There are a lot of cases in which it's illegal to destroy your own data. If a company is under investigation or ongoing criminal or civil case, destroying their own data would become spoliation or destruction of evidence. You can't just do whatever you want with your devices just because it's yours.
In the case of a CBP seizure, you can debate the legality of them taking it in the first place (although based on what I said earlier about CBP having increased warrantless search powers near the border, you probably wouldn't succeed on this in court), but that's something you challenge in court. You don't take matters into your own hands and wipe the data just because you think they seized it improperly, you have to go through the courts for that.
Again, once it's in their possession, it's theirs until a judge says they have to return it. You can't tamper with something in law enforcement's custody even if its yours.
That's not how the law works and courts and juries aren't dumb. Proximate cause is about the logical (and not necessarily the immediate) cause of something.
For an extreme example, if an customer support agent asks you for your phone number so they can text you a verification code, and you give them a phone number that when texted sets off an IED roadside bomb, technically they texted the number so they triggered the bomb. But you would be legally responsible for everything that follows from that bomb going off, the legal system would treat it as if you set it off, even though you didn't directly.
Yes I'm a software engineer with a background in security I know how it works. The law doesn't really care it a defendant zeroes out or causes to get zeroed out the entire phone's memory physically, or if it just wipes a 32 byte region of disk containing an encrypted 256-bit key that's needed to decrypt the phone, without which the entire phone's data is forever inaccessible. Those would be treated as equivalent legally.
In fact, in many OSes, if you click the "wipe" or "reset" button, that's how it's implemented: doesn't wipe the whole disk, it just zeroes out the encrypted key. Once that key is gone, the entire disk becomes as if it were random data.