Loading story…
U.S. prosecutors have charged Atlanta resident Samuel Tunick with allegedly providing Customs and Border Protection officers a passcode that triggered the wiping of his GrapheneOS phone during a border search at Hartsfield-Jackson airport. The case is being described as a likely first-of-its-kind federal prosecution involving a phone's built-in duress password feature, which can erase device data when a designated code is entered instead of unlocking the handset.
Tunick has pleaded not guilty and is seeking to suppress the evidence, arguing that his detention, denial of counsel, and the seizure of his phone were unlawful. Defense attorneys also contend the investigation was tied to his association with the Cop City environmental movement rather than the child-exploitation-related basis initially cited by authorities, setting up a broader court fight over border device searches, privacy rights, and the legal consequences of anti-forensic mobile security features.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Tunick pleaded not guilty in the federal case and sought suppression of evidence, arguing that his detention, denial of counsel, and the seizure of his phone were unlawful. His attorneys also challenged the government's rationale for the investigation.
At Hartsfield-Jackson airport, U.S. Customs and Border Protection officers allegedly entered a passcode provided by Atlanta resident Samuel Tunick that caused his GrapheneOS phone to erase its contents during an attempted border search. The incident is described as the basis for what may be the first known U.S. federal prosecution involving a phone's duress-password wipe feature.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Court filings in a US leak investigation indicate the FBI was unable to forensically extract data from Washington Post reporter Hannah Natanson’s iPhone because **Apple’s Lockdown Mode** was enabled. The government document states the FBI’s Computer Analysis Response Team (**CART**) “could not extract that device,” offering a rare, real-world data point on Lockdown Mode’s effectiveness against at least some standard law-enforcement mobile forensics workflows. The filings also describe limited recovery from the device’s SIM card via a CART tool that produced an auto-generated HTML report containing only the phone number, and note the FBI paused further extraction attempts due to a court “Standstill Order.” The search and seizure occurred amid an investigation into government contractor **Aurelio Perez-Lugones**, whom prosecutors believe was a source for classified information; investigators also reviewed **Signal** messages between Perez-Lugones and the reporter as part of the case. Apple positions Lockdown Mode (introduced in 2022 for iPhone/iPad/Mac) as a high-risk protection that reduces attack surface by restricting attachments, inbound FaceTime from unknown contacts, certain web technologies, and other features.
Jun 29, 2026
US federal prosecutors indicted **Samaneh Ghandali** and **Soroor Ghandali** (former Google engineers) and **Mohammadjavad Khosravi** (Samaneh’s husband, employed at another unnamed tech firm) for alleged **trade secret theft**, **conspiracy**, and **obstruction of justice** tied to the exfiltration of sensitive processor-related information. The Department of Justice alleges the trio used their roles at multiple Silicon Valley companies to access and steal confidential documents covering **processor security** and **cryptography**, and moved the material to unauthorized third-party and personal locations, including destinations linked to **Iran**. Investigators allege the activity included transferring large volumes of internal files to external communications platforms and sharing them in channels associated with the defendants, with additional copies later found on personal devices and systems connected to the group. Prosecutors also claim the defendants attempted to conceal the scheme through actions such as destroying records, making false statements, and photographing screens to avoid direct document transfers. Google said it enhanced safeguards and alerted law enforcement after discovering the incident; the alleged stolen trade secrets reportedly included information related to Google’s **Tensor** processor used in *Pixel* phones.
Jun 29, 2026
Russian authorities used **Cellebrite UFED** phone-forensics technology to access the iPhone of jailed opposition figure **Andrey Pivovarov** in June 2021, months after Cellebrite said it had ended sales and services to Russian government customers over human rights concerns. A **Citizen Lab** investigation, supported by forensic evidence from Pivovarov’s device and Russian court records, found investigators extracted data including **WhatsApp** and **Telegram** messages and searched for political terms and opposition figures; authorities reportedly could not unlock his MacBook. The findings renewed scrutiny of how surveillance and forensic tools remain usable after vendors cut ties with government clients. Researchers said Cellebrite’s legacy architecture and offline functionality allowed older systems to keep operating without vendor support, and warned that data taken from Pivovarov’s phone may also have aided surveillance of other dissidents, including **Anastasiya Burakova**, who was later targeted in a hacking campaign linked to Russia’s **FSB**. Cellebrite said any post-March 2021 use in Russia was **unauthorized**, involved legacy hardware, and would now be ineffective against modern devices.
Jul 12, 2026