Loading story…
Destructive duress passcodes on smartphones are drawing attention after reports highlighted how the feature can wipe a device instead of unlocking it when a user is under coercion. On GrapheneOS for Google Pixel phones, the duress PIN feature introduced in June 2024 erases user profiles, their data, and the eSIM partition by destroying disk-encryption keys, making recovery impractical. The reports note that stock Android and iOS do not provide an equivalent built-in duress passcode, relying instead on slower local or remote wipe options.
The legal risks of using the feature came into focus through the case of Atlanta resident Samuel Tunick, who allegedly triggered a duress passcode during a Customs and Border Protection inspection at Hartsfield-Jackson International Airport in January 2025. Prosecutors charged him under 18 U.S.C. § 2232 for allegedly destroying property to prevent lawful seizure, while his attorneys are contesting the device seizure on Fourth Amendment grounds. The case underscores unresolved legal questions in the U.S. and other jurisdictions over compelled device unlocking and whether intentionally wiping a phone during a lawful search can itself become a criminal act.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Germany’s Federal Court of Justice issued a decision concluding that compelling a suspect to use a fingerprint to unlock a phone does not violate self-incrimination protections because it does not require the same active participation as entering a password.
During a Customs and Border Protection stop at Hartsfield-Jackson International Airport, Atlanta man Samuel Tunick allegedly provided a GrapheneOS duress passcode on his Android phone, causing the device data to be wiped instead of unlocked.
GrapheneOS introduced a duress PIN/passcode feature for supported Google Pixel devices that wipes user profiles, their data, and the eSIM partition by destroying disk-encryption keys.
Prosecutors charged Samuel Tunick with destroying property to prevent lawful seizure after the airport incident. His attorneys are seeking suppression on Fourth Amendment grounds, arguing the seizure was warrantless.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. prosecutors have charged Atlanta resident Samuel Tunick with allegedly providing Customs and Border Protection officers a passcode that triggered the wiping of his **GrapheneOS** phone during a border search at Hartsfield-Jackson airport. The case is being described as a likely first-of-its-kind federal prosecution involving a phone's built-in **duress password** feature, which can erase device data when a designated code is entered instead of unlocking the handset. Tunick has pleaded **not guilty** and is seeking to suppress the evidence, arguing that his detention, denial of counsel, and the seizure of his phone were unlawful. Defense attorneys also contend the investigation was tied to his association with the **Cop City** environmental movement rather than the child-exploitation-related basis initially cited by authorities, setting up a broader court fight over border device searches, privacy rights, and the legal consequences of anti-forensic mobile security features.
Jul 30, 2026
Court filings in a US leak investigation indicate the FBI was unable to forensically extract data from Washington Post reporter Hannah Natanson’s iPhone because **Apple’s Lockdown Mode** was enabled. The government document states the FBI’s Computer Analysis Response Team (**CART**) “could not extract that device,” offering a rare, real-world data point on Lockdown Mode’s effectiveness against at least some standard law-enforcement mobile forensics workflows. The filings also describe limited recovery from the device’s SIM card via a CART tool that produced an auto-generated HTML report containing only the phone number, and note the FBI paused further extraction attempts due to a court “Standstill Order.” The search and seizure occurred amid an investigation into government contractor **Aurelio Perez-Lugones**, whom prosecutors believe was a source for classified information; investigators also reviewed **Signal** messages between Perez-Lugones and the reporter as part of the case. Apple positions Lockdown Mode (introduced in 2022 for iPhone/iPad/Mac) as a high-risk protection that reduces attack surface by restricting attachments, inbound FaceTime from unknown contacts, certain web technologies, and other features.
Jun 29, 2026
Google said it is rolling out a fix for an Android 16 lock-screen bypass in **Gemini** that allows someone with brief physical access to a locked phone to send **SMS** and **WhatsApp** messages without entering a PIN, password, or biometric. Researchers and follow-on reporting said the flaw can be triggered through a specific multi-touch interaction when Gemini is invoked from the lock screen and prompted to open apps such as Messages, bypassing the expected authentication step. Google said the issue is not limited to Pixel devices, though it did not identify all affected manufacturers or models. The bug was reproduced on a fully patched **Pixel 6a** and appears tied to Gemini's **Deep Research** and lock-screen app-handoff behavior, where authentication checks can fail during transitions from the lock-screen overlay into the full app. Reporting said the weakness may also let an attacker regain Gemini access to previously disconnected apps, switch accounts, view or delete Gemini conversation history, change some security settings, and exfiltrate data while leaving no failed unlock attempts logged. The researcher who disclosed the issue said it reflects an incomplete fix for an earlier reported vulnerability and points to a broader trust-boundary problem in how lock-screen restrictions are enforced across Gemini activities.
Jul 21, 2026