Don't bring sensitive data to a border crossing

Link: US government targets Cop City protester over phone operating system, by Timothy Pratt in The Guardian

This is worth knowing about and is concerning — but not necessarily for the main reason that’s being reported.

The Department of Justice is trying to prosecute Sam Tunick, an Atlanta-based activist, for allegedly using a duress password on his GrapheneOS phone when he crossed the border in January 2025.

“Agent Findley and several others repeatedly asked Tunick to open his phone during the interrogation, telling him they would seize it if he did not. When he finally provided a passcode, “the screen went blank, flashed several times and the phone appeared to restart”, according to the motion.”

The phone was wiped. According to the Department of Justice, rather than the usual unlock password, the one Tunick had provided was a signal that GrapheneOS should reset the device to factory settings. That’s the core issue: it’s not that he was using GrapheneOS or had set up a duress password, but he was accused of using it to reset his device rather than give his data to law enforcement when asked.

At the point where law enforcement or border protection are asking you for data, it’s your right to refuse a search, but you typically can’t actively destroy it. I’ve always understood that the police can’t compel you to unlock your phone without a warrant, although, unfortunately, Customs and Border Protection has an exemption around the border. If there is a warrant, or if CBP asks you in a border zone, you may still refuse to unlock it, but the device may be seized and held. The trick here, which Tunick’s lawyers are arguing, is that the request was unlawful to begin with.

Because Tunick was a part of Atlanta’s Stop Cop City protests, he had been put on a terrorist watchlist; that fact was circulated just three hours prior. That flagged him for the secondary inspection that led to him being asked to unlock his phone. Protest is protected by the first amendment and a core component of democratic speech; putting protesters on a watchlist designed to protect the public against violent extremism is undemocratic. That’s even more affronting when you consider that the protest was against a police training center: the message it sends is nakedly authoritarian. Finally, and most egregiously, the questioning was about child exploitation imagery, which they had no reason to suspect him of holding. As a result, the search may not have been legal.

While a duress password is a deliberate act of destruction, the better path when crossing the border is to not have data to seize to begin with. Anyone who deals with sensitive information should consider that their phone might be taken at the border. Customs and Border Protection policy even allows agents to clone it, giving them permanent access to your data even after they hand your device back to you. They’re only supposed to do this when there’s a national security concern or reasonable suspicion of a crime — but if activists are being targeted as terrorists, that policy threshold doesn’t feel like a solid protection.

So: log out of your email, calendar, and file sharing before you embark upon your travels. Delete Signal entirely (but back it up). Consider which photos you want to travel with. Don’t travel with a stock phone — that can lead to more questions — but intentionally cut down your information footprint. That way, even if you are stopped, you won’t compromise sources (if you’re a journalist) or your compatriots (if you’re an activist). And you’re not forced to delete data in the moment in a way that could leave you vulnerable.