Privacy-focused operating system developer GrapheneOS has declared its software "completely legal" and protected under the U.S. Constitution, following the first known U.S. criminal prosecution involving one of its security features.

GrapheneOS is an open-source, security-hardened mobile operating system built on the Android Open Source Project, offering enhanced privacy protections such as sandboxing, hardened memory allocation, and granular permission controls for users who include activists, journalists, and security-conscious individuals.

"We have no obligation to weaken any of the security protections it provides," the project stated on X (formerly Twitter) on July 27. "Creating and using GrapheneOS is strongly protected by the US constitution. Laws attempting to make it illegal or require weakening the security would be unconstitutional."

GrapheneOS is completely legal. We have no obligation to weaken any of the security protections it provides. Creating and using GrapheneOS is strongly protected by the US constitution. Laws attempting to make it illegal or require weakening the security would be unconstitutional.

— GrapheneOS (@GrapheneOS) July 27, 2026

The statement was posted in a thread discussing the criminal case. When asked whether the project was refusing to cooperate with Homeland Security, GrapheneOS responded that it could not assist. Once key material has been wiped, "there's nothing we can do to assist with it," the project wrote, adding that bypassing encryption is "not possible" by design.

The Case Against Samuel Tunick

Samuel Tunick, an Atlanta-based activist, faces charges under 18 U.S.C. § 2232, a federal statute that criminalizes the destruction or attempted destruction of property to prevent its seizure by the U.S. government. He allegedly entered a duress code that wiped his Google Pixel smartphone during a warrantless border search in January 2025. He has pleaded not guilty and faces a maximum sentence of five years in federal prison. A judge is expected to rule on his motion to suppress evidence no earlier than the end of October.

That motion carries broader significance. U.S. courts have long recognized a "border search exception" to the Fourth Amendment, permitting warrantless searches at ports of entry without probable cause. However, federal circuit courts remain divided on how that exception applies to electronic devices, with some requiring reasonable suspicion for forensic searches of phones and laptops. How the court treats the warrantless search of Tunick's device could inform that ongoing legal debate.

In an interview with 404 Media, Tunick described the charges as "meant to intimidate people against protecting their data." He accused the government of seeking to "set a precedent that no one has the right to privacy." Tunick also recounted a year of surveillance prior to his indictment, including a GPS tracker placed on his vehicle and subpoenas for his phone records and Gmail account.

Defense Arguments

Tunick's federal public defender, Matthew Dodge, stated that DHS officers had called ahead to the airport, requesting that Tunick be detained and his phone searched. According to Dodge, agents searched both Tunick's bags and person over his explicit objections and found nothing. He emphasized that officers could have obtained a warrant but chose not to. "They didn't do that," Dodge said.

Dodge also noted that he identified only one other prosecution under the same statute, which arose in a drug trafficking investigation. He called the application of the charge "extraordinarily rare."

Government Response

A spokesperson for U.S. Customs and Border Protection (CBP) told 404 Media that all travelers are subject to inspection upon entry. The spokesperson said searches of electronic devices are infrequent and evaluated on a case-by-case basis, factoring in travel history and law enforcement alerts. The U.S. Attorney's Office declined to comment on the matter.

GrapheneOS Duress Feature

GrapheneOS introduced its duress PIN feature in June 2024, designed precisely for the type of scenario Tunick described. Project founder Daniel Micay pointed to a published overview of the system's defenses against data extraction from locked devices.

In a separate statement, GrapheneOS noted that the secure element in the Google Pixel—the phone recommended for use with its firmware—only updates after the device owner authenticates, describing this as a deliberate defense against "state coercion."

The case also enters a broader, years-long debate over the tension between strong encryption and law enforcement's investigative needs—a conflict previously spotlighted in disputes involving Apple, Signal, and other companies over whether providers can or should facilitate access to locked devices and encrypted communications.