Duress passcodes explained: How they work and why they can land you in court

In a recent incident at Hartsfield-Jackson International Airport, an individual named Samuel Tunick was allegedly compelled by a Customs and Border Protection agent to use a duress passcode on his smartphone. Duress passcodes, also known as self-destruct passcodes, are a security feature designed to erase all data on a device when entered under duress.

This feature is available in GrapheneOS, a privacy-focused version of Android, but it is not present in standard Android or iOS systems. If activated, the duress passcode will wipe all user profiles, data, and the eSIM partition, making recovery nearly impossible. Despite its potential benefits for privacy-conscious individuals such as journalists and activists, the use of duress passcodes can lead to legal consequences.

Tunick is facing charges under 18 U.S.C. § 2232, which could result in up to five years of imprisonment. His legal team is attempting to suppress the evidence based on Fourth Amendment grounds. However, the legal landscape surrounding duress passcodes varies internationally, with some countries having laws that could complicate the situation for users.

While GrapheneOS offers robust protection, it remains a specialty OS not widely adopted, and users without access to this feature may have limited options to secure their data.