---
title: "DHS Told an Activist It Wanted His Phone for Child Abuse Images. It Lied"
description: "Court filings show the real reason was a terrorism probe tied to Atlanta’s Stop Cop City protests, before the phone’s duress PIN wiped it"
author: "Luis Goa"
published: 2026-10-20T16:00:10Z
modified: 2026-10-21T00:35:42Z
url: https://rews.cc/a/dhs-told-an-activist-it-wanted-his-phone-for-child-abuse-ima-bc00d6
language: en
tags: ["privacy", "security", "cbp", "grapheneos", "stop-cop-city", "us"]
publisher: "Rews (https://rews.cc)"
---

# DHS Told an Activist It Wanted His Phone for Child Abuse Images. It Lied

*Court filings show the real reason was a terrorism probe tied to Atlanta’s Stop Cop City protests, before the phone’s duress PIN wiped it*

By Luis Goa · October 20, 2026 · https://rews.cc/a/dhs-told-an-activist-it-wanted-his-phone-for-child-abuse-ima-bc00d6

## In brief

- DHS email cited “suspected terrorist activities” 3 hours before Tunick’s flight landed, CBP told him it was CSAM instead
- A CBP officer later admitted there was no basis for the CSAM claim, per a defense court filing
- Tunick faces up to 5 years under 18 U.S.C. § 2232(a) for his phone’s wipe; defense found only one prior case under the statute
- GrapheneOS’s duress PIN, added June 2024, destroys cryptographic key material rather than deleting files
- A suppression ruling is pending; defense reply due October 23, 2026; Tunick has pleaded not guilty

Three hours before Samuel Tunick’s flight landed at Hartsfield-Jackson Atlanta International Airport on January 24, 2025, a Homeland Security Investigations officer emailed Customs and Border Protection a one-line justification for stopping him: “TUNICK is under investigation by HSI/JTTF for suspected terrorist activities.” The email, now filed as a court exhibit, asked CBP to route him to secondary inspection, seize his electronics, and collect the passcodes. When Tunick actually reached the inspection room, CBP officers gave him a different reason entirely: they told him they were searching his phone for “kiddie porn.”

That discrepancy is the subject of a new filing by Tunick’s lawyers, reported by [404 Media](https://404media.co/dhs-said-they-searched-man-who-wiped-grapheneos-phone-for-child-abuse-material-they-lied/), seeking to throw out evidence in the federal case against him. One of the CBP officials involved, identified as Officer Findley, “acknowledged that officers had no reason whatsoever to believe Mr. Tunick possessed child pornography,” according to the defense brief. Tunick denied the accusation on the spot. His lawyers call the CSAM claim “nothing more than pretext for a fishing expedition into the depths of Mr. Tunick’s devices.”

**How the stop and search unfolded** Based on court filings in United States v. Tunick

| From | To | How |
| --- | --- | --- |
| HSI/JTTF email to CBP *(cites "suspected terrorist activities," sent ~3 hrs before landing)* | CBP secondary inspection *(Atlanta airport, Jan. 24, 2025)* |  |
| CBP secondary inspection *(Atlanta airport, Jan. 24, 2025)* | Officers tell Tunick: searching for CSAM *(officer later admits no basis for this)* |  |
| Officers tell Tunick: searching for CSAM *(officer later admits no basis for this)* | Tunick provides a passcode |  |
| Tunick provides a passcode | Phone's duress PIN triggers wipe |  |
| Phone's duress PIN triggers wipe | Charged under 18 U.S.C. § 2232(a) *(up to 5 years)* |  |

Based on [404 Media / court filings](https://404media.co/dhs-said-they-searched-man-who-wiped-grapheneos-phone-for-child-abuse-material-they-lied/)

Tunick, a Stop Cop City activist in Atlanta, was indicted by a federal grand jury on November 13, 2025, on a single count of knowingly destroying the digital contents of a Google Pixel phone “for the purpose of preventing and impairing the Government’s lawful authority to take said property into its custody and control.” The indictment was sealed and only became public when it was unsealed with his arrest on December 3, 2025, first reported by 404 Media. The statute is 18 U.S.C. § 2232(a), and conviction carries up to five years in federal prison. His federal public defender, Matthew Dodge, told 404 Media he had found only one other prosecution brought under the same provision — a drug-trafficking case — calling this one “extraordinarily rare.”

## How the duress PIN actually erases a phone

Tunick’s Google Pixel ran GrapheneOS, a hardened fork of Android built around locking down the operating system against forensic extraction tools. Since June 2024, [GrapheneOS has shipped a duress PIN/password feature](https://decrypt.co/374705/completely-legal-grapheneos-pushes-back-as-duress-password-case-proceeds): a second credential that, entered anywhere the phone asks for a PIN or password, triggers an irreversible wipe instead of unlocking the device. According to [GrapheneOS’s own documentation](https://grapheneos.org/features), the wipe “does not require a reboot and cannot be interrupted,” and it also destroys any installed eSIMs. The feature does not delete files one by one; it destroys the cryptographic key material — including the Weaver table on the phone’s secure element, a rate-limiting structure for unlock attempts — that the operating system needs to decrypt storage at all. Once that key material is gone, the encrypted data on disk is mathematically unreachable; there is no file left to recover, because there is no longer a key that could ever reconstruct one. GrapheneOS has said flatly that it has no way to help investigators around this: “there’s nothing we can do to assist with it.”

Whether entering that code counts as “destroying property” under § 2232(a) is the live legal question, and it is complicated by who did the typing. By Tunick’s account, he gave CBP officers a passcode and they entered it themselves; the wipe was not something he triggered with his own hands inside the inspection room. [GrapheneOS posted on July 27, 2026](https://decrypt.co/374705/completely-legal-grapheneos-pushes-back-as-duress-password-case-proceeds) that “GrapheneOS is completely legal. We have no obligation to weaken any of the security protections it provides,” adding that laws forcing it to weaken that security “would be unconstitutional.” That statement addresses the software, not the specific act of handing over the code at a border checkpoint, which is what the indictment actually charges.

[![An Interview With the Man Charged for Allegedly Wiping His GrapheneOS Phone](https://i.ytimg.com/vi/LvjdD4iDCQ0/hqdefault.jpg)](https://www.youtube.com/watch?v=LvjdD4iDCQ0)

404 Media’s video interview with Tunick on the case, published alongside its reporting. Video: 404 Media · YouTube

The government’s interest in Tunick traces to Defend the Atlanta Forest, the loose campaign against the Atlanta Public Safety Training Center, the complex opponents call Cop City. The project was [budgeted at $90 million when the Atlanta city council approved it in 2021](https://en.wikipedia.org/wiki/Cop_City); 61 activists connected to the opposition movement were indicted in Georgia under the state’s racketeering statute in August 2023. Tunick is being prosecuted by the office of U.S. Attorney Theodore Hertzberg, which in June 2026 also charged two people over a 2022 arson and explosives attack on a contractor building the training center. Tunick himself has not been charged with any Cop City–related offense, any act of terrorism, or possession of CSAM — only with the single count over the phone wipe. A rews [earlier report](https://rews.cc/a/immigration-advocate-sues-u-s-over-phone-seized-at-miami-air-67b155) covered a separate case of a phone seized from a traveler at a US airport, part of a broader pattern of expanded device searches at the border this year.

## Where the case stands

Tunick’s lawyers, Melissa McGrane and Joseph Austin of the Federal Defender Program, filed a motion to suppress on March 17, 2026, arguing CBP never read him his Miranda rights during a custodial interrogation in which he repeatedly asked for an attorney, and that the stop itself was an unlawful pretext for investigating his political associations rather than any crime. Magistrate Judge Christopher C. Bly held an evidentiary hearing on the motion on July 20, 2026, and left the record open for further filings, according to the case docket on [CourtListener](https://www.courtlistener.com/docket/71998357/united-states-v-tunick/). Tunick’s post-hearing brief is due September 18, 2026; the government’s response is due October 9; his reply is due October 23 — two days from now. A ruling is not expected before then.

Tunick has pleaded not guilty. Georgia State University rescinded a job offer to him on September 14, 2026, after the case drew wider coverage, according to 404 Media’s earlier reporting. “I hope people understand that the charges against me are meant to intimidate people against protecting their data and their privacy,” Tunick told 404 Media, “and the government hopes to set a precedent that no one has the right to privacy.” Whether Judge Bly agrees that the stop was pretextual, and what the government’s October 9 response says about why its agents told two different stories about why they wanted into Tunick’s phone, is the next thing to watch in a case that is, for now, the only known federal prosecution built on a privacy feature doing exactly what its documentation says it does.

## See also

- [61 indicted in Georgia on racketeering charges connected to Stop Cop City protests](https://www.pbs.org/newshour/amp/politics/61-indicted-in-georgia-on-racketeering-charges-connected-to-stop-cop-city-protests) — pbs.org · Context on the parallel RICO prosecution of the protest movement