A traveller gave a duress password at the border and was charged

On 13 November 2025 a federal grand jury in Georgia indicted a United States citizen for wiping the contents of his phone during a border search. The indictment concerns conduct on 24 January 2025 and rests on a provision about preventing the authorities from taking property. The maximum penalty is a fine, imprisonment for up to five years, or both. The defendant pleaded not guilty. On 17 March 2026 his lawyers moved to suppress both statements and evidence, and an evidentiary hearing was held on 20 July 2026.

What happens technically

The feature at the centre of the case is a duress password. Instead of unlocking the device, the code wipes its contents. GrapheneOS, an alternative Android system for Google Pixel phones, describes the feature as a wipe that cannot be interrupted, and which triggers anywhere in the system where the code is requested. The point is that the user can comply with a demand to give up the code without the contents becoming available. One clarification is necessary here, and it matters: neither the indictment nor the defence motion mentions GrapheneOS or the phrase duress password at all. The connection comes from the defendant's lawyers through the press, not from the court documents.

The legal question is whether giving up a code is an act or a statement. The defence argues the latter, and therefore that it is protected against self-incrimination. They build on three independent grounds: the protection against self-incrimination and the right to counsel, the doctrine that unlawfully obtained evidence cannot be used, and the protection against unreasonable searches. The defence further argues that the stop was planned in advance, that officers gave the search for child sexual abuse material as a pretext, and that during the hearing they conceded they had no reason to believe he held such material. The defence also states that the defendant asked for a lawyer and was refused. The appeals court covering Atlanta currently permits searches of electronic devices at the border without a warrant and without individual suspicion, and the defence asks the court to depart from that line. One point deserves noting: the defence does not concede that a wipe took place, referring to it throughout as alleged, while GrapheneOS states that the feature worked as intended. The prosecutor's office defends the indictment publicly and states explicitly that data counts as property under the provision. A decision can come no earlier than after the final filing on 23 October 2026.

What this means for you if you travel with a work phone

It is tempting to read this case as a question of which phone feature is clever. That is the wrong place to start. The case shows that a technical protection can turn into a criminal charge, and that the choice to use it is not a technical choice at all. Our assessment is that this belongs in the travel policy rather than in the settings on a phone. An employee standing at a border having to decide what to do has already lost. The decision should have been made before departure, by somebody other than the person standing there.

The practical answer most organisations reach is not to bring the data at all. A clean phone with no history offers nothing to wipe, and therefore no situation to handle. If you have staff travelling with client information, source material or personal data, a loaner device and a rule for what belongs on it are worth having. Note at the same time how little is settled here. Nothing has been decided, the defence does not concede that anything was wiped, and the state of the law at the border is precisely the question the court has been asked to address. That is not a foundation to build a policy on, but it is a good reason to have one.

Berigo recommends

• Decide what staff may carry on devices across borders, and write it into the travel policy.
• Use loaner devices with no history for trips where a border search is plausible. What is not there can neither be handed over nor wiped.
• Do not leave the individual employee alone with the choice at the border. The decision belongs beforehand.
• Clarify with counsel what applies in the countries your staff travel to. The rules at the border are not the rules elsewhere in the country.
• Remember that this is a pending case with no decision. Build the policy on risk rather than on the outcome of one lawsuit.