GrapheneOS has defended the legality of its open-source privacy features after a U.S. federal prosecution raised questions over whether built-in anti-forensic security tools can be treated as criminal evidence destruction.
The GrapheneOS Foundation has reaffirmed that its open-source privacy and security features, including its duress password, are fully legal and protected under the U.S. Constitution after a federal prosecution brought renewed scrutiny to anti-forensic software.
The statement follows the indictment of environmental activist Samuel Tunick, who allegedly activated GrapheneOS’s duress password during a U.S. Customs and Border Protection airport search. The feature instantly destroys encryption key material stored in the device’s Hardware Security Module (HSM), erases user profiles, local storage, accounts and eSIM profiles, and reboots the device, making encrypted data mathematically unrecoverable, even by GrapheneOS developers.
Federal prosecutors charged Tunick under 18 U.S.C. §2232, which criminalises the destruction or impairment of property to prevent federal seizure. The case is expected to test whether using built-in open-source privacy features can constitute criminal destruction of evidence.
“GrapheneOS is completely legal. We have no obligation to weaken any of the security protections it provides. Creating and using GrapheneOS is strongly protected by the U.S. Constitution. Laws attempting to make it illegal or require weakening the security would be unconstitutional,” the GrapheneOS Foundation said.
The Foundation added that while its software is lawful, activating a duress password during an active law-enforcement encounter could still expose users to separate charges such as obstruction of justice or destruction of evidence. The defence has moved to suppress evidence and dismiss the indictment, with the outcome likely to influence the future development and use of open-source privacy tools in the United States.
