"The screen flickered and that's it": The suspect gave the investigators the unlock password, they just didn't know it would destroy the device
American agents demanded a password from a protester, but the one he provided triggered a security feature that wiped his device entirely. He is now facing an unprecedented indictment.
"The screen flickered and that's it": The suspect gave the investigators the unlock password, they just didn't know it would destroy the device
American agents demanded the password for his device from a suspect. He gave them one - but not the one they were looking for.
Imagine the following situation: you return from vacation, land at the airport, and just before you continue home – federal agents take you to a side room. They start interrogating you and demand the password to your smartphone again and again. After hours of pressure, you break and give it to them. The agents type the requested sequence in anticipation of exposing all your secrets, but then something unexpected happens: the screen turns white, flickers – and the device wipes itself completely. This is exactly what happened to Samuel Tonik, an American protester who took part in a protest against a new training center for local law enforcement forces, which was being built in the Atlanta area while damaging natural areas. Now he is facing a rare and unprecedented indictment.
The investigation and the agents' surprise
Tonik found himself in an interrogation room at the Atlanta airport, facing personnel from the US Customs and Border Protection and the FBI, after officials in the US Department of Homeland Security accused him of involvement in terrorism. According to his lawyers, the agents did not read him his rights, did not present any warrant that was supposed to give them the right to access his device, and repeatedly rejected his requests to meet with a lawyer. Instead, they tried to question him about images allegedly showing child sexual abuse – a topic that, according to them, was only an excuse to extract information from him about the protest and gain access to his smartphone.
For a long time, the agents demanded that he unlock the device, which was locked with a password. They pressured him again and again, until finally he relented and gave them a password. The investigators, sure that they were about to lay their hands on a wealth of evidence and internal information, entered the sequence they received into the smartphone. But then something happened that they really did not expect: the screen suddenly turned white, flickered several times, and it seemed that the device restarted itself. When the system came back up, the agents discovered that the phone had completely reset, wiped itself entirely, and all the information was destroyed.
The secret password and the rare indictment
So what actually happened there? The secret lies in Tonik's operating system. He used GrapheneOS, a secure, open-source operating system that runs only on Google Pixel devices, and is considered very popular among privacy and security enthusiasts, as well as among activists. Among other things, and in order to maintain maximum privacy, the system does not include Google services or apps in advance, and does not integrate them by default.
Let's return to the password that Tonik gave the investigators, and it was not the regular unlock password, but a unique emergency password that is predefined in the system – and when you enter it, it simply destroys all the data on the device at that very moment to prevent access to them.
The feature, called Duress PIN or Duress Password, allows users to define a sequence of characters as a wipe password. As soon as you enter it anywhere that access credentials to the device are required – such as on the lock screen or in system notifications – the device immediately and irreversibly wipes itself, including all eSIM cards installed on it. The wiping process does not require restarting the device, and it cannot be stopped or interrupted at any stage.
Although all the information on the device was destroyed, the authorities still confiscated the empty device, and it is still in their possession. Following the incident, an unprecedented indictment was filed in recent days against Tonik for "destruction of property to prevent its seizure."
Tonik's defense attorneys, along with activists at the Electronic Frontier Foundation, say that the clause under which he is charged is particularly unusual. "I have never seen anything like this in my life, although it is a scenario that I have gone over with journalists and activists over the years," noted a security expert named Runa Sandvik in a conversation with TechCrunch.
