Woman Charged Under Felony Destruction-of-Evidence Statute for Deleting Phone Data

Last month, a man in Michigan got charged under Michigan’s felony destruction-of-evidence statute because he wiped his phone at a U.S. border crossing—and he wasn’t the first. What makes this case different is how it played out. He wasn’t hiding something obvious; he was running GrapheneOS, a hardened Android fork built for privacy, and when customs asked for the PIN, he gave them the duress code. The system responded exactly as designed: the data vanished.

Now the government is treating that designed behavior as destruction. That’s not how most of us think about a phone that follows its owner’s instructions—especially when the owner wasn’t trying to hide anything criminal. The charge isn’t even a terrorism statute; it’s a generic obstruction charge filed in state court. That mismatch tells you everything about where this is heading.

Technical Overview

The technical setup for this kind of operation isn't complicated, but it’s not trivial either. You're essentially dealing with a client-server architecture where the client is a piece of software running on a user's device, and the server is a remote service that the client communicates with. The server's job is to receive requests from the client, process them, and return a response. The client's job is to send those requests and handle the responses.

The protocol used for this communication is HTTPS. It’s the same protocol used by every website you visit, but here it’s being used for a specific purpose: to send and receive data between your device and a remote service. HTTPS is built on top of HTTP, which is a stateless protocol. That means each request the client sends is independent of any other request—it doesn’t remember anything from one request to the next. This is why services use sessions or tokens to maintain state across multiple requests.

Here’s a simple example of what a client request looks like in Python using the requests library:

import requests

response = requests.get(
    "https://example.com/api/endpoint",
    headers={"Authorization": "Bearer YOUR_TOKEN_HERE"},
    timeout=10
)
print(response.json())

The client sends a GET request to https://example.com/api/endpoint with an Authorization header that contains a token. The server processes the request, checks the token, and if it’s valid, returns a JSON response. If the token is invalid or missing, the server will return a 401 Unauthorized response.

The server itself is likely running on a platform like AWS, GCP, or Azure. It’s configured to handle HTTPS traffic, which means it’s using TLS (Transport Layer Security) to encrypt the data being sent between the client and server. TLS is what makes HTTPS secure—it ensures that the data being transmitted can’t be read or tampered with by anyone else on the network.

The quote "If the government wants you no amount of technical gotchas will prevent this" is a blunt reminder that no matter how secure the software is, there are always other vectors for compromise. If an adversary has the resources and legal authority to compel access, they’ll find a way. HTTPS, TLS, and secure tokens can protect against passive interception or active attacks from third parties, but they don’t protect against compelled access from the entities that control the infrastructure.

The service itself is likely designed with these constraints in mind. It might use short-lived tokens, rate limiting, and other security measures to make unauthorized access harder, but the fundamental limitation remains: if the server is under the control of an entity that can issue legal requests, there’s no technical solution to prevent those requests from being fulfilled.

Industry Impact

The GrapheneOS duress PIN case highlights a gap between technical safeguards and legal reality that most travelers won’t bridge. A device wipe isn’t some remote administrative option—it’s a court-ordered remedy when investigators suspect obstruction, and courts treat it as such. The implication isn’t that travelers are powerless. It’s that the legal system treats wiping a device as a proportional response to alleged noncompliance, regardless of whether the underlying data actually mattered. That’s the part we keep glossing over: the charge isn’t about data destruction. It’s about the act of refusal itself.

I don’t think the advice to use burner phones is wrong, exactly. It’s just incomplete. Burners lower the stakes of refusal by reducing the perceived value of what’s being asked for, but they don’t change the fact that border officers can still demand access and courts can still sanction noncompliance. The deeper issue is that we’ve normalized a system where a misdemeanor-level allegation—“obstructing an investigation”—can trigger device wiping, and that precedent now shapes how travelers weigh their risks.

Where I’m genuinely uncertain is whether this will push a material shift in travel behavior. The people most likely to use duress PINs are already the ones who treat phones as disposable assets. Everyone else has to decide: is the inconvenience of a burner or a secondary device worth the marginal protection against a process that treats refusal as the real crime? The answer probably depends less on technical capability and more on how much someone values the illusion of control at the border.

Conclusion

She deleted her phone data using a feature that exists for exactly this scenario—yet she’s still facing felony charges. That’s not justice, it’s just inertia. The border agent’s claim that this was obstruction doesn’t change the fact that she followed the software’s built-in safeguard. Someone’s going to spend taxpayer dollars proving the obvious, and the only people profiting will be the lawyers on both sides.

At this point, the real takeaway isn’t about encryption or legal technicalities. It’s simpler: if you cross a US border with anything worth protecting, assume it’ll be wiped. The system is set up to make that happen. Burner phones aren’t paranoia—they’re the baseline.