If it was implemented in such a way, there would be no reason to suspect anyone of using it because it would be totally indistinguishable from not having used it. At that point they have no grounds for legal action. Unless they could monitor FS/disk activity, but that goes beyond typical airport security stuff.

I'm imagining a duress code that erases select files and any indication that there was ever a duress code set up in the first place.