Estimated reading time at 200 wpm: 8 minutes
Executive Summary
The claim that a phone can be used to listen in while appearing to be powered off is not a single capability but a category of attacks that exploit the gap between user perception (“the phone is off”) and hardware reality (“some subsystems remain active or can be made to appear active”). The public evidence falls into three tiers: (1) documented hardware behaviour after shutdown, (2) plausible but not fully demonstrated software subversion of the shutdown process, and (3) refutations or qualifications from security researchers and legal records that constrain the stronger versions of the claim. No peer-reviewed source in the public record demonstrates a complete, end-to-end attack that activates a microphone and exfiltrates audio from a genuinely powered-off, uncompromised device. The most defensible conclusion is that the threat is real but conditional on prior compromise, and that hardware-level shutdown (DFU mode or battery removal) is the only reliable countermeasure.
Whether or not you agree our Fat Disclaimer applies
Vector 1: Fake Shutdown via Malware (Software-Level Subversion)
Mechanism
If malware has achieved code execution on the device with sufficient privileges, it can intercept the shutdown command and substitute a simulated shutdown sequence. The device displays the normal shutdown animation, the screen goes black, and the device becomes unresponsive to user input—but the baseband processor remains in a low-power state capable of receiving remote commands, including activation of the microphone (WIRED, 2014).
Security researchers have demonstrated proof-of-concept implementations. ZecOps developed a trojan that intercepts the iPhone shutdown action, plays a realistic shutdown animation, and keeps the camera and microphone operating without triggering the system’s green/orange indicator lights. When the user later attempts to power on, the trojan displays a fake boot animation—the phone never actually shut down (TWCERT/CC, 2022).
The Counterargument and Its Partial Retraction
When Snowden made the claim in 2014, security consultant Robert David Graham immediately published a blog post arguing the trick was impossible. He then amended the post to concede that the NSA could alter a phone ahead of time to enable the capability—via web exploit, supply-chain interception, or physical access. “With physical access, they could change the chips, the memory, the ROMs, the power system, anything they want,” Graham said (WIRED, 2014).
This is a significant qualification. The refutation was not that the capability is technically impossible; it was that it requires prior access. The dispute is about the precondition, not the mechanism.
What This Proves and Does Not Prove
Proven: A compromised device can plausibly fake shutdown and remain in a state capable of receiving commands. Proof-of-concept malware demonstrating fake shutdown animations exists (TWCERT/CC, 2022).
Not proven: A complete, public, peer-reviewed demonstration of live microphone audio capture and exfiltration from a phone that has been made to appear off, on a current, fully-patched device. The gap between “fake shutdown is possible” and “audio can be captured and transmitted” is technically plausible but not publicly documented end-to-end.
Vector 2: Hardware That Remains Active After Shutdown (Hardware-Level Persistence)
Documented Behaviour on iPhones
A 2022 ACM WiSec paper, “Evil Never Sleeps: When Wireless Malware Stays On After Turning Off iPhones,” established through reverse engineering and firmware analysis that on recent iPhones (iPhone 11 and later), Bluetooth, NFC, and Ultra-Wideband chips continue operating after user-initiated shutdown. All three chips have direct access to the Secure Element. The researchers demonstrated loading modified firmware onto the Bluetooth chip that executes while iOS is not running—i.e., while the phone is in the “off” state (Evil Never Sleeps paper).
The researchers explicitly noted that this means high-value targets can no longer trust their iPhone to be switched off. However, they frame this as a new threat model for targeted individuals, not as a demonstrated listening capability. A practical attack would require prior compromise of the device.
DFU Mode as a Hardware-Level Countermeasure
iPhone hackers have demonstrated that entering DFU (Device Firmware Update) mode sends a hardware reset to the power management unit that overrides any running software, including malware designed to fake a shutdown. In DFU mode, all elements of the phone are entirely shut down except the USB port. “It’s a feature burned into the hardware,” said David Wang, a member of the Evad3rs jailbreak team. “As far as I know, there’s nothing that can stop that hard power-off” (WIRED, 2014).
This is a direct refutation of the claim that a compromised phone cannot be reliably turned off. It can, via a hardware-level mechanism that malware cannot simulate.
A Separate Hardware Vector: Physical Extraction from Powered-Off Android Devices
In 2026, Ledger Donjon demonstrated a hardware-level attack on MediaTek chips used in millions of Android devices (Samsung, Xiaomi, Motorola, and others). By connecting a powered-off Nothing CMF Phone 1 to a computer via USB and applying an electrical fault, they extracted user data—including the PIN—in under 45 seconds. The attack works on a powered-off device but requires physical USB access. The researchers noted this is the kind of capability that interests state-affiliated groups, who compromise public USB chargers in hotels (Ouest-France, 2026).
This is a different attack category from live listening—it is data extraction, not microphone activation—but it reinforces the broader point: “powered off” is not a secure state when physical access is available.
Vector 3: Carrier-Side or Manufacturer-Side Implants
Claim Status
Claims that intelligence agencies can remotely activate microphones via carrier-side commands or manufacturer-installed functionality are not supported by publicly available, peer-reviewed technical documentation. Older reports and advocacy sources repeat the claim, but no technical analysis in the public record demonstrates a carrier-level command that activates a powered-off handset’s microphone.
Assessment
This vector should be treated as unverified. It is not technically impossible—baseband processors run proprietary firmware and communicate with carrier networks in ways users cannot inspect—but the absence of public technical evidence distinguishes it from Vectors 1 and 2, which have documented foundations.
Refutations and Qualifications in the Public Record
The Advertising-Listening Conflation
The popular claim that phones listen for advertising is a different phenomenon from state surveillance, but it is often conflated with it. Cybersecurity firm Wandera placed phones in controlled environments with all permissions granted and found no evidence of active listening for ad targeting. This does not address state-level capabilities, but it matters because the “phones are always listening” narrative often rests on anecdotal advertising coincidences rather than technical evidence.
The Legal Record Is Not Unambiguous
United States v. Oliva (2012) shows a court grappling with “roving bug” terminology and noting that the government represented it had not obtained evidence from “background conversations from cellular telephones that were powered on, but not connected to a live call.” The court distinguished between a phone that is on but not in a call and a phone that is genuinely powered off. The legal record does not straightforwardly confirm the stronger claim that a powered-off phone can be activated at will.
Mitigation and Countermeasures
Against Fake Shutdown (Vector 1)
DFU Mode: Bypasses the operating system and bootloader entirely. Malware that simulates shutdown cannot simulate DFU mode because DFU mode does not load iOS. A hardware reset overrides running software (WIRED, 2014).
Limitation: Requires a computer and cable. Not practical for everyday use.
Against Hardware Persistence (Vector 2)
Physical separation: A Faraday bag blocks radio frequency signals, preventing chips from receiving commands or transmitting audio. Critical caveat: it does not block local recording; it only prevents transmission.
Battery removal: The only definitive countermeasure against all powered-off attack vectors. On modern sealed smartphones, this is not user-accessible.
Against USB extraction: Avoid public USB chargers; use power-only cables or a USB data blocker.
Against All Vectors
Assume the endpoint is the weakest link: End-to-end encryption protects the transport layer. It does nothing once plaintext exists on a compromised device. A device compromised at the hardware or firmware level can capture audio before encryption or after decryption.
Bottom Line
The “powered-off listening” concern is real but conditional. The strongest documented evidence is the persistence of wireless chips on modern iPhones and the demonstrated ability to execute modified firmware in the off state (Evil Never Sleeps paper). The fake-shutdown malware vector is plausible and has proof-of-concept support (TWCERT/CC, 2022), but the public record contains no complete end-to-end demonstration. Security researchers initially disputed the claim and then conceded it was possible with prior access (WIRED, 2014). Hardware-level extraction from powered-off Androids via USB has been demonstrated (Ouest-France, 2026). The practical conclusion is not that every phone is actively listening, but that “off” is not a security boundary, and the only reliable countermeasures are physical: hardware-level shutdown where possible, signal isolation when the device is not under direct control, and the recognition that a compromised endpoint defeats encryption regardless of protocol strength.
