Type what you’re looking for and press Enter.

Your device may not actually be turning off

January 4th, 2026
3 Comments

One of the important things to realize these days is that when you turn a device off, it may not actually be turning off. Instead, it might go into a standby or low-power mode and keep working in some way depending on the device, while looking like it is not functioning anymore. It’s especially important to keep this in mind when you care about privacy and security. Let’s take a look at what this means and what you should watch out for.

Your device might not actually be off

When you turn such a device ‘off’, it might, for example, still be recording certain information while using various components such as the microphone, Wi-Fi, NFC and Bluetooth radios when they are present. An example of this is Apple’s iPhone. Here’s from How-To Geek, “What Does ‘iPhone Findable After Power Off’ Mean?” (May 22nd 2022):

Starting with iOS 15, certain recent models of iPhone (such as iPhone 13) can be remotely located while powered off thanks to the Find My network and the Find My app. This is possible because even when powered off, the iPhone provides a small amount of reserve power to the Bluetooth, UWB, and NFC chips. The feature can help you find a lost iPhone more easily, even if the battery has died.

And here’s more on this from LiveMint, “Your iPhone is still broadcasting your location after shutdown or theft – here is how it works” (December 7th 2025):

Apple’s Find My network can locate an iPhone even when it is switched off, using nearby Apple devices to relay encrypted location data. […] Apple’s Find My network has quietly become one of the company’s most powerful security tools, allowing iPhones to be located even after they have been switched off. The technology, built into every model since the iPhone 11, uses nearby Apple devices to relay encrypted location data, offering users a significant advantage when a handset goes missing or is stolen. […]

Since the iPhone 11, Apple has equipped its devices with low-power Bluetooth technology that continues to function briefly after shutdown. When Find My is enabled, nearby Apple devices, whether they belong to you or strangers, can detect your iPhone and relay encrypted location data back to iCloud. This process is anonymous, and a thief cannot disable it simply by turning the phone off.

That sounds like a very nice ‘feature’ to have to recover a lost or stolen phone, until you think a little further about how this ‘feature’ can be used against you! I’m sure you can imagine that this ‘feature’ is a privacy and surveillance nightmare. Apple is able to know your exact location, and that of others around you, even when your phone is supposedly turned ‘off’. The UWB (Ultra-Wideband) technology that is still receiving power when the phone is off, can be used for the following:

Like Bluetooth and Wi-Fi, ultra-wideband is a wireless communication protocol that uses radio waves. Ultra-wideband offers high bandwidth with low power usage, but it only works over short distances. That’s why other wireless technologies like Bluetooth and Wi-Fi are still useful: They have a longer range. Unlike “narrowband” technologies, UWB transmits data over a wider frequency (above 500 MHz). Bluetooth and Wi-Fi are unreliable ways of detecting distance and position. Sure, a device with a stronger signal is probably closer than one with a weaker one, but that’s all you can detect–and it’s not perfect, as signals could be boosted to trick the system. Rather than depending on signal strength, the iPhone will measure the round-trip time of the signal to determine the distance it is from another device. Through multiple antennas, UWB can also measure the angle the signal is arriving from. A precise angle combined with a precise distance means your iPhone can pinpoint an object to a reasonably precise location in space.

If Apple can know this, then so can any other rogue entity such as the government (yes, all governments are criminal organizations) or anyone else that has somehow gained access to your device and/or your Apple account.

Device manufacturers might give you the option through the operating system to be able to turn this ‘feature’ off if you don’t want to use it. Apple appears to give users this option in iOS as explained above. But this is no guarantee that this ‘feature’ will actually be turned off by the operating system! Apple might simply lie, or there might be a bug in their software, or, an attacker who somehow gains access to your device might enable this ‘feature’ while you don’t realize it, as we’ve seen with SIM cards recently.

The device manufacturer might even become the victim of a supply chain attack, where one or more back-doors get added into hardware and/or software components that are shipped with the device. Such back-doors could then be used to enable the device to spy on you even while it’s turned ‘off’. As it becomes increasingly difficult to hack into devices using vulnerabilities in software, rogue entities are looking more and more into getting back-doors into devices via the supply chain. It’s not very difficult to do this, since any intelligence agency that takes themselves serious have their spies working at most Big-Tech companies and/or their suppliers these days. In any device, there are subcomponents that come with their own software (AKA‘firmware’) which is usually just a binary blob that the device manufacturer does not have access to (low-level, source code etc.) and cannot verify what’s inside. This can be the firmware that drives your Wi-Fi and Bluetooth modems, for example. Now if you consider that the Mossad from Israhell added bombs to walkie-talkies and pagers in a 10-year supply chain operation, and chips in iPhones were apparently back-doored in a 4-year operation, then anything is possible (see the footnotes in my post “On the FBI and France framing GrapheneOS” for details).

This is why it’s very important to have physical hardware kill-switches on a device that allow you to physically turn off and disable a component in the device, such as the camera, microphones, Wi-Fi/NFC/Bluetooth radios and any sensors that can be used to spy on you. 1 These switches must physically disable power and data lines to these components. This way, even when the software on your phone doesn’t work as advertised and/or gets compromised, you can still ensure that the functionality that they can use is physically limited by turning off the components using the hardware switches. An example of a device that has such switches is the Librem 5 mobile phone. The Librem 5 also tries to minimize or mitigate the use of binary firmware blobs.

It’s important to keep in mind that it’s not a question of if your device gets compromised, but when. No matter what operating system you use on your device, it’s only a matter of time until some kind of vulnerability is used to break into the device. When that happens, the hardware switches are the only way in which you can still limit what can be used to spy on you and it could make a substantial difference. You could also go the Edward Snowden route and open your device and physically disable certain components by disconnecting their cables or desoldering and removing them completely. Snowden is known to have desoldered microphones from his mobile phone for example and using an external microphone when needed to make calls. But this is obviously less convenient than having hardware switches. And unfortunately, removing the battery to make sure that a device is really off is not always a possibility, especially not for most modern mobile phones and tablets these days.

Footnotes

  1. It’s important to consider that the various sensors that are in modern devices these days can also be used to spy on you in ways that you may not yet realize. For example, modern mobile phones and tablets come with a number of sensors installed, such as an ambient light sensor, infrared temperature sensor and accelerometer (motion and orientation). These can be used to infer information about your environment and activities. Below are a few examples.

    An attacker can know how you use your phone and see your environment through the ambient light sensor on your device. Here’s from MIT, “Study: Smart devices’ ambient light sensors pose imaging privacy risk” (January 29th 2024):

    The ambient light sensors responsible for smart devices’ brightness adjustments can capture images of touch interactions like swiping and tapping for hackers. These passive, seemingly innocuous smartphone components receive light from the environment and adjust the screen’s brightness accordingly, like when your phone automatically dims in a bright room. Unlike cameras, though, apps are not required to ask for permission to use these sensors. In a surprising discovery, researchers from MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) uncovered that ambient light sensors are vulnerable to privacy threats when embedded on a smart device’s screen. The team proposed a computational imaging algorithm to recover an image of the environment from the perspective of the display screen using subtle single-point light intensity changes of these sensors to demonstrate how hackers could use them in tandem with monitors.

    An attacker can know what you type based on the motion sensor in your device. Here’s from a paper by Rui Song et al., “I Know What You Type: Leaking User Privacy via Novel Frequency-Based Side-Channel Attacks” (December 2018):

    Smartphone sensors have been applied to record the movement of users for healthy use. However, the motion sensor readings recorded by malicious applications can be utilized as a side-channel to leak user privacy by keystroke inference. Most existing approaches use time-domain statistical characteristics for keystroke inference. Their systems are poor to show the subtle changes in short time period, since the time- domain statistical features can only reflect the characteristics in a long-time interval. In this paper, we propose a novel framework to perform keystroke inference on smartphones. This framework introduces an improved MFCC algorithm to extract frequency- domain features for more comprehensive use of raw data. Since the frequency-domain energy distribution of motion signals is concentrated, and the specificity of signals is strong, MFCC can improve the inference accuracies under complex scenarios. Based on this framework, we present a prototype called FreqKey, which is an inference system to leak user privacy such as PINs and passwords. FreqKey collects motion sensor readings during keystroke events and constructs classification models with machine learning algorithms.

    An attacker can use the microphone in your phone to listen in on you typing on your computer and know what you type. Here’s from a paper by Joshua Harrison et al., “A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards” (August 2023):

    With recent developments in deep learning, the ubiquity of micro-phones and the rise in online services via personal devices, acoustic side channel attacks present a greater threat to keyboards than ever. This paper presents a practical implementation of a state-of-the-art deep learning model in order to classify laptop keystrokes, using a smartphone integrated microphone. When trained on keystrokes recorded by a nearby phone, the classifier achieved an accuracy of 95%, the highest accuracy seen without the use of a language model. When trained on keystrokes recorded using the video-conferencing software Zoom, an accuracy of 93% was achieved, a new best for the medium. Our results prove the practicality of these side channel attacks via off-the-shelf equipment and algorithms.

    ↩︎

Meta

This entry was published on Sunday, January 4th, 2026 at 6:34 am by Karel Donk and is filed under Hardware Information Technology Science Software . You can use the permanent link to bookmark and/or share it.

Comments

There are 3 responses. Follow any responses to this post through its comments RSS feed. You can leave a response, or trackback from your own site.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

The Eye of Providence

Subscribe to blog via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email. Note that this subscription is different from my newsletter.