What happens when you turn off your smartphone
When you shut down, the operating system completes processes, closes applications and disables the main processor. The smartphone stops being "smart": no internet, no apps, no screen. But inside the device there is not one processor - and here begins the most interesting.
Baseband chip is a separate computer in the phone
Each smartphone has at least two processors. The first - application processor - launches Android or iOS, your messengers and browser. The second is the baseband processor (radiomodule). A separate chip with its firmware, which steers all radio communication: cellular network, Bluetooth, Wi-Fi. Baseband operates independently of the main OS.
Shutting off the phone in a regular way does not necessarily completely de-energize the baseband subsystem - the radio module is able to keep the minimum activity if the manufacturer has laid it in the firmware. For those in the tank - imagine: you turn off the computer (the main processor), and the router in the next room (baseband) remains in the outlet and continues to flash indicators.
The baseband chip itself is not a spy. It performs the functions laid down by the manufacturer. The question is: which functions remain active after "off" and who can use them.
When the phone is turned off is really "alive"
Three confirmed scenarios in which the off smartphone retains the ability to transmit location information. Two - full-time functions from the manufacturer. The third is the result of a targeted attack.
Low-energy mode iPhone Find My and Google Find My Device
Starting with the iPhone 11, devices support the "Locator" function even after shutdown thanks to a separate Bluetooth LE chip; the U1 (UWB) chip is used for precise positioning, but is not required for the operation of beacons. The device goes into low-energy mode (Low Power Mode): the main processor is inactive, but the Bluetooth Low Energy (BLE) and Ultra-Wideband chips continue to work. The phone periodically sends BLE beacons, they are caught by other Apple devices nearby and anonymously relay the coordinates to Apple's servers - the same principle that AirTag has on the Find My network.
On Android, a similar thing appeared in Google Pixel 8 and Pixel 8 Pro. According to Google documentation, the Pixel off remains visible in the Find Device service within hours of shutdown. Two mandatory conditions: active Bluetooth and GPS at the moment of shutdown. Without them, the regime will not start. The detail that is worth knowing: the geolocation settings on the Pixel can not be changed without unlocking the smartphone, but Bluetooth is switched off freely. The thief will not be able to quickly shoot down the geoposition without knowing the access code.
Here you need to understand the context: it is not surveillance in a frightening sense. The data is only available to the device owner through his Apple or Google account. But if an attacker has access to your account - through phishing, password leakage or banal selection - he will see the location of the "off" phone. Password leaks occur regularly: according to the data Have I Been Pwned, more than 509 million records have flowed from Facebook alone, including email addresses, dates of birth, place of work, gender and geographic location.
Spyware with fake shutdown - wiretapping through the phone
A more realistic threat to the average user is malware that emulates the shutdown. You press the power button, you see the standard disconnection animation, the screen goes out. But the phone did not turn off - it went into a special mode, where the display is inactive, and the camera, microphone and communication module continue to work. One of the most effective methods of listening through the phone, which is actually used by stalkerware-applications.
Researchers from the University of California, San Diego, analyzed 14 popular spyware applications for Android and found a whole zoo of hidden recording techniques. Applications activate the microphone and camera, operate the accessibility functions to record keystrokes, mask their icons under "Wi-Fi" or "Internet Service." Four of 14 received control commands via SMS, and some - without checking the sender. One application allowed remote erasing data from the victim's phone.
The scale of the problem is serious: the number of devices with stalkerware has increased markedly in 2020-2021. Norton Labs reported a 63% increase in the United States, Avast - about 93% in the UK for a similar period (however, the methodology of counting in open reports is not fully disclosed). According to Kaspersky, tens of thousands of users were affected by stalker software in 2023.
Signs of fake shutdown: the device is heated in a "off" state, the battery is discharged noticeably faster than with a real shutdown.
Hardware backdoor in the phone
The most exotic scenario is the physical introduction of the tracking chip into the body of the device. The implant receives power from the battery of the phone bypassing the staff scheme and works completely autonomously. According to unconfirmed data discussed in the community of privacy researchers (in particular, on the Privacy Guides forum), the NSA (NSA) allegedly had the ability to track the switched-off phones through hardware implants that require physical access to a particular device.
Can you hack an off smartphone in this way? Technically - yes. Practically, it is an expensive point operation of the level of special services aimed at a specific purpose. If you are not an investigative journalist, not a diplomat and not an object of operational development - the probability tends to zero. During my time in mobile forensics, I have never met a hardware implant in the device of an ordinary user. Not one.
Cybersecurity myths about smartphones
Now for what doesn't work the way many people think.
"Pulled out SIM - the smartphone doesn't follow the user." Find My BLE beacons work without a SIM card. The phone without SIM continues to connect to Wi-Fi; emergency calls (112) through the cellular network are also possible - but it is a separate channel not related to the BLE-mechanism Find My. The SIM output disables part of the communication channels, but not all.
"Disabled GPS - will not find." The GPS module in the phone only receives a signal from satellites - it does not transmit anything in itself. But the location is determined by a bunch of other ways: triangulation on cell towers, scanning Wi-Fi networks nearby, the device's IP address. According to Kaspersky, the global geolocation data market in 2024 is $21.21 billion. Companies collect information about movements through all available channels.
"Air mode is complete isolation." Air mode disables cellular, Wi-Fi and Bluetooth. How to track the off phone in the air mode? In the state conditions - in any way, it really works. But if the device is infected with spyware, the malware can control the radio modules bypassing the user settings.
"Hackers can remotely turn the phone off." Without a hardware implant, it is impossible. Baseband chip in the normal mode is not able to run the main processor on the external command. If the phone is actually turned off (rather than pretending to be spyware), remote activation is an area of fiction, not real threats.
When you shut down, the operating system completes processes, closes applications and disables the main processor. The smartphone stops being "smart": no internet, no apps, no screen. But inside the device there is not one processor - and here begins the most interesting.
Baseband chip is a separate computer in the phone
Each smartphone has at least two processors. The first - application processor - launches Android or iOS, your messengers and browser. The second is the baseband processor (radiomodule). A separate chip with its firmware, which steers all radio communication: cellular network, Bluetooth, Wi-Fi. Baseband operates independently of the main OS.
Shutting off the phone in a regular way does not necessarily completely de-energize the baseband subsystem - the radio module is able to keep the minimum activity if the manufacturer has laid it in the firmware. For those in the tank - imagine: you turn off the computer (the main processor), and the router in the next room (baseband) remains in the outlet and continues to flash indicators.
The baseband chip itself is not a spy. It performs the functions laid down by the manufacturer. The question is: which functions remain active after "off" and who can use them.
When the phone is turned off is really "alive"
Three confirmed scenarios in which the off smartphone retains the ability to transmit location information. Two - full-time functions from the manufacturer. The third is the result of a targeted attack.
Low-energy mode iPhone Find My and Google Find My Device
Starting with the iPhone 11, devices support the "Locator" function even after shutdown thanks to a separate Bluetooth LE chip; the U1 (UWB) chip is used for precise positioning, but is not required for the operation of beacons. The device goes into low-energy mode (Low Power Mode): the main processor is inactive, but the Bluetooth Low Energy (BLE) and Ultra-Wideband chips continue to work. The phone periodically sends BLE beacons, they are caught by other Apple devices nearby and anonymously relay the coordinates to Apple's servers - the same principle that AirTag has on the Find My network.
On Android, a similar thing appeared in Google Pixel 8 and Pixel 8 Pro. According to Google documentation, the Pixel off remains visible in the Find Device service within hours of shutdown. Two mandatory conditions: active Bluetooth and GPS at the moment of shutdown. Without them, the regime will not start. The detail that is worth knowing: the geolocation settings on the Pixel can not be changed without unlocking the smartphone, but Bluetooth is switched off freely. The thief will not be able to quickly shoot down the geoposition without knowing the access code.
Here you need to understand the context: it is not surveillance in a frightening sense. The data is only available to the device owner through his Apple or Google account. But if an attacker has access to your account - through phishing, password leakage or banal selection - he will see the location of the "off" phone. Password leaks occur regularly: according to the data Have I Been Pwned, more than 509 million records have flowed from Facebook alone, including email addresses, dates of birth, place of work, gender and geographic location.
Spyware with fake shutdown - wiretapping through the phone
A more realistic threat to the average user is malware that emulates the shutdown. You press the power button, you see the standard disconnection animation, the screen goes out. But the phone did not turn off - it went into a special mode, where the display is inactive, and the camera, microphone and communication module continue to work. One of the most effective methods of listening through the phone, which is actually used by stalkerware-applications.
Researchers from the University of California, San Diego, analyzed 14 popular spyware applications for Android and found a whole zoo of hidden recording techniques. Applications activate the microphone and camera, operate the accessibility functions to record keystrokes, mask their icons under "Wi-Fi" or "Internet Service." Four of 14 received control commands via SMS, and some - without checking the sender. One application allowed remote erasing data from the victim's phone.
The scale of the problem is serious: the number of devices with stalkerware has increased markedly in 2020-2021. Norton Labs reported a 63% increase in the United States, Avast - about 93% in the UK for a similar period (however, the methodology of counting in open reports is not fully disclosed). According to Kaspersky, tens of thousands of users were affected by stalker software in 2023.
Signs of fake shutdown: the device is heated in a "off" state, the battery is discharged noticeably faster than with a real shutdown.
Hardware backdoor in the phone
The most exotic scenario is the physical introduction of the tracking chip into the body of the device. The implant receives power from the battery of the phone bypassing the staff scheme and works completely autonomously. According to unconfirmed data discussed in the community of privacy researchers (in particular, on the Privacy Guides forum), the NSA (NSA) allegedly had the ability to track the switched-off phones through hardware implants that require physical access to a particular device.
Can you hack an off smartphone in this way? Technically - yes. Practically, it is an expensive point operation of the level of special services aimed at a specific purpose. If you are not an investigative journalist, not a diplomat and not an object of operational development - the probability tends to zero. During my time in mobile forensics, I have never met a hardware implant in the device of an ordinary user. Not one.
Cybersecurity myths about smartphones
Now for what doesn't work the way many people think.
"Pulled out SIM - the smartphone doesn't follow the user." Find My BLE beacons work without a SIM card. The phone without SIM continues to connect to Wi-Fi; emergency calls (112) through the cellular network are also possible - but it is a separate channel not related to the BLE-mechanism Find My. The SIM output disables part of the communication channels, but not all.
"Disabled GPS - will not find." The GPS module in the phone only receives a signal from satellites - it does not transmit anything in itself. But the location is determined by a bunch of other ways: triangulation on cell towers, scanning Wi-Fi networks nearby, the device's IP address. According to Kaspersky, the global geolocation data market in 2024 is $21.21 billion. Companies collect information about movements through all available channels.
"Air mode is complete isolation." Air mode disables cellular, Wi-Fi and Bluetooth. How to track the off phone in the air mode? In the state conditions - in any way, it really works. But if the device is infected with spyware, the malware can control the radio modules bypassing the user settings.
"Hackers can remotely turn the phone off." Without a hardware implant, it is impossible. Baseband chip in the normal mode is not able to run the main processor on the external command. If the phone is actually turned off (rather than pretending to be spyware), remote activation is an area of fiction, not real threats.
