Here's what a smart congressperson would ask: "Director Clapper, on April 15th, 2009, there were large protests around the country. Did your agency request cellular meta data covering that day?"
It's likely obfiscated by the telco as I understand it, but imagine that freakout.
We could pull our batteries out in 2003, but we don't have that feature anymore.
Many of us still do. Some of us still greatly prefer phones with a removable battery--I wouldn't buy a phone without one. Goodbye HTC, hello Samsung.
They wouldn't want to tip their hand re:transmission capabilities. They'd probably only activate the capability on-demand, and only for high-value targets (ie. by sending a special packet to be received by the "powered off" handset). It's sorta like turning your phone into a listening "bug" while powered on... you wouldn't want to constantly stream data and tip your hand -- you'd only activate the capability when there is a strong likelihood of a valuable conversation occurring.
In short, no, it ain't gonna happen. It would show up on Bunnie Huang's blog one day and there would be blood in the streets the next.
I wouldn't expect to get away with it on all phones all the time. But certain phones targeted by surveillance malware? Sure.
Note that powered-off phones still have real time clocks running, for things like keeping time.
> An attempt to do it in the analog domain with no synchronous logic would be even more apparent to anyone who studies the internals of the phone.
I agree, there's little chance of an analog tape recorder being in the phone.
> In short, no, it ain't gonna happen. It would show up on Bunnie Huang's blog one day
Go ask Bunnie if he thinks a well-funded attacker could implement it, having access to the baseband design docs. Then ask him how long it could be used in the wild against unsophisticated targets before it ended up on his blog.
> and there would be blood in the streets the next.
This surveillance malware is being found on phones and in some places there is, in fact, literal blood in the streets.
https://www.securelist.com/en/analysis/204792290/Spyware_Hac...
http://news.cnet.com/8301-13578_3-57573707-38/meet-the-corpo...
Malware can't run when the power management logic has shut down the SoC and baseband hardware.
How many people actually measure the battery life of their phone when they believe it's off?
Is it so hard to imagine part of that logic including the mobile phone equivalent of wake-on-lan?
Yes. You don't have to power up the cellular transceiver to poll a power button. That's usually handled by a dedicated power-management chip with few/no other capabilities (and an internal clock in the kHz range at most, I'd expect.)
The FBI has been known to hack phones such that the microphone is turned on and transmitting when the phone is on but not in use.
http://abcnews.go.com/blogs/headlines/2006/12/can_you_hear_m...
Absurd. Total fiction.