Good point, asking for a citation. It's an extraordinary claim and so requires something to back it up. A quick search turns up this quote from a 2013 Washington Post story "By September 2004, a new NSA technique enabled the agency to find cellphones even when they were turned off. JSOC troops called this “The Find,” and it gave them thousands of new targets, including members of a burgeoning al-Qaeda-sponsored insurgency in Iraq, according to members of the unit." Source: https://www.washingtonpost.com/world/national-security/nsa-g...

That WaPo news has been debunked:

http://blog.erratasec.com/2013/07/no-nsa-cant-track-phones-e...

There is NSA method called 'implant', but it requires installation of software (possibly in the firmware). It's not so easy and it can't be used in large scale.

Reading the blog post, it definitely does not 'debunk' the Washington Post report. All it does is take issue with Snowden's blanket claim that all mobiles are vulnerable (which is a good point and is one I'm inclined to agree with).

Let's not confuse mass surveillance and targeted surveillance of small number of people. They are two different things.

Snowden is right when he says that every phone is vulnerable for targeted surveillance. For people like him, every phone is dangerous even when they are closed.

Mass surveillance is different. NSA can't just pick random person and remotely track their phone when it's turned off.

This capability has been known for many years. From 2006:

>"The FBI can access cell phones and modify them remotely without ever having to physically handle them," James Atkinson, a counterintelligence security consultant, told ABC News. "Any recently manufactured cell phone has a built-in tracking device, which can allow eavesdroppers to pinpoint someone's location to within just a few feet," he added.

Source: http://blogs.abcnews.com/theblotter/2006/12/can_you_hear_me....

I believe (but cannot cite) that this capability became mainstream when E911 & GPS was mandated.

This stuff is a big reason why BlackBerry was so critical to regulated industries and public company execs. PIN messaging on legacy BlackBerry was secure between devices on the same BES, and there wasn't a direct linkage to the user's identity, which made it easy to lower the value of metadata collection.

The fact that BlackBerry designed around this early on leads me to suspect (as an outside observer with an imagination) that mass metadata collection was known by folks in industry back in the 90s.

> The fact that BlackBerry designed around this early on leads me to suspect (as an outside observer with an imagination) that mass metadata collection was known by folks in industry back in the 90s.

Wouldn't a simpler explanation be that it was just over-designed for 90s-era threats in a way that hardened it to some more recent threats?

It is definitely a simpler explanation.

Consider however that none of their US based competitors managed to do address those threats in a meaningful way.

Maybe referring to a "short message type 0"

https://github.com/SecUpwN/Android-IMSI-Catcher-Detector/iss...

This was one of the things revealed by the Snowden leaks.

'Dreamy Smurf handles power management, which according to The Guardian includes "an ability to stealthily activate a phone that is apparently turned off"'

https://en.wikipedia.org/wiki/WARRIOR_PRIDE

Snowden didn't want to be in a room with a phone, no matter the state of the phone.