With the battery removed there were ways track phones at least in the 2G days, you won’t be able to use cellular tracking but the phone could be detected by flooding the area with RF and looking for a specific signal pattern that would happen wether the phone was powered on or not or even if it didn’t had a power source.

I don’t know if the new phones can still be tracked like this but in the early to mid 2000’s you had airborne pods capable of detecting phones in remote locations even those which were off/without a battery.

Do you have a citation for this? Not doubting you but I’d like to read more and most I can online isn’t very technical

You can refer to some of the NSA leaks like “The Find” https://www.washingtonpost.com/gdpr-consent/?next_url=https%...

I’ve seen a demonstration of this (intelligence community heritage museum, it was public it was part of an RF demonstration which also included remotely capturing screen images by listening to a VGA cable and some other cool stuff), the specific mode of operation wasn’t revealed it wasn’t clear if the RF absorbed by the antenna causes enough current to flow to power something in the cellphone which sends out a chirp or if it’s completely passive and measures the RF attenuation changed from an antenna being present.

It wouldn’t surprise me if older 2G phones could be wirelessly powered to some extent I still remember those inductive LED after market antennas for old Nokia phones. Alternatively even if no logic was powered it might be that there was some sort of a mechanism to deal with unwanted buildup like tying a capacitor that once full discharges back through the antenna which causes it to emit signal, that might be the thing that makes most sense since otherwise you are risking building up enough charge to damage something.

A small metal box should work well.

For extra inconspicuousness, make the box look like a flask.

The SOP for field agents was apparently to store them in the fridge.

lol, or potato chip bags... it is always a delight to see the bad guy step on a rake. Powerwords: CIA Italy Kidnap Potato

I'd like to know more about this. Do you have any links?

The availability of public sources is limited, look for reports about “The Find” from the NSA leaks.

Hardware kill switches, if you don't trust your stack, just means you're moving the exfiltration time to after you've turned the switch back on.

Depends on your threat mode. Killswitches will definitely prevent connecting to wrong towers and location tracking.

Sorry for the pedantry: It will prevent live cellular tracking, it will not prevent malicious apps or libraries from vacuuming your Bluetooth, WiFi, GPS, barometric pressure, or whatever else you've given permissions to a trusted app that is being used as an exfiltration vector.

If you have kill switches for WiFi, GPS, Bluetooth and sensors, then it will prevent all tracking. Librem 5 smartphone has that.

If a phone runs the Linux kernel, and are hit with one of dozens and dozens of known unpatched exploits, and has no boot security to detect such, expect your hardware switches to be useless when faced with any motivated attacker.

Librem 5 smartphone has that.

To be clear, you're stating that the Librem 5 and Pinephone, with their hardware kill-switches that prevent current getting to the GPS, modem, cameras, BT & wifi radios, and microphone, will still be able to determine where it's been when power is restored to the above radios?

Because I'd like even a pie-in-the-sky hypothetical for how exactly this would work. Keep in mind, there is no inertial navigation in these devices; no pedometer, no low-power fitness tracking, nothing else.

I'm not sayinmg I know it's impossible, but I'm deeply curious how in the world you can make this assertion in good faith, or with any credibility.

> has no boot security to detect such

Purism's Chief Security Officer Kyle Rankin commented that Purism is "looking into implementing" the Librem Key for tamper-evident booting on the Librem 5. Another way this could be done is storing hashes of the boot files in an OpenPGP smartcard to compare with the current boot files to verify that they haven't been changed.

https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque...

Purism can "look into" whatever - they're going to be playing catch up until they have serious security researchers.

I used to be enamored by Purism publications until I saw GrapheneOS.org.

Librem 5 is the only phone in the world having mobile/desktop convergence and OpenPGP smartcard. This is not just theoretical possibility, a lot of research has already been put into it.