Is it technically or theoretically possible for any part of a mobile phone's circuitry to be still on and transmitting even while turned off and the battery has been removed? If so, how?
I am thinking perhaps it could remain in a low power state and certain chips and capacitors could hold their charge for a while. Is this plausible or no?
NB: this question is distinct and more specific than this question so it is not a duplicate.
If you have a phone with a removable main battery, you can try this:
Disable the cellular network, GPS, WiFi, Bluetooth etc on your phone by turning them off manually and then putting the phone into flight mode.
Make a note of the current time shown on the phone and on your PC by writing it down on paper.
Shut down the phone, remove the main battery and the SIM card. Now wait 5 minutes.
Put the main battery back in, but not the SIM card and then turn the phone on again. The phone should still be in flight mode.
Note the current time on the phone again and the current time from your PC.
Remember when in Flight Mode and without the SIM card, the phone cannot get a time update from the cell tower. If a phone just stored the current time in flash memory before shutting down, then on powering on the phone it would be 5 minutes behind and match the time you wrote down on paper. This is because it would not know how much time had elapsed from when the phone had shut off and when it was turned on again. However that is not what happened, it kept up with the current time even when shut off and the battery was removed. That is because of the second battery on the phone.
This HowStuffWorks article looks into the inside of a digital mobile phone. Quoting from the article: "As you can see in the picture above, the speaker is about the size of a dime and the microphone is no larger than the watch battery beside it. Speaking of the watch battery, this is used by the mobile phone's internal clock chip." This would be similar to the function of a CMOS battery in every PC/laptop. There is also a February 2010 patent mentioning a primary and secondary battery of different size and capacity: "The first battery may discharge during use of the mobile phone without simultaneous discharge of the second battery. Upon discharge of the first battery, the second battery may not be automatically activated."
A standard silver cell watch battery has a capacity of 200 mAh, a Zinc-air battery has a capacity of 620 mAh. From personal experience, my battery in my wristwatch has lasted for over a decade as it was just keeping the time, running alarms and the odd stopwatch. I am not certain which capacity the secondary battery is which is installed on most mobile phones but it could contain a newer, powerful one installed by the manufacturers. The design of mobile phones is typically a closed design. There is a new micro-battery that could fit in and power a credit-card-thin device and be charged 1,000 times faster than regular batteries. Therefore every time you charged your phone, it would charge the secondary battery as well.
When the phone is turned off and the main battery is removed, the secondary battery could do more than just keep track of the time. It is all connected to the same circuitry so it could leave certain chips powered on in a low power state, for example the GPS, the microphone, the camera, or the closed baseband processor on every mobile phone.
Now, hypothetically the secondary battery could be remotely activated and periodically do a burst transmission every x minutes and send GPS coordinates or microphone recordings back to your favourite 3 letter agency. If the chips were just passively transmitting, perhaps they need a StingRay or Reaper drone in the area to boost the signal. The cell tower itself may be powerful enough to pick up the signal.
This article states that the NSA can technically listen in to the microphone of an iPhone even if it is switched off. In Edward Snowden's conversations with Laura Poitras he advised her to put her mobile in the freezer. In Snowden's NBC interview he mentions "They can absolutely turn them on with the power turned off to the device". He even took out the main battery in his phone before a recent Wired interview. Removing the main battery may not be enough to avoid surveillance.
If I add a thick layer of tinfoil to my hat, perhaps everyone's mobile phones have been converted to an always on bugging and tracking device by NSA. They could have bugged every phone and home in the world whether their phones were turned on or not. You could get intel on anyone, anywhere. This could be why NSA does not allow mobile phones in their secure environments. It could activate every time it picks up speech then do a burst transmission at certain intervals. Maybe it only does that if you mention certain key words but maybe the phone does not have that capability with only the second battery running. Usually that analysis usually takes place in the basement of Fort Meade.
I would not be surprised in the slightest if there was a big black screen system with a map inside the NSA with coloured dots all over it. The green dots would be the people with their cellphones turned on and transmitting audio and GPS coordinates back to NSA. Then the orange dots would be people in "flight mode" or who have turned their phone "off", but their phone is still communicating with the tower. Then blinking orange dots for people who have turned their phone off and removed their SIM card, but their phone is still trackable by the unique IMEI on their device. Then red dots for people who have turned their phone off and removed the main battery. Highly suspicious behaviour obviously. A Reaper or StingRay would then be dispatched to the red dot's location.
How would you potentially stop surveillance from our mobile phone even with the battery removed?
As Brill would say, "The more technology you use, the easier it is for them to track you."
You must define "transmitting". There are two categories; active and passive. Active transmissions require relatively large amounts of power to actually send out data whereas passive transmissions require little to no added power and could represent a NFC transmission such as an RFID chip being read by a scanner.
There are also some theoretical transmissions types. One is listed here.
While most electronic devices do have some internal power sources (small batteries, capacitors, etc) other than the main battery, these sources are very limited in their uses and generally are only there to preserve vital data while transitioning to a long term 'power off' state. While these power soruces could technically and theoretically be exploited to send a few transmissions, this would require great skill and very customized work.
Also note that an attacker could potentially charge/power a device with static electricity and thus without it powered on or a battery even there. Here's an article.
You may be interested in this question as it deals a little bit with powering on unpowered devices.
So to answer your question, yes, but it is unlikely as it greatly relies on how the device and attack/vulnerability is set up.
Also, IMHO, this seems more like a physics question and less of a security question...
No, even with any internal capacitors or small secondary batteries, there isn't enough power to get off even a small amount of transmission. Transmission simply requires too much power, even for relatively short range given the type of transmitter in the phone.
It would be possible to design a system where the phone could receive a command to do something later if you were to use some type of transistor radio powered off the radio wave itself, but it would require a specialized device with specialized circuity to do this. (I suppose technically such a system could also have a specialized local low-power transmitter, such as NFC tag mode (not the phone mode that is normally supported by newer smartphones), but it wouldn't be communicating on the cell network then.)
So no, realistically this isn't possible unless you are given a specialized phone with hidden hardware in it to either provide large amounts of power or to allow specialized transmission, both of which would be easily identifiable from looking at the insides of the phone.
There are unpowered transmitters (or rather powered by the receiver), such as NFC and RFID tags, and with enough specialized hardware, it may be possible to read/send a very small amount of information (and repeat for a very low bandwidth communication), but these would be extremely limited without a battery or capacitor (note: while most capacitors do have a safety discharge circuit, not all do, and some are known to hold their charge a long period of time)
that said, physical location would be relatively easy to establish via triangulation with a couple high-powered receivers within range (~50 feet max?)
No. The radio(s) require power. Without radio(s) there is no transmitting. While it is quite possible for silicon circuitry to maintain state in the condition described they cannot transmit.
