Can a smartphone record conversations when locked?
Short answer: Yes. Locking a smartphone does not necessarily prevent its microphone or other installed software from accessing and recording audio. Whether recording can occur depends on the phone’s operating system, permissions, applications and device configuration. A locked screen should therefore not be treated as a security control for confidential conversations.
Explanation
A smartphone's lock screen primarily controls access to the user interface. It should not be assumed to have to have disabled all software activity including the microphone.
Depending on the operating system, application permissions and device configuration, applications or system functions may continue operating no matter that the screen is locked. Audio-related functions, such as recording, can therefore remain available.
For this reason, locking the screen on the one hand, and physically preventing a device from capturing audio on the other, are two different security controls. In environments where spoken information is sensitive, the presence and capabilities of the smartphone should be considered separately from whether its screen is locked
Why it matters
In confidential meetings, the security concern is not simply whether someone can interact with a smartphone. The device itself contains microphones, wireless interfaces and software capable of processing or transmitting information even without human interaction.
This distinction matters in environments involving commercially sensitive discussions, legal matters, government information, investigations, intellectual property or other confidential conversations. Treating a locked screen as equivalent to a disabled device creates a false sense of security.
Where the consequences of unauthorised recording or disclosure are significant, controls should address the capabilities of the smartphone rather than relying solely on its visible state.
Practical considerations
In day-to-day life, locking a smartphone remains an important protection against unauthorised access. This should not, however, be relied upon as a control against audio capture during a sensitive conversation.
Organisations should assess device-related risks according to the sensitivity of the meeting and their own security requirements. Measures may range from establishing clear device policies, to removing personal electronic devices from the meeting environment, to using appropriate technical controls.
The optimum approach depends on the level of confidentiality required and the risks the organisation is seeking to manage.