Does switching off a smartphone provide enough security for a confidential meeting?

Not necessarily. Switching off a smartphone can substantially reduce its normal operating capabilities, but whether this is considered sufficient depends on the sensitivity of the meeting and the level of assurance required. For highly confidential environments, security may require devices to be physically removed, isolated or otherwise controlled rather than relying solely on their apparent power state.

Explanation

A smartphone that has been properly powered down is fundamentally different from one that is merely locked or placed in standby. Normal applications, wireless communications and operating-system functions are generally no longer active in the same way.

However, security decisions are not based only on what a device would normally be expected to do. They also consider how much confidence is required that the device cannot capture, process or communicate sensitive information.

In higher-security environments, relying on an individual participant to switch off a device may provide less assurance than a procedure in which devices are physically separated from the protected conversation. The appropriate control therefore depends on both the technical risk and the level of assurance required.

Why it matters

Confidential meetings often involve commercially sensitive information, legal discussions, government matters, investigations, intellectual property or decisions that have not yet been made public.

When smartphones are present, organisations must decide what level of device control is proportionate to the information being discussed. A procedure that is acceptable for an ordinary internal meeting may not provide sufficient assurance for a highly sensitive conversation.

Practical considerations

For lower-risk meetings, requiring participants to switch off smartphones may form part of a reasonable device policy. For more sensitive environments, organisations may choose stronger controls such as collecting devices before the meeting, keeping them outside the protected area or using appropriate isolation measures, such as an isolation-management vault like MuteCase.

The appropriate approach should be determined by the sensitivity of the information, the organisation's security requirements and the level of assurance required during the conversation.