Since the iPhone 11, Apple has kept a radio module active for up to 24 hours after it’s turned off, and the device itself stores a log of months’ worth of data. In the Catatumbo and Cauca regions, charging an iPhone is no longer a convenience: it’s a procedural error.

USA · November 9, 2026 · 850 words

Turned off, wrapped, put away. The gesture that seems prudent is the one that leaves the cleanest trace: the phone continues to transmit in standby mode and the archive of months remains intact inside.

There’s a scene that repeats itself in the camps of Catatumbo and Cauca, one that should already be in the manuals of these terrorist groups: someone turns off their cell phone, wraps it in a cloth, puts it in their combat pants pocket, and feels safe. The gesture makes sense. Turning off a phone should turn it off.

On an iPhone, the location is exact.

In the early morning of November 9, in a rural area of ​​Tibú, the Aerospace Force bombed a camp belonging to the 33rd structure of the ‘Calarcá’ faction. Four were killed, six captured, and ‘Barba Chivo’ was arrested. Three weeks earlier, on October 22, the José María Becerra front of the ELN had been targeted in El Tambo, Cauca: ten dead, including ‘Marcos Pacífico’ and ‘Ochenta’. These are the seventh and eighth such attacks, each targeting a leader. And the pattern has a component that the troops are aware of but the guerrillas haven’t fully grasped: the machinery they carry continues to work against them, even when they believe they have silenced it.

Off is not off

Starting with the iPhone 11, Apple included a feature that the company itself documents but that very few people knowingly use: the phone can be located even when it’s turned off . It’s not magic or a backdoor: when the device is powered off, it doesn’t completely disable the Bluetooth Low Energy module. It leaves it in a standby mode that continues to emit encrypted beacons for hours—up to 24, according to the feature’s design—enough for any iPhone that passes nearby to pick them up and forward them to iCloud.

And in the vast majority of iPhones it comes activated from the factory, because it turns on during the initial setup without the user noticing.

When the battery is running low, the phone sends its final location to Apple. A device that runs out of power at a campsite doesn’t become silent. It leaves a point on the map, and that point is an address.

Airplane mode, the textbook trap

The second mistake is believing that airplane mode is equivalent to invisibility. Airplane mode disables cellular radio and Wi-Fi, but leaves Bluetooth enabled by default, and Bluetooth is precisely what powers the Search network. The user who activates airplane mode and puts their phone away is silencing the noise while leaving the only trace that matters on.

And there’s a third level, the most serious because it doesn’t depend on the network: the phone stores its own history within the device. In Settings → Privacy and security → Location → System services → Significant locations, there’s a record with months of travel, including the time and number of visits to each site. No cloud service or signal is needed to read it: it’s right there on the device. It’s a map of safe houses, supply points, trail crossings, and retreat routes, written by the target himself over months. A phone seized in an operation isn’t just a phone: it’s a pre-written intelligence file.

Added to that is the network log: every WiFi network it connected to and every tower that recorded it, with the date. Cross-referencing that with the location history reconstructs the logistics of an organization without needing a single informant.

The range that most exposes the location

The problem isn’t uniform across the entire lineup. Location sharing with the device turned off has been available since the iPhone 11 and has been maintained throughout subsequent models, including the 15, 16, 17, 18 Pro, Air, and Duo. Starting with the iPhone 14, a built-in satellite modem was added which, where the feature is enabled—Mexico, Europe, Japan, Australia, the US, and South America—allows location sharing without a network connection.

In short: the most expensive phone belonging to the most important people is the one that exposes them the most. And the most expensive one is almost always the one belonging to the person in charge.

The coordinates that come out of such a device mature on a table like this: two telephones, a radio and a paper map.

1. Actual tracking capabilities of the iPhone (independent of PRISM)

• Find My Network : This feature works even when your phone is turned off or has a dead battery. The device emits low-energy Bluetooth signals that other nearby Apple devices relay. This allows you to locate your device even without a cellular network or Wi-Fi.
• Even with the battery removed (in older models) or the phone turned off, there are residual location mechanisms in recent versions.

2. PRISM context and US access

PRISM was an NSA program that obtained data from the servers of US companies (Apple, Google, Microsoft, Facebook, etc.) through warrants issued under the FISA law. Apple denied granting direct access, but the program existed, and companies handed over data under legal requirements.

In current practice:

• Any data that reaches Apple servers (iCloud, Find My, messages, etc.) is subject to US jurisdiction.
• In operations in conflict zones or against groups that are also of interest to the U.S., there is a risk that location or communications information from an iPhone could end up being accessible or shared through intelligence channels.
• It’s not that there’s a «PRISM remote switch» that’s always on, but the architecture of the device and its cloud services creates a permanent exposure surface.

3. Why is it acceptable in the Colombian operational context?

In jungle areas, border regions, or special forces operations (where the coordinates become a target), an iPhone represents a risk of:

• To reveal the position of a group or an analyst.
• Generate a historical record that can be exploited later.
• Compromising communications or metadata that should not leave national control.

The procedure you describe (disabling Search + Bluetooth + Faraday bag or aluminum foil) doesn’t work, but it’s fragile.

Operational conclusion

Consumer iPhones should not be used . It’s not a question of «whether the NSA is listening in real time,» but of architecture: the device is designed to be traceable, sync data with a US company’s cloud, and maintain tracking capabilities even when turned off.

When the distance drops below 60 meters, the map disappears and only an arrow with the exact meters remains.

Offensive Security Certified Professional (OSCP)