[Security Discussion] derpsec:
-They can use FinFisher/FinSpy mobile malware to do this which tries to backdoor you with MITM apps and updates.

don't install unsigned apps, don't blindly accept OTA updates, check app permissions before installing (hmm.. this tetris_game.apk wants to access my mic, camera and SMS history)

-They can ask/bribe/coerce your Telco to push you an update full of hidden spyware

use a custom rom, ask dev if they are using custom keys or stupidly reusing default AOSP keys

-They can ask/bribe/coerce your Telco to push spyware to the SIM

remove simtoolkit apk's in /system/app

-They can ask/bribe/coerce Google to silently install their spyware

remove GoogleServicesFramework.apk and com.android.vending.apk, or use install time SEAndroid mac

-They can ask/bribe/coerce/sabotage your device hardware either on route to you or at the factory

if you think you're being watched (lol) buy used off craigslist for cash to protect supply chain and wipe the phone. there probably is hardware backdoors. buy a Chinese phone then at least you'll be backdoored by them instead of western 3 letters agencies http://en.meizu.com/

-They can sabotage your ROM developer's system to infect the toolchain, or compiler so it compiles hidden backdoors without them knowing

ask if your ROM dev does deterministic building like the torproject does: https://blog.torproject.org/blog/deterministic-builds-part-one-cyberwar-and-global-compromise

There's probably a dozen other ways like using unknown kernel/browser exploits. Remove /system/bin/pm and /system/bin/su and that will counter most of the common remote exploits. Welcome to the privacy arms race where it's impossible to keep up with the ballooning cancerous spying industry.

You can totally disable the mic with SEAndroid boolean "disableAudioCapture" but it kills all uses of the mic including calls, so you'd have to deactivate it when you want to call somebody. The point is to prevent it listening in on what's being said in a room while the phone is supposed to be off or not in use. You'd need an SEAndroid enabled build/rom with (preferably) your own build keys in build/target/product/security or trust and hope the rom developer won't compromise their private build keys and hand them out to agencies, or have sloppy security practices allowing them to be stolen. You can also use app permissions revocation with SEAndroid (and it's built into CyanogenMod) like blocking android.permission.RECORD_AUDIO or android.permission.MODIFY_AUDIO_SETTINGS. Remove anything in /system/app that looks like it records voice like SoundRecorder.apk and SpeechRecorder.apk, any Voice dialers, and remove SimToolkit apk.

You also should have a kernel .config setting of CONFIG_STRICT_DEVMEM=y to prevent ways to disable SEAndroid LSM by screwing with kernel memory. http://dev.gentoo.org/~swift/docs/s...l.html#item-gt-kernelconfig-restrictmemaccess

If you follow instructions to download both SEAndroid and AOSP, you can run diff/patch commands to see what they've changed in the original source, so you can port that to your rom or CyanogenMod source. The 4.3 kernel already contains SEAndroid modifications you just need to build a policy for your device which will all be located in /external/policy/setools and /external/mac-policy for revoke_permissions.xml you can use as reference to make your own on whatever device you have. The default Nexus policies probably "Just work" on most other roms but I've never tried. CyanogenMod team could easily port over all the bitbucket.com/seandroid changes to all their Nexus devices and just make a few additions to label their default system applications.

TL;DR put your phone in the fridge like Snowden does or something soundproof, then talk about your plans to build the Dr. Evil volcano island and moon base laser.