I can't hang up: measuring a stuck call on a mobile phone

T.S.C.M LTD research. 25 October 2026.

The complaint

In counter-surveillance work, one of the most common things a worried client says is: "Calls on my phone won't end. I press the button and nothing happens." It is easy to dismiss as a software glitch. It is just as easy to over-read it as proof of eavesdropping. We wanted to know whether the complaint can be measured at all, and what the measurement can and cannot tell an examiner.

What we measured

A phone's standard diagnostic capture records the state of every call as the operating system tracks it: ringing, dialing, active, held. From that record we measured one simple quantity: how long an outgoing call stays in the dialing state without ever becoming an active call.

We ran the same measurement on two groups:

• 39 iOS devices from our clean reference set: 146 outgoing call attempts. Longest time in dialing: 47.6 s. Attempts longer than one minute: 0.

• 2 field devices examined during client-commissioned inspections: 3 outgoing call attempts. Longest time in dialing: 800 s. Attempts longer than one minute: 2.

On the two field devices, one call stayed in the dialing state for 392 seconds and another for 800 seconds (more than 13 minutes). In the second case the messaging app had already reported the call as ended, while the operating system still held it open. During that time the phone treated a press of the side button as belonging to the open call, which matches what the user described: the phone "would not respond".

What it tells an examiner

1. The complaint is real and measurable. A call that never connects but stays open for minutes did not occur once in 146 attempts on clean devices. When a client describes it, it can be found in the diagnostic record and documented, instead of being dismissed.

2. The record cannot say why. The same pattern fits a software defect in how an app and the operating system hand a call to each other, and it fits deliberate interference. Nothing in the diagnostic record separates the two. An examiner should not call such a call benign, and should not call it proof of compromise.

3. It is one signal, not a verdict. In our method a stuck call raises the need for a deeper examination. It does not decide the case on its own. A finding of compromise needs independent evidence from a different family of signals.

4. Timing matters. The diagnostic record only covers a limited window. If the symptom comes back, capture diagnostics immediately, while the call is still open.

Limits

The clean reference set is 39 devices and 146 call attempts, all on iOS. The field side is two devices, so we report what we observed, not a rate. Android needs its own measurement.

Why we publish this

Clients describe symptoms long before any tool reports a finding. We think a symptom deserves a measurement, and an honest statement of what the measurement does not prove.

T.S.C.M LTD is a licensed investigations corporation (Israel, Ministry of Justice, licence 1191017). All field data comes from client-commissioned inspections with the client's written authorisation. No client data is included in this article.