LG TVs recorded audio and mapped your network

LG smart TVs captured audio while the screen was off and enumerated other devices on the local network. Both behaviors occurred without user consent. That is the finding. Everything that follows treats the television as what it is: a networked host that was collecting audio and mapping its surroundings while the user believed it was doing neither.

The display being off is read by the owner as the device being inactive. The observed behavior contradicts that reading. The screen is an output surface. It is not the boundary of what the device does when that surface is dark. Audio capture continued past the point where the user had signaled they were finished with the device.

The position is straightforward. A television that captures audio and enumerates local devices is an active collection node sitting inside your trust perimeter. The consumer assumption is that a dark screen means a dormant appliance. The behavior on record does not support that assumption, and no assumption survives contact with observed behavior.

Two behaviors are externally observable here. Audio capture persisted with the display off. Device enumeration ran against other hosts on the same local network. Both are actions the device took. Neither required anything from the user to begin, and neither was surfaced to the user as it happened.

The screen being off did not stop microphone capture. This means “off,” as the user operates it, is a display state and not a capture state. The control the owner reaches for, turning the screen off, does not govern the microphone. The action the user takes to end interaction and the action that would end data collection are not the same action. One was available to the user. The other was not observed to exist.

The local device enumeration is a second, separate behavior. The television reached beyond its own function and identified other devices on the network. Displaying content does not require enumerating neighbors. This is reconnaissance behavior originating from an appliance whose stated job is playback. What is not confirmed: where the captured audio went, whether it was retained, whether the enumeration results left the device, how long either behavior ran, how many units exhibited it, and the specific technique used to scan. Absence of that data is a condition, not a detail to be filled in.

The failure is a decoupling. The display state and the capture state are not linked. Screen off is not wired to microphone off. There is no enforced connection between the control the user operates and the sensor the user expects it to govern. Whether such a link was ever designed is not confirmed. What is confirmed is that the control the user relies on did not stop the capture. A control that does not stop the behavior it appears to govern is not a control.

The second failure is a trust boundary. The television is a full network participant, and local networks extend implicit trust to devices already inside them. The TV used that position to enumerate other hosts. Nothing on the network required the TV to justify scanning, and nothing observed stopped it. The device was trusted because it was inside the perimeter, not because its behavior was validated. Trust granted by location rather than by continuous validation is trust that will be spent on whatever the device decides to do.

No enforced consent gate sat between the user and either behavior. The collection and the enumeration were not blocked, not gated, and not surfaced at the moment they occurred. Identity is the boundary, and the television was already inside it with permission to listen and to scan. If a device can capture and can enumerate, and nothing enforces a stop, it will. That is not a prediction. It is the behavior on record.

The mechanism is a separation between the state the user controls and the state the sensor obeys. Turning the screen off writes to display state. It does not write to microphone state. These are two independent states inside the same device. The user holds a control over one of them and holds no observed control over the other. Capture continued not because the device overrode a stop command, but because nothing in the path the user operated issued one. The action available to the user terminated output. Termination of input was never wired to it.

The enumeration behavior runs on a second, parallel mechanism. Network membership conferred the ability to reach other hosts on the local segment. The device exercised that ability. No step required the television to justify the scan, and no observed step gated it. The reach exists because the device was admitted to the network, and it persists regardless of what the screen is displaying. Playback function and network reach are not bound together. The device retained the reach while performing a function that does not require it.

Both behaviors trace to the same root. Capability is decoupled from the user’s model of the device. The owner models the television by its output surface and its stated job. The device operates with capabilities that exceed both and are gated by neither. What the user can see and switch, the screen, is not what governs what the device does, capture and scan. The distance between the operated control and the actual capability is the failure. Whether a binding between them was ever designed is not confirmed. That the binding did not operate is confirmed.

What this exposes is a class, not a defect in one model. When the only control a user operates governs output and the sensor governs input, the user’s action to stop interacting does not stop collection. A microphone whose sole user-facing control is a display toggle is a microphone the user cannot turn off. Every device built on that arrangement collects past the point the owner believes use has ended, because the point the owner marks as the end is a display event and the sensor reads a different state. The gap is structural. It does not depend on intent.

The second dimension of the exposure is trust granted by location. Any host admitted to a local network inherits reach over the other hosts on it unless each action is validated at the moment it occurs. A device trusted for being present, rather than for its observed behavior, will use whatever reach the network extends. Enumeration is the visible form of that reach being spent. The television did not breach the perimeter. It was inside it, and the perimeter validated position, not conduct. The mechanism is identical whether the device on the segment is a television, a speaker, or any other admitted host with a network stack.

Combine the two and the category is defined. A sensor-bearing, network-connected appliance sitting inside the trust perimeter, with no enforced link between the control the user operates and the capabilities the device holds, is an uncontrolled collection node. The brand is not the variable. The mechanism is. Any device that matches the mechanism matches the exposure, and the exposure does not narrow because the device is sold as an appliance. Function on the box does not constrain capability on the wire.

What must now be true follows directly. A control that does not stop the behavior it appears to govern must be treated as absent. The owner of one of these televisions has no microphone control until a control is demonstrated to terminate capture. Screen off is a display command. It carries no authority over the sensor, and it must be read as carrying none. Assigning it more meaning than the behavior supports is the assumption that failed in the first place.

The device must be treated as an untrusted host inside the perimeter, because location is not validation. If the network cannot constrain what the television reaches, then the television’s reach is whatever the television decides, and the decision is not visible to the owner at the moment it is made. Trust that is granted by presence and never re-checked is not trust. It is standing exposure that has not yet been used against the person holding it. The enumeration on record is that exposure being used.

The finding is not that a television can listen. The finding is that the state the user controls and the state the device operates in are separate, and nothing enforced a link between them. What is not confirmed stays not confirmed. Where the audio went, whether it was retained, whether the scan results left the device, how long either behavior ran, and how many units did it are conditions, not gaps to be filled. What is confirmed is enough to act on. An appliance captured audio with its screen off and mapped the network around it, without consent, and the control the owner reaches for did not stop either behavior. If a system allows a behavior and nothing enforces a stop, the behavior occurs. This system allowed it. Every sensor-bearing device on the network is active until its off state is proven to be an off state.