I cast around for a followup a year or so after the original article ran but didn't have enough to warrant a second story. In terms of remote activation of microphone, that also could be done with malware without any company's participation, which is what today's WSJ piece suggests. Re: the WashPost piece, I saw it too. I speculated via Twitter at the time that it could be referring to last cell tower pinged.