---
title: "You put your phone down. It keeps talking"
locale: "en"
url: "https://irz.fr/en/articles/leak-phone-keeps-talking-en"
markdown_url: "https://irz.fr/en/articles/leak-phone-keeps-talking-en.md"
category: "tech"
tags: ["privacy", "network", "Tailscale", "Raspberry Pi", "digital art"]
published_at: "2026-08-20T09:58:00.000Z"
author: "Léa Perrin"
translation: "https://irz.fr/fr/articles/leak-phone-keeps-talking-fr.md"
---

# You put your phone down. It keeps talking

LEAK turns a phone’s network traffic into light and sound. The crucial detail is that the sculpture does not detect the act of putting the phone down: it becomes the phone’s route to the internet.

The discovery headline was almost too perfect: “when you put your phone down, this sculpture starts listening.” It immediately suggests a pressure sensor, proximity detector or some neat physical ritual in which touching the table wakes the artwork.

That is not what **LEAK**, the digital sculpture by Arthur Effront, actually does. Putting the phone down does not trigger anything in the electronics; by then the sculpture is already listening because the phone has been configured to route its internet traffic through the Raspberry Pi.[1](https://www.creativeapplications.net/member/leak-unknown-communications-made-visible/)[2](https://www.hackster.io/news/when-you-put-your-phone-down-this-sculpture-starts-listening-4f9e7118e38b) The real mechanism is more useful than the imagined sensor trick because it exposes a network relationship rather than a gesture.

## No sensor

The published description of LEAK mentions no presence sensor, external accelerometer, RFID reader or pressure-sensitive surface that detects a phone being placed nearby. The architecture it does describe is built around **Python, Tailscale and a Raspberry Pi 4**.[1](https://www.creativeapplications.net/member/leak-unknown-communications-made-visible/)

The phone joins a Tailscale network and uses the LEAK machine as its internet gateway. Tailscale calls that role an **exit node**: a device inside the private network carries the client’s ordinary internet traffic out to the public network.[3](https://tailscale.com/docs/features/exit-nodes)

What creates the interaction is the route itself: LEAK sits between the phone and the public internet for as long as the client keeps using that exit node.

> Illustration: Diagram of network traffic flowing from a phone through LEAK to the internet. The real causal chain: the phone routes traffic through LEAK using Tailscale. Placing the phone down is not an electronic event detected by the sculpture. Credit: [IRZ illustration](https://www.creativeapplications.net/member/leak-unknown-communications-made-visible/).

That puts the sculpture directly in the path of the conversation between a connected device and the internet.

## The phone talks

Locking a smartphone screen does not necessarily silence its network activity, since notifications, synchronisation, token refreshes, service requests, DNS, telemetry and persistent connections may continue according to the operating system and installed apps. LEAK turns that background traffic into something with a physical presence. Its LCD can display information including **packet size** and origin or destination, while light and sound provide a more abstract translation of the same flow.[1](https://www.creativeapplications.net/member/leak-unknown-communications-made-visible/)

Effront’s question then becomes literal: what do our devices say when we stop looking at them?

The project does not answer with a packet-analysis dashboard that demands expertise. It answers with a physical object that can remain active beside a phone whose owner considers it idle.

## A Pi in the middle

CreativeApplications calls the Raspberry Pi 4 LEAK’s “microcontroller”, although Raspberry Pi specifies a full **single-board computer** built around a Broadcom SoC, LPDDR4 memory, Gigabit Ethernet and a Linux operating system.[1](https://www.creativeapplications.net/member/leak-unknown-communications-made-visible/)[6](https://www.raspberrypi.com/products/raspberry-pi-4-model-b/specifications/)

The distinction matters because LEAK needs to run Python, Tailscale, traffic analysis and audiovisual outputs at the same time. A Linux computer sitting on the routing path is a natural fit for that job.

On Linux, Tailscale can route through the kernel: WireGuard packets arrive encrypted, Tailscale removes the tunnel layer, and the original packets return to the kernel for forwarding toward their destination.[4](https://tailscale.com/docs/reference/kernel-vs-userspace-routers) That sequence places the Pi directly in the packet path instead of merely observing traffic from somewhere else on the network.

## What it can see

Sitting in the path does not mean reading everything on the phone.

To be sure, Tailscale builds its tunnels on WireGuard, but removing that tunnel at the exit node does not remove every other layer of encryption.[5](https://tailscale.com/docs/concepts/wireguard) The node forwards the original traffic to the internet after Tailscale has decrypted the tailnet transport; when the original connection uses HTTPS, **application TLS still exists** between the phone and the remote server.[4](https://tailscale.com/docs/reference/kernel-vs-userspace-routers)

LEAK can therefore work with whatever network information is available: volume, packet sizes, timing, addresses and some unencrypted metadata. The project description itself says the proxy exposes partially unencrypted communications and explicitly mentions packet sizes and origins or destinations.[1](https://www.creativeapplications.net/member/leak-unknown-communications-made-visible/)

That is very different from automatically learning the text of a Signal message or the body of an HTTPS API request merely because the Pi is the exit node.

> Illustration: Diagram separating observable network metadata from HTTPS content that remains encrypted. An exit node can observe packets passing through without automatically decrypting application content protected by HTTPS or end-to-end encryption. Credit: [IRZ illustration](https://tailscale.com/docs/reference/kernel-vs-userspace-routers).

That limitation helps the work because the mere existence, rhythm and destination of a communication are already enough to make hidden activity perceptible, without turning the sculpture into a content-interception appliance.

## Network consent

Another important detail is that Tailscale does not secretly send a phone through any exit node that happens to be available. The node must advertise that role, an administrator must allow it, and each client device must explicitly choose to use it.[3](https://tailscale.com/docs/features/exit-nodes)

LEAK is therefore closer to a prepared experiment than an ambush: before watching a device communicate, its owner first agrees to make the sculpture the gateway for that device. This sharply limits the demonstration, since nothing in the published architecture suggests a gallery installation could simply listen to every phone walking past it.

It also makes causality cleaner, because the traffic being visualised was deliberately routed into the system.

## Not reproducible yet

IRZ searched for a public repository matching LEAK or Arthur Effront and did not find the project code. CreativeApplications documents Python, Tailscale, Raspberry Pi 4, an LCD, lighting, sound and a transparent 3D-printed PLA structure, but provides no complete program, electronics bill of materials or reproducible deployment procedure.[1](https://www.creativeapplications.net/member/leak-unknown-communications-made-visible/)

The broad architecture is checkable from the published descriptions and Tailscale documentation, while the exact filtering, aggregation and mapping from packets into sound or light remain impossible to audit independently without public code.

That is the difference between **understanding a mechanism** and **reproducing an artwork**. The first is possible here; the second needs more documentation from the author.

## Two network sculptures

LEAK is not the first gallery work to make network infrastructure into the artwork itself. Beginning in 2014, Trevor Paglen and Jacob Appelbaum exhibited **Autonomy Cube**, a transparent sculpture containing computers that routed visitors’ traffic through Tor and could participate in the anonymity network as relays or exit nodes.[7](https://www.wired.com/2016/04/sculpture-lets-museums-amplify-tors-anonymity-network/)

The two works point in almost opposite directions: Autonomy Cube modifies a museum network to **add anonymity**, whereas LEAK alters the path so the existence of communication becomes perceptible.

In both cases, the important part is not merely what the sculpture displays. It is what the sculpture **does to the route taken by data**.

## Down, not silent

Arthur Effront studies Media & Interaction Design at ECAL, where his recent work already moves among tangible interaction, mixed reality, sound and digital systems.[8](https://ecal.ch/en/school/network/people/arthur-effront/) LEAK follows the same logic by giving an abstract infrastructure a visible and audible body.

The shorthand “put your phone down and the sculpture listens” makes the project sound like a behavioural sensor. The real version is more precise: **configure the phone to pass through the sculpture, then notice what it keeps doing after you, the human, have stopped using it**.

Putting the phone down triggers nothing in LEAK; it simply makes the contrast visible between our idea of an idle device and a network connection that keeps doing work.

## References

1. [Arthur Effront / CreativeApplications, LEAK – Unknown communications made visible](https://www.creativeapplications.net/member/leak-unknown-communications-made-visible/)
2. [Hackster.io, When You Put Your Phone Down, This Sculpture Starts Listening](https://www.hackster.io/news/when-you-put-your-phone-down-this-sculpture-starts-listening-4f9e7118e38b)
3. [Tailscale, Exit nodes (route all traffic)](https://tailscale.com/docs/features/exit-nodes)
4. [Tailscale, Kernel vs. netstack subnet routing & exit nodes](https://tailscale.com/docs/reference/kernel-vs-userspace-routers)
5. [Tailscale, About WireGuard](https://tailscale.com/docs/concepts/wireguard)
6. [Raspberry Pi, Raspberry Pi 4 Model B specifications](https://www.raspberrypi.com/products/raspberry-pi-4-model-b/specifications/)
7. [WIRED, The Artist Using Museums to Amplify Tor’s Anonymity Network](https://www.wired.com/2016/04/sculpture-lets-museums-amplify-tors-anonymity-network/)
8. [ECAL, Arthur Effront](https://ecal.ch/en/school/network/people/arthur-effront/)