I think that you (and others!) must have misread: I did not write that malicious software would turn on the hardware — I wrote that it 'could turn off the LED w

I think that you (and others!) must have misread: I did not write that malicious software would turn on the hardware — I wrote that it 'could turn off the LED when the camera and microphone are running.' What I mean is that a user could leave the hardware switches in the microphone- or camera-on positions, but malicious software could turn off the LEDs, so that the user would think he had privacy but in fact did not.