Can android lollipop 5.1.1 apps which have permission to access mic and camera access them when the app is not running?
I woke up to the news by the NYT that a popular app I had previously downloaded was solely developed to be used as a spying tool by a government. I did not research the app when I downloaded it and the app needed mic and camera access as it is a messaging app.
What can I do in the future to ensure my mic and camera are not running when I'm not running an app? It will not be practical to check if every app I download is trusted or not as even popular American apps could be potentially malicious.
As all software based techniques have a potential to be flawed or hacked (and, as @Jason commented: an app that is seemingly not running might still run), there may be a 'hardware' based solution:
A good old sticker that covers the camera (only really practical for the front facing camera) is a solution that's not hackable. 'Camera cover slides', available for about 8$ at Amazon, are the more convenient alternative.
Unfortunately I'm not aware of a similar simple solution regarding the mic.