The "sandbox" means:The modem does not access system memory Power input of the modem is controlled by the application processor Audio input of the modem is controlled by the application processor The above points are effective solved by having a separate module or chip for the modem and only communicating with it via a simple serial port. Plus, adding a switch to its power supply and audio. However, some people are even more paranoid and add an RF switch between the modem and the antenna, "just to be sure". Not sure how far the Neo900 and the Purism go with this, though. (Neo900 had a detailed doc somewhere but I can't find it now.)