AirTags are the perfect tracking device, but how can we protect users from stalkers?


Bluetooth trackers are very smart technologies. They are very small, quite cheap and barely consume power. Attach them to your belongings, perhaps your keys or a wallet, and you can use a smartphone to pinpoint their location on a map – a godsend for the careless and forgetful among us.

Their reputation, however, has been tainted by a very obvious concern: what if someone slips one of these things into your bag, your coat pocket, or sticks one under your car?

The ability of these trackers to become a practical tool for harassment has become a growing concern in recent months, as people around the world – mostly women – report new incidents to police, journalists and on social media.

It’s perfectly natural for people to want a product that allows them to track stolen items…but the price of that is creating the perfect tracking device.

Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation and stalkerware expert

Much of the attention has been on Apple’s tracker, AirTag, for a number of reasons: it’s become the most well-known on the market; its location reporting is incredibly accurate thanks to its reliance on a vast network of existing Apple devices; and, most importantly, it incorporates anti-stalking technology, so people tracked by a maliciously placed AirTag could be notified of its presence. These alerts drew attention to issues inherent in the technology that are only now being addressed, somewhat belatedly, by manufacturers.

The complaints are all very similar. A smartphone alert notifies the tracked person that an AirTag is following them, with details of their recent trip. A later search could reveal the device hidden in a bag, or in clothing, or wedged between the license plate and the body of a car. It is possible at this point to deactivate the AirTag by removing its battery, but the person being tracked may already be at home, and the person who tracked them may already know where they live. By demonstrating its ability to both track and alert victims of harassment, the AirTag managed to tick all the boxes. But the problem has not gone away.

“AirTags are more powerful than other physical trackers because they are more accurate,” says Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation and stalkerware expert. “They have anti-harassment mitigations, which competing products [such as Tile] do not. However, these attenuations are not equally distributed. They’re pretty good, but only if you exist within the Apple ecosystem.

Galperin refers to the fact that only iPhone users running iOS 14.5 or later will receive these harassment alerts. Anyone with an Android phone should download and install a special app called Tracker Detect to get the same level of protection. Galperin is campaigning for such alerts to be built into the Android operating system, so potential victims don’t have to expect to be tracked, but she notes that neither Apple nor Google are particularly motivated to work together to solve the problem.

Pushing back against criticism, Apple was keen to point out the successes of AirTag, where people were reunited with valuables, even their medications. He also notes that the security features he has introduced (or will soon introduce) are “an industry first.”

These include warning messages during the setup process that using an AirTag to track people is a crime; improved accuracy to help find and disable nearby AirTags; beacons beeps deemed potentially malicious; plans to increase the volume of these beeps following criticism that they weren’t loud enough; and a special alert if an AirTag speaker is found to have been disabled or tampered with. (AirTags modified to be silent have been seen for sale on Etsy and eBay.)

Users can follow AirTag in the new Articles tab of the Find My app.  Picture: Apple

Given the breadth of these measures – which ensure that anyone unwittingly wearing an AirTag must be alerted to the fact – potential AirTag buyers might well ask, “But what if the alerted person is a thief who stole my bag ?” That’s a good question, and one that highlights the dichotomy at the heart of the entire Bluetooth tracking industry. Part of the magic inherent in these devices is that we could, in theory, use them to pinpoint the location of a stolen item. But Apple is careful not to make such promises. AirTags are not meant to track stolen items, just lost ones. This is a delicate but essential semantic difference.

“It’s perfectly natural for people to want a product that allows them to track stolen items,” says Galperin. “But the price to pay is the creation of a perfect tracking device. A device that effectively tracks your item when it’s been stolen doesn’t tell the thief it’s being tracked. That is, it has no anti-harassment mitigation.

So the truth is, a Bluetooth tracker with decent anti-harassment provisions cannot be relied upon to protect your property from theft. Unsurprisingly, this message is not communicated very well by Apple, Samsung or any other manufacturer. After all, “These tags aren’t as useful as you think” isn’t really a marketing slogan. “Nor is it: ‘We care more about people being harassed than your property,'” Galperin says.

This raises the question of whether the minor benefits provided by Bluetooth trackers (i.e. the ability to speed up the process of locating your lost keys) are really worth the privacy and security issues they cause. unquestionably. “That,” says Galperin, “is a question for Apple’s marketing department.”

Updated: February 27, 2022, 7:47 a.m.


About Author

Comments are closed.