Over the past year, a slew of cases have come to light in which criminals have used AirTags to stalk people.
How AirTags Work
Apple unveiled AirTags in April 2021 as devices that help find easily lost items. Inside an AirTag is a board with a wireless module, as well as a replaceable battery and a speaker that’s actually quite large, and that’s really the bulk of the device .
Here’s how AirTags work in the simplest scenario: you stick the little key fob on your keys, and if one day you’re late for work and your keys are lost somewhere in your apartment, you activate the mode of search on your iPhone. Using ultra-wideband (UWB) technology, the phone directs you to the AirTag, giving you helpful prompts like “hot” or “cold.”
In a more complicated scenario, suppose you attached the AirTag to your backpack and one day you rushed out of the subway so fast that you accidentally left it behind. Since you and your iPhone are already far from your backpack when you realize you’ve lost it, UWB won’t help. Now anyone with a relatively modern Apple device – iPhone 7 and newer – can get involved. Using Bluetooth, they detect nearby AirTags and transmit approximate or specific coordinates to your Apple account. You can now use Apple’s Find My service to see where your backpack ended up, such as in the lost and found office or with a new owner. What is essential is that all of this happens automatically; you don’t even need to install anything. Everything the AirTag search system needs to work is already built into the iOS of hundreds of millions of users.
But since Bluetooth has a maximum range of a few tens of meters, it only works in big cities, where there are a lot of people with iPhones. If your backpack ends up in a small town where all the inhabitants use Android smartphones, it will be difficult to determine the location of the AirTag. In this case, a third detection mechanism comes into play: if a few hours pass and the AirTag hasn’t had a connection with any iPhone, the built-in speaker starts emitting a sound. If the person finding the item understands how to connect their smartphone with NFC to the AirTag, the AirTag shows them the phone number of the item owner.
AirTags and Shady Business
In theory, AirTags are a useful accessory for everyday tracking of easily lost items. Technology can help you find your hidden keys or a bag you forgot. An example of a useful application that has been widely discussed over the past year is sticking an AirTag on a suitcase before boarding a plane. On several occasions, travelers were able to locate their lost luggage faster than airline employees.
But in practice, right after the device went on sale, reports started popping up about how people were using it in ways that weren’t entirely legal, and there were even reports of obvious criminal activity. Here are the main examples.
- A German activist discovered the location of a top-secret state agency after sending it an envelope containing an AirTag. Many people use such a tactic – which is more or less legal depending on a country’s laws – to track actual mail delivery routes, for example. But it is also possible to use an AirTag as the German activist did: if someone uses a post office box to receive mail so that they can keep their real address private, a mail containing an AirTag at the interior will reveal the true place of residence.
- More seriously, in December 2021, Canadian police investigated several incidents in which criminals used AirTags to steal cars. They stuck an AirTag on a car in a public parking lot, used it to determine where the owner lived, then stole the car at night while it was parked in a suburb, a little further away from potential witnesses.
- There are many testimonials involving the use of AirTags to stalk women. In this case, the perpetrators stick an AirTag on a woman’s car or slip it into her bag, then they check where she lives and see the routes she regularly travels. AirTags contain protection against this type of harassment: if the tag constantly moves while away from the iPhone it is linked to, the built-in speaker begins to beep. However, it didn’t take long for DIY enthusiasts to realize that there is a workaround: Modified AirTags with the beep disabled have recently started appearing on the market.
But that’s not even the scariest scenario. In theory, one can hack the AirTag and change its behavior in software. Clear steps in this direction have already been taken: for example, last May, a researcher managed to gain access to the protected firmware of the device. It will be most dangerous for Apple and users if someone manages to exploit the network of hundreds of millions of iPhones to illegally track people without the knowledge of the manufacturer, the owners of the smartphones who participate in a tracing operation and the victims. themselves.
How dangerous are AirTags?
The scariest scenario has yet to come true, and it’s unlikely to be – after all, Apple cares about the security of its own infrastructure. You should also keep in mind that there are other devices similar to AirTags. Various legal and illegal tracking devices have been around for over a decade.
Moreover, even consumer tags with features similar to AirTags have been on the market for a long time. Tile released its tags in 2013, and they also offer ways to search for lost items over a great distance using the same principle as AirTags. Of course, this company probably won’t be able to get “coverage” from hundreds of millions of iPhones. Plus, devices like these cost money – sometimes a lot of money – and they’re relatively easy to detect.
In the case of AirTags, they must be connected to an Apple account, which is difficult to create anonymously without providing a real name and usually a credit card number. If the police report a case of illegal tracking, Apple releases that data — admittedly, you have to convince the police to ask for such data, and according to testimonies from victims in different countries, that doesn’t always happen.
In the end, it’s always the same story: AirTags are a handy technology that criminals can also use for malicious purposes. Apple didn’t invent cyberstalking, but it has developed handy technology that allows people to engage in unlawful harassment. This means that it is the company’s responsibility to make it harder for the device to be used for improper purposes.
Once again, Apple’s closed software and device ecosystem has come under fire. If you have an iPhone and someone slipped an AirTag into your bag, your phone will let you know. What if you don’t have an iPhone? For now, Apple has developed a band-aid solution by releasing an app for Android smartphones that you need to install to detect tracking. The result is that Apple created a problem for everyone but offered a simple solution only to its own customers. Everyone has to adapt in one way or another.
In February, Apple tried to respond to the avalanche of criticism by issuing a lengthy statement. He acknowledged that before releasing AirTag, he had not considered all the ways to use it, whether legal or illegal. He pledged to tell AirTag buyers more explicitly that AirTags should not be used to track people. It also plans to increase the volume of the beep that helps you find an AirTag someone has planted on your stuff. This is commendable, but it does not solve all the problems. We hope that over time Apple will be able to clearly separate legal and illegal ways to use AirTags.
Stalkerware
Apple’s AirTags cost a fair amount of money, a tracker has to link an AirTag to their real account, and the manufacturer actually tries to make it harder for the tags to be hidden.
In contrast, developers of spyware and stalkerware applications do their best to make them as undetectable as possible. In addition to location tracking, tracking apps give the spy a bunch of other options. In particular, they open access to the victim’s documents, photos and messages, which can be even more dangerous than geolocation. So if you’re worried about being tracked, the first thing you should do is protect your smartphone – that’s the most obvious target.
Then you can search for unknown AirTags. If you’re using an iPhone, it’ll let you know pretty quickly that there’s a tag. If you have an Android and want to protect yourself from tracking with an AirTag, install the Apple Tracker Detect app.
