Bluetooth trackers are very clever pieces of technology. They’re very small, pretty cheap and barely consume any power. Attach them to your belongings, perhaps your keys or a wallet, and you can use a smartphone to pinpoint their location on a map — a boon for the careless and the forgetful amongst us.
Their reputation, however, has been blighted by one very obvious concern: what if someone slips one of these things into your bag, your coat pocket or sticks one to the underside of your car?
The ability of these trackers to become a convenient tool for stalking has become a growing concern in recent months, as people across the world — predominantly women — report new incidents to police, journalists and on social media.
director of cybersecurity at the Electronic Frontier Foundation and an expert on stalkerware
Much of the focus has been on Apple’s tracker, AirTag, for a number of reasons: it has become the best-known in the marketplace; its location reporting is incredibly accurate thanks to its dependence on a huge network of existing Apple devices; and, most importantly, it has anti-stalking technology built in, such that people being tracked by a maliciously placed AirTag could be notified of its presence. Those alerts have drawn attention to problems inherent in the technology that are only now, somewhat belatedly, being addressed by manufacturers.
The complaints are all very similar. A smartphone alert informs the person being tracked that an AirTag is following them, with details of the journey they’ve recently taken. A subsequent search might reveal the device hiding in a bag, or in clothing, or wedged between the licence plate and body of a car. It’s possible at this stage to disable the AirTag by removing its battery, but the person being tracked may already be at home, and whoever tracked them may already know where they live. By demonstrating its aptitude both for tracking and for alerting victims of stalking, the AirTag has successfully ticked all the boxes. But the problem hasn’t gone away.
“AirTags are more powerful than other physical trackers because they are more accurate,” says Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation and an expert on stalkerware. “They do have some anti-stalking mitigations, which competing products [such as Tile] do not. However, those mitigations are not equally distributed. They’re pretty good, but only if you exist inside the Apple ecosystem.”
Galperin is referring to the fact that it’s only iPhone users running iOS 14.5 or later who will receive these stalking alerts. Anyone with an Android phone would have to download and install a special app called Tracker Detect to achieve the same level of protection. Galperin is campaigning for such alerts to be baked into the Android operating system, so potential victims don’t have to anticipate being stalked, but she notes that neither Apple nor Google are particularly motivated to work together to solve the problem.
Pushing back against criticism, Apple has been keen to highlight AirTag’s success stories, where people have been reunited with valuables, even their medication. It also notes that the safety features it has introduced (or will soon be introducing) are “a first in the industry”.
These include warning messages during the set-up process that using an AirTag to track people is a crime; improved accuracy to help find and disable nearby AirTags; audible beeps from tags deemed potentially malicious; plans to increase the volume of those beeps following criticism that they weren’t loud enough; and a special alert if an AirTag speaker is found to have been disabled or tampered with. (AirTags modified to be silent have been seen for sale on Etsy and eBay.)
Given the extent of these measures — which ensure that anyone unwittingly carrying an AirTag should be alerted to the fact — potential buyers of an AirTag may well ask: “But what if the person being alerted is a thief who’s stolen my bag?” It’s a good question, and one which highlights the dichotomy at the heart of the whole Bluetooth tracking industry. Part of the magic inherent in these devices is that we could, in theory, use them to pinpoint the location of a stolen item. But Apple is careful not to make such promises. AirTags are, it reminds us, not for tracking stolen items, merely lost ones. It’s a delicate, but critical semantic difference.
“It’s perfectly natural for people to want a product which allows them to track stolen items,” says Galperin. “But the price of that is the creation of a perfect stalking device. A device which effectively tracks your item when it's been stolen does not tell the thief that they're being tracked. Which is to say, it has no anti-stalking mitigations.”
The truth, therefore, is that a Bluetooth tracker with decent anti-stalking provisions cannot be relied upon to protect your property from theft. Unsurprisingly, this message isn’t being communicated very well by Apple, Samsung or any other manufacturer. After all, "These tags are not as useful as you think they are" is not much of a marketing slogan. “Nor is, ‘We care more about people being stalked than we care about your property’,” says Galperin.
It begs the question of whether the minor benefits that Bluetooth trackers actually bring (i.e. the ability to speed up the process of locating your lost keys) are really worth the problems of privacy and security which they unquestionably cause. “That,” says Galperin, curtly, “is a question for Apple’s marketing department.”
