Ramblings from a Researcher-In-Training

Peer Reviewed

Posts tagged AirTag
Some Important Follow-Up on Apple's AirTag Stalking Problem

Apple just announced some much-needed improvements to the Find My network specifically addressing the stalking concerns surrounding AirTags and other Find My accessories — which I discussed at length in a recent post. The list of changes is lengthy (which is good), and addresses many areas of improvement to the Find My network's privacy and anti-stalking feature-set. Chance Miller covered all of the changes in detail over at 9to5Mac, but in short the list of promised improvements includes:

  • Clear language during AirTags setup about the intent of the product, and their anti-stalking features.
  • Improved nearby device alerts that more-specifically identify the device detected near you
  • Expanded support documentation on what users should do if they get such a Find My alert.
  • Availability of the Precision Finding feature to recipients of "unwanted tracker" notifications.
  • On-device alerts when nearby AirTags begin playing a chime in an attempt to be found.
  • "Refined unwanted tracking alert logic" — hopefully improvements to the required duration before an alert, etc.
  • Louder AirTag tones to make finding them much easier.

All of these improvements are very good iterations on an already-outstanding system. As I harped on in my previous post, AirTags and the Find My network stand entirely alone in the tracker market in terms of anti-stalking protections, and these additions only reaffirm that position. I even posited that Apple's approach to AirTags privacy features might result in more creeps getting caught, as opposed to any increase in stalking in general, due to AirTags automatically alerting any would-be victims. Apple provided some commentary (albeit lacking in specifics) on this topic in their post as well:

We have been actively working with law enforcement on all AirTag-related requests we’ve received. Based on our knowledge and on discussions with law enforcement, incidents of AirTag misuse are rare; however, each instance is one too many.

Every AirTag has a unique serial number, and paired AirTags are associated with an Apple ID. Apple can provide the paired account details in response to a subpoena or valid request from law enforcement. We have successfully partnered with them on cases where information we provided has been used to trace an AirTag back to the perpetrator, who was then apprehended and charged.

The fact that every AirTag has a unique ID, is tied to an Apple ID, and alerts its victims to its presence makes it an incredibly bad choice for creeps to commit crimes; as I speculated, a quick subpoena for the owner of a malicious AirTag provides law enforcement with all the information they need to make a quick arrest — and Apple seems more than happy to help with such efforts (as they should be).

The only major component missing from Apple's AirTags adjustment announcement are accommodations for any Android-users who may fall victim to stalking. Chance Miller sums up the issue nicely:

Going forward, the biggest hole in the Find My and AirTag alerts ecosystem continues to be on the Android side of things. While Apple does offer a “Tracker Detect” application to locate nearby AirTags with an Android device, the app doesn’t scan for nearby accessories in the background. Instead, it only scans a user’s surroundings when the user initiates the scan.

It might require some sort of cross-platform collaboration between Apple and Google, but ideally there’s more that can be done in this regard to protect Android users.

I couldn't agree more — I think if Apple partnered with Google to bring background tracker scanning to Android, all of the obvious holes in the Find My network would be patched and any would-be stalkers using AirTags would probably just be signing up to be ID'd and quite possibly arrested.

NewsMatt VanOrmerAirTag
On Apple's AirTag Stalking Problem

Apple’s AirTags are one of the most feature-rich and useful consumer tracking products on the market — extensive OS integration, pinpoint tracking accuracy using Apple’s U1 chip, and perhaps the biggest benefit of all: the unrivaled network of iOS devices on the Find My network, which essentially guarantees a lost item is able to “ping” its owner with a location. That said, easy, affordable, and ubiquitous tracking devices have caused some considerable concern particularly from victims of stalking — Ryan Mac and Kashmir Hill summarize the issue well in their New York Times coverage:

Ms. Estrada is not alone in her experience. In recent months, people have posted on TikTok, Reddit and Twitter about finding AirTags on their cars and in their belongings. There is growing concern that the devices may be abetting a new form of stalking, which privacy groups predicted could happen when Apple introduced the devices in April.

The sharp increase in reports of people being unknowingly tracked by bad actors using AirTags is clearly indicative of a major problem — but the question I’ve been wrestling with since these stories began is “Has Apple made the problem of stalking worse with AirTags, or just easier to discover?” This question stems from one of the primary features of AirTags that most competing products entirely lack: the “anti-stalking features” baked into iOS. From the AirTag’s product page:

AirTag is designed to discourage unwanted tracking. If someone else’s AirTag finds its way into your stuff, your iPhone will notice it’s traveling with you and send you an alert. After a while, if you still haven’t found it, the AirTag will start playing a sound to let you know it’s there.

Put simply, if an unknown AirTag is seen moving with you for a period of time your iPhone will send you a notification to let you know, and even cause the offending AirTag to beep and give away its location. I’ve gotten this notification myself on a day where I had my wife’s car keys, “unknown” AirTag included. Since the AirTag did not belong to my iCloud account, I got a warning notification after about four hours of driving around town on my errands. Obviously, in my situation the warning notification was frivolous and almost worth a chuckle (after all, I knew my wife’s keys were the culprit) — but to someone who finds an AirTag in their purse after a party or on the underside of their car? I imagine discovering that some stranger is tracking your location (and has been for a couple hours) would be greatly distressing.

AirTag Notifications and the Frequency Illusion

For a moment, let’s place the many recent stories about unwanted AirTag stalking in context with Apple’s anti-stalking feature (which notifies iOS users of the fact they are being tracked) and the surrounding market of other readily-available tracking devices (Tile, Chipolo, or no-name options from Amazon and Alibaba) with no such anti-stalking features to speak of. Yes, Apple’s AirTags have the U1 chip, which greatly narrows the accuracy of the device to under one foot versus the bluetooth-limited range of 30 feet for most other trackers. That said, I would argue a nefarious individual wanting to stalk someone would debatably be foolish to use an AirTag to do so…since their victim has a high probability of being alerted to the tracking device (if they have an iPhone — more on that later). Surely to a criminal, the benefit of AirTags’ highly-pinpoint accuracy is immediately overwhelmed by the downside of getting caught. AirTags’ anti-stalking features make the discovery of an unwanted tracker trivially-easy (for iPhone-users), and each AirTag being paired to a specific iCloud account (and in the case of a surreptitiously-placed AirTag: a specific criminal’s iCloud account) creates a scenario in which victims are readily-notified and perpetrators are easily identified by law enforcement (presumably with a simple subpoena for the owner of the discovered AirTag). In fact, I think the increase in news stories about AirTag stalking situations are less indicative of AirTags causing more stalking, and more indicative of how frequently stalkings already occur — with AirTags’ anti-stalking features simply bringing more of these horrible situations to light. These stories may be a classic example of the Baader-Meinhof phenomenon (AKA the "Frequency Illusion") — in which increased awareness of creeps using AirTags to stalk women creates the illusion that it is happening more often, or even that AirTags are responsible for this illusory increase in incidence.

Finding More Solutions

Stalking is a serious problem, and Apple’s foray into the tracker market places the hefty responsibility of harm mitigation on their shoulders — if nothing else due to their sheer scale making trackers like AirTags so much more ubiquitous. Apple’s iteration on AirTags’ anti-stalking features seems to indicate the company is aware of their role in protecting users, but there’s still plenty of room for improvement. Perhaps the highest-priority item should be bringing the iOS-integrated unknown tracker notification to Android devices as well, as Benjamin Mayo from 9to5mac and others have suggested. Apple has released a dedicated Android app so users can “scan” for nearby AirTags, but the lack of constant background checks and the necessity of manually seeking out the app in the first place renders it all but useless. I’d guess most of the foundational work for Android system-level tracker alerts was done with Apple and Google’s joint effort on the (painfully underutilized) COVID exposure notification API, so a partnership with Google to further-reduce the harm of stalking is probably feasible. In addition, the nebulous amount of time (usually on the order of hours) that an unwanted AirTag needs to be following you seems somewhat untenable if preventing stalking is the goal. If it takes five hours of moving around before you’re notified that you may be being stalked, is the harm really prevented? I proposed on Twitter that Apple (and perhaps Google down the road) should add the ability to lower the time before such a warning is sent to a user’s preference — or perhaps even better, set the default duration very low (30 minutes?) and allow users to raise it if they feel comfortable with the added risk.

Ultimately, I don’t think AirTags are to blame for any perceived increase in stalking incidents since their release — in fact, I think their innovative anti-stalking features are likely resulting in more unaware victims discovering the unwanted trackers and avoiding much worse outcomes. That being said, the ball is still in Apple’s court to take a very negative PR situation and apply some creative solutions (like the ones suggested above) to deliver real-world protections for potential victims of stalking. AirTags’ anti-stalking features have already put pressure on other tracking companies like Tile to develop similar anti-stalking solutions, and hopefully further improvements will make stalking someone with a consumer tracker dingus much more difficult for creeps and weirdos; or if nothing else, results in more of them getting caught.

News, iOSMatt VanOrmerAirTag, iOS, News