Abusing New Tech

Apple AirTag Crimes

Visit the Evidence Files Facebook and YouTube pages; Like, Follow, Subscribe or Share!

Find more about me on Instagram, Facebook, LinkedIn, or Mastodon. Or visit my EALS Global Foundation’s webpage page here.

This article was first published in February 2023.

In the spring of 2021, Apple unveiled its new AirTag. Its intention was to help Apple users locate “items that matter most” with their phone’s “Find My” app. AirTags work using Apple’s U1 chip. It is not a GPS unit, rather it uses Ultra-Wideband (UWB) that essentially networks it to any compatible, in-range Apple device. UWB is a low-power radio protocol, or short-range method of wireless communication. For the layperson, it is similar to Bluetooth. UWB measures how long it takes a radio pulse to move from one device to another, which allows it to precisely pinpoint location, far more accurately than Bluetooth beacons. UWB has a range of about 650 feet (200 meters), with a location accuracy of around 4 inches (10 cm). The more UWB (i.e. Apple) devices that are within range, the more accurate the location pinpoint becomes. If used as intended, users attach the AirTag to an item they don’t wish to lose, such as their keys. When the users look for the item, they simply open the “Find My” app on their iPhone, which will search for the UWB signature from the Tag. Moreover, if the Tag is not immediately detected, users can add a custom message that will appear to any other iPhone user who comes in close enough proximity to it. iOS 14.5 or higher is required to connect an Apple device to the AirTag.

As happens with almost all interesting new technologies, some folks find ways to abuse them. Unsurprisingly, a device made to track down certain items quickly became a tool for stalking. Not long after its launch, police in the US began receiving reports of unknown AirTags attached to complainants’ vehicles or personal items. In some cases, it seems the purpose of the criminal was to track the whereabouts of a specific person; in others, it was to track a vehicle the perpetrator later wished to steal. Because the AirTag connects to any compatible Apple device, potential criminals can use their Find My app to track its location with relatively sharp accuracy. In January of 2021, Apple reported more than 1 billion active iPhones worldwide, with at least 116 million in the United States. That is a lot of data points to help locate an AirTag. Apple responded to reports of AirTag abuses within months. It added a feature where an AirTag that was away from its owner would play an audible sound after 8 to 24 hours. It also created an alert for iPhone users if they were traveling accompanied by an AirTag not associated with their device. For Android users, whose devices do not detect the AirTag, Apple released a Tracker Detect app so they would receive notifications of an accompanying AirTag. Of course, this requires the user to know the app exists, and to go to the Play Store and download it.

There is no question that people have attempted to use the AirTag for nefarious purposes. I assisted on at least two cases myself where this happened. I cannot provide details of those cases, but here are some examples that made it to public media:

Sports Illustrated model Brooks Nader stated on the Tamron Hall Show that her husband discovered an AirTag hidden in her coat pocket after a night out at a bar in Manhattan. Nader’s phone alerted her to the presence of the unknown device, prompting her and her husband to search for it. She stated that she did report the incident to the police, but the technology was new at the time and police seemed unsure what to do about it. It is currently unclear if the police pursued the matter further. In or around the first week of February 2023, a Cincinnati police officer was fired for planting an AirTag on a woman’s car. The officer had a previous relationship with the woman, and allegedly used the AirTag to show up at places he knew she would be based on his ability to track her. The woman discovered the AirTag when it began beeping in her car. The offender was arrested in June of 2022. It should be noted that the criminal charges and firing stemmed from conduct in addition to simply placing the tracking device. In Texas, a man reported to police the presence of an AirTag in the truck he had purchased just hours earlier. In that case, it turned out that the man had actually purchased a stolen truck (apparently unknowingly). The thieves who sold it to him, however, seemed to have planted the AirTag to track the vehicle to, well, re-steal it later. Another case, in Montgomery County, Pennsylvania, involved a woman reporting to police that she had discovered that an unknown AirTag had been tracking her all evening. Shortly after this discovery, she observed a vehicle parked near her house. She (perhaps, dangerously) approached the vehicle, which then drove away. After the vehicle left, she received a notice that the device was moving away from her until such time as her phone lost connection with it. In June 2022, two women sued Apple in San Francisco federal court alleging that Apple’s AirTag provided their stalkers “the weapon of choice” to pursue them.

AirTags used in crimes can be tracked by police to identify the owner in many cases, often quite easily. I won’t provide the details here, but it is not through the use of some “big-brother” technology. Nonetheless, in the US, or in the jurisdiction I am most familiar with at least, it is unclear that following someone with an AirTag or similar device is—by itself—enough to lead to criminal charges. For example, New York State Penal Law § 240.26 defines 2^nd degree harassment as “follow[ing] a person in or about a public place or places.” Whether covertly placing an AirTag in someone else’s belongings or vehicle and simply observing their comings and goings on a computer or phone constitutes “following a person” is unclear. The 3^rd Department, which in New York is an appellate level court, stated that absent an intent to “harass, annoy or alarm” there is no harassment. The act of covertly placing a tracking item on a person’s property seems to imply that the perpetrator actually is attempting to avoid harassing, annoying or alarming the target. At least until the perpetrator takes a further step, this seems like a legally (if not morally) defensible action. Indeed, as of this writing I found no case where the singular use of a tracking device like the AirTag, without more, led to a successful conviction.

The series of incidents involving the AirTag seems to reflect a generally larger problem in the United States, and probably everywhere else. That is, technology is developing so swiftly that the world’s sluggish legal systems cannot keep up. While I am not encouraging over-criminalizing activities based on every abuse of new technologies, these stories do illustrate the increasing burden on individuals to take precautions against the adverse use of otherwise helpful technologies. It is impossible to keep up with every development, but the choice to use various tech does impose some responsibility toward learning about that tech. The AirTag cases present a particular conundrum because most people haven’t chosen to use them. It would be unreasonable to expect people to know—or care—much about a new gadget they may have never even heard about, let alone use. In this type of circumstance, it is incumbent on those who do become aware of these types of issues to share that information with their friends and family. With social media, it is very easy to spread the word on just about anything. With technology, we can’t wait for the authorities and experts to act on our behalf.

As Carl Sagan wrote in 1989, “We live in a society exquisitely dependent on science and technology, in which hardly anyone knows anything about science and technology.” My experience indicates that this largely remains true. If so, it is the responsibility of each of us to do what we can to change this.

***

I am a Certified Forensic Computer Examiner, Certified Crime Analyst, Certified Fraud Examiner, and Certified Financial Crimes Investigator with a Juris Doctor and a Master’s degree in history. I spent 10 years working in the New York State Division of Criminal Justice as Senior Analyst and Investigator. Today, I teach Cybersecurity, Ethical Hacking, and Digital Forensics at Softwarica College of IT and E-Commerce in Nepal. In addition, I offer training on Financial Crime Prevention and Investigation. I am also Vice President of Digi Technology in Nepal, for which I have also created its sister company in the USA, Digi Technology America, LLC. We provide technology solutions for businesses or individuals, including cybersecurity, all across the globe. I was a firefighter before I joined law enforcement and now I currently run the EALS Global Foundation non-profit that uses mobile applications and other technologies to create Early Alert Systems for natural disasters for people living in remote or poor areas.

For another article discussing how tech is used to commit crimes, click below.