Apple recently said it would improve AirTag safeguards after reports of people being tracked surreptitiously using AirTags. However, some experts say Apple’s efforts won’t be sufficient to protect users. “Even with the personal safety guide released by Apple, consumers are still subject to increased risks, as it only gives consumers some tools to use if they suspect their device has been compromised,” Nabil Hannan, managing director at cybersecurity firm NetSPI, told Lifewire in an email interview.
AirTags or CreepTags?
AirTags send out Bluetooth signals that nearby Apple devices can detect. Many people have claimed they’ve been tracked by people using AirTags without their knowledge. “AirTag was designed to help people locate their personal belongings, not to track people or another person’s property, and we condemn in the strongest possible terms any malicious use of our products,” Apple said in a news release. The company also said it’s seeing increased reports of people using AirTags for malicious reasons and writes that it’s working with law enforcement on AirTag-related requests. Apple intends to release updates to AirTags and the Find My network, starting with new privacy warnings, alerts, and documentation. It’s also looking into introducing other capabilities for a later release, including new precision-finding tools and adjustments for AirTag alerts and sounds. Being tracked by an electronic surveillance device isn’t a new problem since GPS trackers have been around for decades, Sam Dawson, a digital privacy expert at ProPrivacy, pointed out in an email. “What AirTags enable is highly accurate short-term surveillance in a very light and easy-to-hide package at a relatively low cost,” he said. “The government won’t track you with an AirTag, but a thief might leave one in your car’s fuel cap for the day to figure out what route you usually take. The ability to determine someone’s location with high precision opens the door to theft, harassment, stalking, and many other forms of privacy violation.” Apple is usually privacy-aware and has put in place a system to detect rogue AirTags to help remove unwanted AirTags, Susan Morrow, an author who writes on cybersecurity at the Infosec Institute, said via email. An AirTag detection system is on the iPhone, and there was a recent release from Apple of an app (Find My) that provides rogue AirTag detection for Android. However, the surreptitious use of AirTags as a method of stalking is more difficult to manage, Morrow said. “There have been reports of AirTags being placed in car wheel wells to track the movement of a car in readiness to steal it, for example,” Morrow added. “While ‘Find My’ might alert an individual to the presence of an AirTag, there are certain situations, domestic abuse, for example, where they are unable to carry through on the removal of the tag.”
Staying Safe
There’s no easy answer when it comes to making sure unwanted AirTags are not tracking you, experts say. Disabling cellular, Bluetooth, and Wi-Fi radios on a smartphone will limit the tracking ability and impede most features on any devices, cybersecurity expert Scott Schober said via email. Manufacturers and app developers should be transparent in what type of wireless signals and data are being emitted at any given moment and what potential they have for being tracked, he said. “When manufacturers do not disclose this basic information, the average user will not raise any privacy concerns,” Schober added. “However, when users are notified, they can make an informed decision regarding their willingness to accept the potential security or privacy vulnerabilities in exchange for the convenience of services.” One solution to the problem of digital stalking would be to anonymize information collected by apps, making it extremely difficult to track individuals, Marco Bellin, CEO of Datacappy, which makes privacy software, said in an email interview. “Manufacturers should also stop buying or selling information to or from third parties,” Bellin added. “Third-party data collectors are so prevalent that it is impossible to use the ‘right to be forgotten’ laws in California and Europe.”
