Report finds AirTag enables 'inexpensive, effective stalking'
A report by The Washington Post delves into the security and safety functions Apple's new AirTag, concluding the device and its corresponding Find My service are not equipped with proper anti-stalking safeguards.
When it debuted AirTag in April, Apple went to great lengths to head off criticism of its tracking device.
During an unveiling event and in subsequent interviews, the company touted protections against stalking, or "unwanted tracking" in Apple parlance, that include iOS notifications and audible AirTag alerts.
A casual study conducted by The Washington Post columnist Geoffrey Fowler asserts Apple's efforts might not be enough to foil harassers, and in fact enables a "new means of inexpensive, effective stalking." He added that existing safeguards "aren't sufficient" to thwart misuse of the diminutive tracker.
Fowler asked a colleague to track him for a week using an AirTag that was placed in his backpack. During a bike ride, the device revealed Fowler's location every few minutes with a resolution of about half a block. When stationary at home, AirTag was able to provide his exact address.
While Fowler was made aware that the unknown device was following his movements -- both through iOS notifications and an audible alert played through AirTag's speaker -- the alerts were not as effective as hoped.
Specifically, Fowler notes the alarm rings after three days and when it does, it plays 15 seconds of "light chirping" measured at 60 decibels from three feet away. As previously detailed by Apple, AirTag outputs an audio signal when it is away from its user for three days. That time span is a problem for some privacy and domestic abuse advocates.
Fowler also takes issue with operating system compatibility. With the Find My network currently limited to iOS, Android users are unable to discover and be alerted to an AirTag that is traveling with them. Coupled with a speaker that can be easily muffled or disabled, AirTag becomes a powerful tool for tracking people who don't own an iPhone. It should be noted that Android devices can read read an AirTag's "Lost Mode" message via NFC.
Locating a foreign AirTag is also made difficult on iOS, Fowler says. An option to force the tracker to play a sound exists, but users are unable to track down the device using the Precision Tracking feature.
Apple's VP of iPhone marketing, Kaiann Drance, addressed a few of Fowler's concerns in an interview, though the information provided failed to build on previous statements.
"These are an industry-first, strong set of proactive deterrents," Drance said. "It's a smart and tunable system, and we can continue improving the logic and timing so that we can improve the set of deterrents."
Fowler asked Drance if Apple consulted domestic abuse experts when it designed AirTag's deterrents, but the executive declined to answer.
"We don't have any more details to share about the process. But of course, we are open to hearing anything from those organizations," Drance said.
Apple is among the first competitors in a fledgling consumer tracker market to offer anti-stalking protections, but as Fowler demonstrated, the solution is not perfect. The company is being pushed to find the sweet spot between powerful finding features and personal privacy -- a difficult needle to thread considering AirTag's raison d'tre.
When it debuted AirTag in April, Apple went to great lengths to head off criticism of its tracking device.
During an unveiling event and in subsequent interviews, the company touted protections against stalking, or "unwanted tracking" in Apple parlance, that include iOS notifications and audible AirTag alerts.
A casual study conducted by The Washington Post columnist Geoffrey Fowler asserts Apple's efforts might not be enough to foil harassers, and in fact enables a "new means of inexpensive, effective stalking." He added that existing safeguards "aren't sufficient" to thwart misuse of the diminutive tracker.
Fowler asked a colleague to track him for a week using an AirTag that was placed in his backpack. During a bike ride, the device revealed Fowler's location every few minutes with a resolution of about half a block. When stationary at home, AirTag was able to provide his exact address.
While Fowler was made aware that the unknown device was following his movements -- both through iOS notifications and an audible alert played through AirTag's speaker -- the alerts were not as effective as hoped.
Specifically, Fowler notes the alarm rings after three days and when it does, it plays 15 seconds of "light chirping" measured at 60 decibels from three feet away. As previously detailed by Apple, AirTag outputs an audio signal when it is away from its user for three days. That time span is a problem for some privacy and domestic abuse advocates.
Fowler also takes issue with operating system compatibility. With the Find My network currently limited to iOS, Android users are unable to discover and be alerted to an AirTag that is traveling with them. Coupled with a speaker that can be easily muffled or disabled, AirTag becomes a powerful tool for tracking people who don't own an iPhone. It should be noted that Android devices can read read an AirTag's "Lost Mode" message via NFC.
Locating a foreign AirTag is also made difficult on iOS, Fowler says. An option to force the tracker to play a sound exists, but users are unable to track down the device using the Precision Tracking feature.
Apple's VP of iPhone marketing, Kaiann Drance, addressed a few of Fowler's concerns in an interview, though the information provided failed to build on previous statements.
"These are an industry-first, strong set of proactive deterrents," Drance said. "It's a smart and tunable system, and we can continue improving the logic and timing so that we can improve the set of deterrents."
Fowler asked Drance if Apple consulted domestic abuse experts when it designed AirTag's deterrents, but the executive declined to answer.
"We don't have any more details to share about the process. But of course, we are open to hearing anything from those organizations," Drance said.
Apple is among the first competitors in a fledgling consumer tracker market to offer anti-stalking protections, but as Fowler demonstrated, the solution is not perfect. The company is being pushed to find the sweet spot between powerful finding features and personal privacy -- a difficult needle to thread considering AirTag's raison d'tre.
Comments
How is an AirTag better for stalking (or non-stalking) than a Tile?
A Tile might give you updates, but the probability of passing another Tile user is much lower than an iPhone in other words, especially in remote areas.
With AirTags, your own phone essentially works together with the AirTag to constantly update the AirTag's last known location (essentially your current location), which is the scary part if the AirTag doesn't belong to you.
IMO - three days is too long to notify someone, but I understand the need for balance in preventing everyone from getting a ton of notifications for AirTags traveling with you. And I’m sure somewhere, someone at Apple said: Well these things will just help us sell more purple iPhones to women who have Androids and dont want to be stalked.
as to whether 3 days or not is appropriate, I am sure that is a reasonable first step and then let the general public push fo ra different timeframe. Any less time and Apple would have been in trouble. Any more time and Apple would have been in trouble.
I don't mind them. I understand the risks and can deal with those risks. But most people aren't technical. One of my family members still can't find the "home button" on her old iPhone that she has used for years.
Why this vital information was left out of the review is disturbing. At least the Ars article mentioned this significant issue with AirTags. One could be planted on your car and you would never know it. It is also documented on how easy it is to disable the speaker too.
In the later use case I can tell you for certain that the three day notification period is for audible alerts only. My partner sometimes takes our child out for play dates without me and after a short time (a couple of hours) gets a notification on their iPhone that an AirTag is “following” them in close proximity. They know what it is so it’s not an issue and we share our location with each other anyway.
But even in the few days we have had the AirTag it has already served it’s purpose as we had to locate the school bag as it was left behind somewhere in a zoo. Rather than retracing our steps we simply opened Find My and saw it had been handed in at lost property, so from a real world use case perspective it has performed flawlessly.
As for those complaining about “stalking” why would I use an AirTag for that purpose? The device is directly associated with an AppleID so it’s dead easy to file charges once it is found. If I was going to stalk someone there’s plenty of other trackers available that can be bought and used, without the ability to be so easily identified, for about the same price as an AirTag 4-pack and also don’t need to rely on the iPhone network for its data. Hell if you really wanted to track someone you could just mirror their SIM card and use that to monitor them via the cell network using equipment that can be acquired for a reasonable cost if you look hard enough.
This is just another case of Apple bashing for the sake of it and focussing on the negative without regard to practical realities.
The report is b/s for a variety of reasons:
- The majority of stalking crime involves persons who are known to each other. However to stalk with a tracking device requires a stalker to get close enough to personally install it on the victim which isn't feasible. If the stalker knows the victim's location then tracking with an electronic device isn't the problem. In the hypothetical situation where the victim doesn't know the stalker, the same issues apply: getting close enough, and having already known the victim location. (Whereby the stalker can just follow the victim anyway.)
- The device works best when placed in the open. This is why the accessories are all designed to leave the tracker exposed. One can't install the device to something like the underside of a car and expect it to work, the device is still limited by EM physics.
- The tracker itself is linked to the owner. Stalking with this is like leaving your ID at a crime scene.
- It's a highly publicised tracking device and alerts the victim, while being trivial to disable. Anyone that finds it will know what it is, especially when it's beeping at them.
- If the software is smart enough to notify the user about being followed, it's smart enough to not publish that location.
So stalking isn't the issue with this device, the issue with this device is that if an item is intentionally taken/stolen the tracker can be easily disabled. So it makes sense to attach it to low value items such as keys. For more expensive items the route is either an accessory that gives the tracker permanence or purchasing items which already include the hardware (such as the VanMoof bikes and most Apple devices.)Side note: It would only be "inexpensive" if it didn't require a $600 iPhone just to get started.
Therefore we should all stay in our caves, being good luddites playing with rocks and sticks because that's the only way we'll stay safe and secure.
We understand that WaPo does not support your favored political reporting. But this thread is about AirTags -- not politics.
This from another publication is the one part of the Airtags privacy argument that might actually be a real concern IMO, abusive relationships which I know for a fact are not all that uncommon:
The only protection for Android users is the audible alert after three days, and it’s already been shown that the speaker can be disabled. The piece reiterates calls for Apple to work with Google as it did with COVID-19 contact tracing to develop a standard that gives Android users the same pop-up alerts as iPhone owners. It does also seem a no-brainer to require authentication to turn off the privacy alerts."