Bluetooth trackers, such as Apple’s AirTags, are originally designed to help people find their belongings, but can also be used by malicious actors to secretly track people. Reporters Without Borders (RSF) examines the risks posed to journalists and what tech companies are doing to mitigate those dangers.
Bluetooth trackers, such as Apple’s AirTags, are devices which can be attached to objects to help their owners track them through an interactive map in an app. Intended to help people find lost belongings, they have become an easy tool for malicious actors to track people secretly.
Trackers work by regularly emitting Bluetooth signals on a particular network that are picked up by the owner’s phone. If the phone is too far away, the signal is picked up by other Bluetooth-enabled devices on the same network.
The biggest network at the moment is Apple’s Find My. When an AirTag is separated from its owner, its signal will be picked up by any nearby Apple device, which will then send the signal and location information to the iCloud and on to the owner’s iPhone. Android trackers such as SmartTag work similarly with Android devices.
Potential dangers of trackers
As Bluetooth trackers are small and last for months without needing new batteries, it is relatively simple to slip a tracker into a victim’s car or bag, or in more advanced cases sew one into items like stuffed animals.
In this way, a malicious actor can track a victim’s movements over a period of time, allowing them to ascertain the victim’s home and work addresses, routines, and potentially orchestrate an assault. For journalists, trackers further pose the risk of exposing anonymous sources and the times and places of private meetings.
Tech companies’ safety measures
- Unknown trackers alerts. Apple allows users to proactively search for unknown AirTags in their vicinity through the Find My app on their phones. This will also cause unknown AirTags to emit a tone, making them easier to locate. Likewise, Google released its unknown tracker alert feature in August 2023.
- Suspicious AirTags alerts. Apple phones will automatically alert users if an unknown AirTag remains in their vicinity for a predetermined length of time or if users take an unknown AirTag home with them (or to a “significant location” if this functionality is enabled).
- No data storage. AirTags, unlike some other trackers, will only display the AirTag’s last known location but do not store a location log. While this does not prevent malicious actors from keeping records via third-party software, it does make stalking more difficult.
- Encrypted signals. Although AirTags rely on third-party devices to communicate with their owners, signals are encrypted so neither the third parties nor Apple can read the information being sent.
- Google-Apple cooperation. Apple released the Tracker Detect app in 2021 which allows Android users to locate Apple compatible trackers in their vicinity. In May 2023, Google and Apple jointly released a proposal for industry specifications, which will expand iOS and Android users’ protections from both kinds of trackers.
Recommendations for journalists
- Keep OS up-to-date. Apple and Android users should keep their operating systems up-to-date to ensure they have all the most recent protections.
- Install trackers detectors app. Android users should download the Tracker Detect app to locate Apple trackers.
- Use all possible security means. Journalists should always remain vigilant when travelling to sensitive locations and meeting with sources, and employ available security technology.
