Apple’s AirTag Used to Steal Cars and Track People

It was a Sunday night in September 2021, and Ashley Estrada was at a friend’s house in Los Angeles when she received a strange notification on her iPhone: “AirTag detected near you”.

The AirTag is a 3.2 centimeter disk with the ability to track locations, which Apple started selling last year as “a way to [um usuário] control the location of your things”.

Estrada, 24, didn’t have an AirTag, and the same was true of the friends she was with. Her cell phone notification said the AirTag had been detected in her possession for the first time four hours earlier. A map of the AirTag’s history showed the bumpy route Estrada had taken through the city while she took care of a bunch of errands.

“I felt very violated,” she said. “I wanted to know who was tracking me, what these people were up to. I was scared.”

Estrada is not the only person to have had this experience. In recent months, people have posted messages on TikTok, Reddit and Twitter about finding AirTags on their cars and stuff.

There is growing concern that the device could be being used to enable a new form of stalking, which privacy organizations predicted would happen when Apple put the devices on sale in April.

The New York Times spoke to seven women who believe they have been tracked through AirTags, including a 17-year-old girl whose mother clandestinely installed the device in her car to be aware of her whereabouts.

Some authorities have begun to take a closer look at the threat that AirTags pose. Police in the city of West Seneca, New York, recently alerted the community to the tracking potential of the devices, after an AirTag was found on the bumper of a car.

Apple served a subpoena to provide information about the AirTag involved in that case, which could lead to charges, according to West Seneca Police.

And in Canada, a local police department announced that it had investigated five incidents involving the use of AirTags by thieves, who placed the devices “in high-priced vehicles so they can track them down and steal them later.”

Researchers believe that AirTags, equipped with Bluetooth technology, could be revealing a wider problem related to tracking facilitated by the technology. The devices emit a digital signal that can be detected by devices using Apple’s mobile operating system. These devices then report back to the network where an AirTag was last identified.

Unlike similar tracking products offered by competitors like Tile, Apple has added features to prevent abuse, including notifications like the one received by Estrada, and a system that causes the device to emit beeps. (Tile plans to roll out a feature that will prevent people from tracking next year, a company spokesperson said.)

But AirTags pose a “uniquely dangerous” threat, given the ubiquity of Apple products, which allow for more accurate monitoring of people’s movements, said Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation and a researcher on so-called “stalkerware.” or chasing software.

“Apple automatically turns each iOS-equipped device into a part of the network that AirTags use to report the location of an AirTag,” Galperin said.

“The network that Apple has access to is larger and more powerful than that used by other trackers. It is more powerful for tracking and more dangerous when used by stalkers.”

Apple does not disclose sales figures, but the tiny AirTags, which sell for $29, have proved popular and have been finding steady demand since their launch.

Alex Kirschner, an Apple spokesperson, said in a statement that the company takes customer safety “very seriously” and is “committed to preserving the privacy and security of AirTags.”

He said the small devices have features that tell users if an AirTag might be being carried by them without them knowing, and that prevent malicious actors from using an AirTag for harmful purposes.

“If users feel that their safety is at risk, they are encouraged to contact local law enforcement, who can work with Apple to provide any available information about the unknown AirTag,” Kirschner said.

The police may ask Apple to inform them of the AirTag’s owner, which would allow them to identify the culprit. But some of the people who spoke to The New York Times were unable to find the AirTags they were notified of, and said that police do not always respond seriously to complaints about notifications received on cellphones.

Estrada, who received the notification while in Los Angeles, eventually found the coin-sized device in a space behind the license plate of her 2020 Dodge Charger. She posted a video on TikTok of the incident, and the video went viral.

“Apple probably launched this product with the intention of doing good, but it shows that the technology can be used for good and bad purposes,” Estrada said.

She said she was told by a Los Angeles Police Emergency Services attendant that her situation did not constitute an emergency and that if she wanted to file a complaint, she should bring the device to a police station in the morning. She didn’t want to wait, and threw the device away after taking several pictures.

A LAPD spokesperson told The New York Times that it was not aware of instances where an AirTag had been used to track a person or vehicle.

But Estrada said that after posting her video on TikTok, an Apple employee, acting on her own initiative, reached out to her. This professional was able to trace the AirTag to a woman with an address in downtown Los Angeles.

AirTags and other products connected to the “Find My” network, Apple’s location service, trigger alerts on unknown iPhones they are traveling with.

The AirTag product page on Apple’s website notes that the devices “are designed to discourage unwanted tracking”, and that they beep when a certain period passes without them detecting the device they are linked to.

In June, after stalker precautions were introduced, Apple updated AirTags to make them start beeping a day after they lost contact with the linked devices, up from the original three-day deadline.

Still, “they don’t whistle very loudly,” Galperin said.

A person who doesn’t have an iPhone may have a harder time detecting an unwanted AirTag. AirTags are not compatible with Android smartphones.

Last year, Apple launched an app for the Android system that allows you to search for AirTags — but the user needs to be prepared enough to download it and use it actively.

Apple did not say whether it was working with Google to develop technology that would allow Android phones to automatically detect its trackers.

People who said they were tracked consider Apple’s safeguards to be insufficient.

Estrada said she was not notified until four hours after her cell phone first detected the unknown device. Others said it took days for them to be notified of the presence of an unknown AirTag.

According to Apple, the timing of an alert may depend on the version of the operating system installed on the iPhone and the location settings of each phone.

Translation by Paulo Migliacci