Digital tracking tags infringe on users' privacy and create a "digital trail" of location data, potentially revealing sensitive information about the movements and habits of individuals, according to a report by Israel's Privacy Protection Authority, released here for the first time.
Apple, manufacturer of the Airtag, is currently facing a class-action lawsuit from dozens of customers in the United States over tracking, harassment and even murder cases facilitated by the technology.
The Privacy Protection Authority's report indicates that these devices pose an increased threat to data security, raising concerns that the information collected through their use could lead to privacy breaches via surveillance. The report analyzes the risks and recommends precautionary measures for owners of tracking tags and those concerned about being tracked.
Tracking tags like Apple's Airtag, Samsung's SmartTag, and similar products from Google or Tile are popular and relatively inexpensive electronic gadgets designed to help locate a suitcase or other mobile items, and sometimes even pets outside the home. However, it turns out that these devices can be misused.
"Tracking tags effectively expand the use of tracking and monitoring infrastructure, raising concerns that personal information, including location data, could leak to third parties or be used in ways that exceed the original purposes for which it was collected, thereby compromising user privacy," the Privacy Protection Authority's report states.
How does it work?
A tracking tag contains a receiver, transmitter, processor and battery, all in a small package that looks like a coin or keychain. People attach them to luggage, laptop bags, bicycles, keys and even pets. The tag signals its location to a nearby offline tracking network (Offline Finding network). These networks are not cellular but use short-range Bluetooth technologies like BLE or UWB, based on our cell phones. Yes, we all unknowingly contribute to the effort to locate these tags.
The offline networks are connected to the general cellular network for device tracking (Find My Services), which allows the tag's location to be determined even if it is far from the owner. The information about all tag locations is stored on the company's servers, which poses a threat to privacy.
The report identifies several key issues created by the technology. Vulnerabilities in registering tracking tags, encrypting their identifiers, and reporting their locations could be exploited maliciously. Additionally, it’s possible for individuals who are not service providers to search the OF network, and non-customers can fake the location of a lost device, thereby disrupting tracking data.
"The public should be aware that tracking tag data might leak to unauthorized parties, thus infringing on user privacy and potentially endangering others' privacy,"Gilad Samama, head of the Privacy Protection Authority, told Ynet."Tracking tags epitomize the concept of the 'digital trail,' and the collected data can reveal sensitive information about our lifestyles and habits."
Risks: Surveillance and privacy violations
Misuse of tracking tags emerged soon after they hit the market. A 2022 New York Times investigation reported on women who complained that Apple Airtags were used to track them: in their bags, cars and clothes. A husband, a suitor, even a mother trying to monitor her daughter's whereabouts at night all used these tags. A young woman found a tracking tag behind her car's license plate with the help of an Apple employee.
Another received a warning about a malicious tracking tag after leaving the gym, but police demanded she find the tag herself, which she couldn’t do. These aren’t isolated cases. By April 2022, over 150 police reports in the U.S. documented cases of tracking tags being used to stalk victims. Car theft rings attached tags to luxury cars to locate them later and steal them. Some car owners hid tracking tags in their vehicles hoping to find them if stolen, only to find that the tag's alert feature allowed thieves to locate and disable them.
In late 2022, a class-action lawsuit was filed in California by 36 customers, alleging that tracking tags had become weapons for stalkers and abusers. The plaintiffs claimed that misuse of tracking tags had led to murders. In one case, a woman in Akron, Ohio, was pursued and shot by an ex-boyfriend using a tracking tag. In other instances, people chased car thieves and were shot by the criminals. In March, a judge ruled to continue the lawsuit against Apple, which argued that misuse is the users' responsibility, much like car accidents caused by using an iPhone while driving.
Awareness and safety measures
Apple, Google, Samsung and other manufacturers are well aware of the risks posed by their technology. When Apple introduced the Airtag, it promised that only the device owner could locate it using the "Find My" app. Later, it added a feature to notify iPhone owners if an unknown tag was nearby, potentially tracking them. But what if you're an Android user? Or vice versa – using a Google tracking tag with an iPhone? This creates compatibility issues.
The surge in complaints led to an unusual collaboration between Apple and Google to create a standard for identifying tracking tags from all manufacturers, including hidden tags used for malicious tracking. This standard, called DULT (Detecting Unwanted Location Trackers), was introduced in the past year. Recently, companies have released products compatible with the new DULT standard.
A new security feature alerts users if a tracking tag moves with them, as opposed to most typical cases where the tracked item is stationary. This limits the number of times a tag's location can be reported.
User Guide: How to cope
The Privacy Protection Authority analyzed manufacturer documents and tracking network providers and compiled several recommendations for the proper use of the technology:
Understand Privacy Settings: Check your device settings to learn how location data is collected and used. Often, you can disable location tracking entirely or only enable it when searching for tracking tags.
Be Mindful of Permissions: When installing tracking and monitoring apps, pay attention to the location permissions they request. Grant access only if essential for the tag's functionality.
Keep Software Updated: Ensure your devices and tracking apps have the latest security and privacy features.
Use Temporary Sharing: Some device tracking networks offer temporary location-sharing features. Use these for specific situations instead of granting permanent access.
Watch for Unknown Trackers: If you find an unknown tracking tag attached to your belongings, contact the police.
For iPhone Users:
Recognize the AirTag alert sound indicating an unknown tag nearby. Enable tracking alerts. Configure precisely which apps can track you using this technology, and allow alerts for "AirTag Moving With You." Review who can share your AirTags’ location and prefer temporary sharing over permanent.
For Android Users:
Enable the DULT feature to alert you to suspicious tracking tags of all kinds. Check what information Google collects about you and clear your location history. Enable two-factor authentication for your Google account. Install the "Tracker Detect" app to identify Apple’s AirTags.
By following these guidelines, users can better protect their privacy while using tracking technology.