Are Apple AirTags being used to track people and steal cars?

In recent months, people have posted on social media about finding AirTags on their cars and in their belongings. PHOTO: NYTIMES

NEW YORK (NYTIMES) - On a Sunday night in September, Ms Ashley Estrada was at a friend's home in Los Angeles when she received a strange notification on her iPhone: "AirTag Detected Near You."

An AirTag is a 1.26-inch (3.20cm) disc with location-tracking capabilities that Apple started selling earlier this year as a way "to keep track of your stuff".

Ms Estrada, 24, did not own one, nor did the friends she was with.

The notification on her phone said the AirTag had first been spotted with her four hours earlier. A map of the AirTag's history showed the zigzag path that Ms Estrada had driven across the city while running errands.

"I felt so violated," she said. "I just felt like, who's tracking me? What was their intent with me? It was scary."

Ms Estrada is not alone in her experience.

In recent months, people have posted on TikTok, Reddit and Twitter about finding AirTags on their cars and in their belongings. There is growing concern that the devices may be abetting a new form of stalking, which privacy groups predicted could happen when Apple introduced the devices in April.

The New York Times spoke with seven women who believe they were tracked with AirTags, including a 17-year-old whose mother surreptitiously placed one on her car to stay apprised of her whereabouts.

Some authorities have begun to take a closer look at the threat posed by AirTags.

The West Seneca Police Department in New York recently warned its community of the tracking potential of the devices after an AirTag was found on a car bumper. Apple complied with a subpoena for information about the AirTag in the case, which may lead to charges, West Seneca police said.

And in Canada, a local police department said that it had investigated five incidents of thieves placing AirTags on "high-end vehicles so they can later locate and steal them".

Researchers believe that AirTags, which are equipped with Bluetooth technology, could be revealing a more widespread problem of tech-enabled tracking. They emit a digital signal that can be detected by devices running Apple's mobile operating system. Those devices then report where an AirTag was last seen.

Apple has added features to prevent abuse, including notifications like the one Ms Estrada received and automatic beeping. But AirTags present a "uniquely harmful" threat because the ubiquity of Apple's products allows for more exact monitoring of people's movements, said Ms Eva Galperin, a cybersecurity director at the Electronic Frontier Foundation who studies stalkerware.

Ms Ashley Estrada found an AirTag which had tracked her across the city while running errands. PHOTO: NYTIMES

"Apple automatically turned every iOS device into part of the network that AirTags use to report the location of an AirTag," Ms Galperin said. "The network that Apple has access to is larger and more powerful than that used by the other trackers. It's more powerful for tracking and more dangerous for stalking."

Apple does not disclose sales figures, but the tiny US$29 (S$39) AirTags have proved popular, selling out consistently since their unveiling.

An Apple spokesman, Mr Alex Kirschner, said the company takes customer safety very seriously and is "committed to AirTag's privacy and security". He said the small devices have features that inform users if an unknown AirTag might be with them and that deter bad actors from using an AirTag for nefarious purposes.

"If users ever feel their safety is at risk, they are encouraged to contact local law enforcement who can work with Apple to provide any available information about the unknown AirTag," Mr Kirschner said.

Police could ask Apple to provide information about the owner of the AirTag, potentially identifying the culprit. But some of the people who spoke with the Times were unable to find the AirTags they were notified of and said police do not always take reports of the notifications on their phones seriously.

Ms Estrada, who received the notification while in Los Angeles, eventually found the quarter-sized tracker lodged in a space behind the licence plate of her 2020 Dodge Charger. She posted a video of her ordeal on TikTok, which went viral.

"Apple probably released this product with the intent to do good, but this shows that the technology can be used for good and bad purposes," she said.

Ms Estrada said she was told by a Los Angeles police officer that her situation was a non-emergency and that if she wanted to file a report she would have to bring the device with her to the station in the morning.

Ms Ashley Estrada found the AirTag behind her car's licence plate. PHOTO: NYTIMES

She did not want to wait and disposed of it after taking several photos.

A spokesman for the Los Angeles police told the Times that the department had not heard of cases in which an AirTag had been used to track a person or a vehicle.

Ms Estrada said that after she posted her TikTok video, an Apple employee, acting on their own, contacted her. The employee was able to connect the AirTag to a woman whose address was in Central Los Angeles.

AirTags and other products connected to Apple's location-tracking network, called "Find My", trigger alerts to unknown iPhones they travel with. The AirTag product page on Apple's website notes that the devices are "designed to discourage unwanted tracking" and that they will play a sound after a certain amount of time of not detecting the device to which they are paired.

In June, after concerns about stalking were raised, Apple pushed an update to AirTags to cause them to start beeping within a day of being away from their linked devices, down from three days. Still, "they don't beep very loudly", Ms Galperin, the cybersecurity expert, said.

A person who does not own an iPhone might have a harder time detecting an unwanted AirTag. AirTags are not compatible with Android smartphones. Earlier this month, Apple released an Android app that can scan for AirTags - but you have to be vigilant enough to download it and proactively use it.

Apple declined to say if it was working with Google on technology that would allow Android phones to automatically detect its trackers.

People who said they have been tracked have called Apple's safeguards insufficient. Ms Estrada said she was notified four hours after her phone first noticed the rogue gadget. Others said it took days before they were made aware of an unknown AirTag. According to Apple, the timing of the alerts can vary depending on the iPhone's operating system and location settings.

Join ST's Telegram channel and get the latest breaking news delivered to you.