AirTag-Facilitated Stalking Protection: Evaluating Unwanted Tracking Notifications and Tracker Locating Features

AirTag-Facilitated Stalking Protection: Evaluating Unwanted Tracking Notifications and Tracker Locating Features

Speakers: Dañiel Gerhardt

Conference: USENIX Security

YouTube: https://www.youtube.com/watch?v=6QiRa686yFo

Overview

This talk, presented by Dañiel Gerhardt at USENIX Security, addresses the critical issue of Bluetooth location trackers, specifically Apple AirTags, being misused for stalking. While these small, affordable devices are designed to help users locate lost items like keys, their inherent real-time tracking capabilities make them a potent tool for non-consensual surveillance. Gerhardt's research evaluates the effectiveness of Apple's "anti-stalking features," which were introduced in response to a surge of online reports detailing AirTag misuse for malicious purposes.

The core of the research investigates three key aspects of these protective measures: the reliability of unwanted tracking notifications on both iOS and Android devices, users' understanding and reactions upon receiving such alerts, and the efficacy of the built-in tracker locating features. Through a series of experiments, including a large-scale participant study and a deception study, the research uncovers significant shortcomings in the current implementation of these safeguards. The findings underscore a pressing need for manufacturers to enhance protective features, improve user education, and prioritize victim safety as the market for these tracking devices continues to expand.

Background

▶ Watch: Introduction: AirTag misuse for stalking (0:00)

Bluetooth location trackers are compact, low-power devices designed to be integrated into a tracking network. Unlike traditional GPS trackers, they lack integrated GPS modules or cellular connectivity. Instead, they leverage the widespread presence of surrounding smart devices—primarily smartphones—within their network. These devices passively detect the tracker's Bluetooth broadcasts, attach precise location data, and relay this information to central servers, enabling near real-time location tracking of the associated item. This innovative approach, exemplified by Apple's Find My network, revolutionized the ability to locate lost personal belongings.

However, the very capabilities that make these trackers effective for finding lost items also render them susceptible to misuse for stalking or non-consensual tracking of individuals. When Apple AirTags launched in 2021, they were met with enthusiastic adoption for their intended purpose. Yet, it wasn't long before a disturbing pattern emerged: reports of AirTags being secretly planted on individuals, in their vehicles, or in their belongings to facilitate stalking. These anecdotes quickly garnered media attention, highlighting a significant security and privacy concern. Apple responded by implementing a suite of protective features, which the presenter refers to as anti-stalking features. These features aim to alert potential victims to the presence of an unknown tracker and assist them in locating it, thereby mitigating the risk of unwanted surveillance.

The research was motivated by the observation that while initial media fervor surrounding AirTag stalking subsided, anecdotal evidence of its persistence continued. This prompted the researchers to conduct a systematic evaluation of Apple's anti-stalking features to determine their real-world effectiveness in protecting potential victims.

Key Findings

▶ Watch: Overview of Apple's anti-stalking features (1:15)

The research yielded several critical findings, revealing significant disparities in protection across platforms and a general lack of user preparedness for such threats. The evaluation was structured around three primary research questions, each addressing a distinct aspect of the anti-stalking features.

Firstly, regarding the reliability of unwanted tracking notifications, the study involved 50 participants (25 with iPhones and 25 with Android phones), each carrying an AirTag for up to two days. The results showed a stark contrast in notification delivery: notifications were delivered on all iPhones (100% reliability), but only on 56% of Android devices. This statistically significant difference indicates that Android users are at a considerably increased risk, as they cannot reliably expect to be warned about potential stalking events. Furthermore, both the mean and median durations for notification delivery were consistently higher on Android devices compared to iOS, suggesting that even when an alert is eventually delivered, it takes longer. The researchers hypothesize that these discrepancies stem from differing software implementations between the platforms, as no clear hardware trends could explain the observed differences.

Secondly, a deception study was conducted to understand users' comprehension and reactions to receiving an unexpected tracking notification in an ecologically valid setting. Participants were initially led to believe they were carrying an activity monitor (a disguised AirTag). After receiving a notification, the deception was revealed, and in-depth interviews were conducted. Three high-level themes emerged that shape a user's reaction:

1. Understanding of Technology: Participants with a higher understanding of how Bluetooth trackers operate tended to react more effectively. Conversely, those with limited technical knowledge often performed unhelpful actions, such as turning off Bluetooth or location services, which do not prevent tracking by AirTags that rely on surrounding devices for location data. This highlights a critical problem: protection should not hinge on technical proficiency.
2. Recognition of Threat: Many participants did not immediately recognize the potential threat of stalking. While some had prior knowledge of AirTag misuse, others did not consider stalking as a possibility upon receiving the notification. The notification itself does not explicitly mention "stalking" or "threat," requiring users to infer the danger, which often leads to underestimation of the situation's severity.
3. Notification Perception: The visual and auditory presentation of the notification significantly influenced user reaction. Participants reported that the AirTag alert appeared like any other standard notification, lacking a sense of urgency. It did not break through "do not disturb" settings or employ a special sound, failing to convey the potential importance or urgency of the situation.

These perception issues led to varied user reactions, categorized into three groups:

• Investigating the Situation: The expected reaction, where users opened the notification, accessed the associated app, and sometimes searched online for more information. Most in this group eventually understood the situation.
• Seeking Help: A surprising number of participants, unsure of what to do, sought assistance from technologically knowledgeable friends or even asked their social circles if someone had accidentally placed a tracker on them.
• Disregarding the Notification: A significant concern, where users ignored the alert, often due to the perceived lack of urgency or an inability to comprehend the potential threat, leading them to dismiss it amidst other daily notifications.

Finally, the research also explored the effectiveness of the locating features, though the detailed results were presented in the full paper. The overall findings underscore a critical gap between the intended protective function of anti-stalking features and their actual efficacy in real-world scenarios, particularly concerning cross-platform reliability and user comprehension.

Technical Deep Dive

▶ Watch: Research questions on feature effectiveness (3:15)

The technical evaluation focused on Apple's suite of anti-stalking features, designed to alert individuals to the presence of an unknown AirTag and help them locate it. These features operate based on the AirTag's internal state and its interaction with the broader Find My network.

The first protective feature is an audible sound emitted directly by the AirTag. This sound is triggered after the AirTag has been separated from its owner's device for a specific duration and has subsequently detected movement via its built-in accelerometer. The intention is to draw attention to the device, making it easier for a potential victim or someone nearby to discover it. The sound is a basic, but often effective, physical alert.

The second, and arguably most critical, feature is the unwanted tracking notification. When an AirTag is separated from its owner for a prolonged period and is observed to be consistently moving with an unsupported device (i.e., a smartphone not belonging to the AirTag's owner), the surrounding supported devices (modern iOS and Android smartphones) will eventually trigger a notification. This alert is often the first indication a potential victim receives about a nearby, unknown tracker. The research specifically highlighted the technical implementation differences here:

• iOS Implementation: Notifications were delivered consistently across all 25 iPhone participants, demonstrating robust integration with Apple's ecosystem. The mean and median delivery times were also lower, suggesting a more optimized and reliable system.
• Android Implementation: In contrast, only 56% of Android devices received these notifications. This significant failure rate points to a less consistent or perhaps less prioritized implementation on the Android platform. The researchers hypothesize that this stems from variations in how different Android manufacturers or versions handle background Bluetooth scanning and notification delivery, rather than fundamental hardware limitations. The delayed and unreliable delivery on Android exposes a critical vulnerability for a large segment of smartphone users.

The third category of features aids in locating a detected AirTag, which can be challenging given their small size and potential for concealment. Two main mechanisms are available:

1. Manual Sound Playback: Once a user has been alerted to an unknown AirTag, they can manually trigger the AirTag to play its sound through the Find My app (or a similar interface on Android, if available and working). This allows the user to locate the device by listening for the sound, much like finding a lost key.
2. Precise Locating with Ultra Wideband (UWB): For users with an iPhone 11 or newer, AirTags are equipped with an Ultra Wideband (UWB) transmitter. UWB technology allows for highly accurate distance and direction finding. When a user has an iPhone 11 or later, the device can provide a "precise locating" experience, showing an arrow pointing in the direction of the AirTag and indicating its distance down to a few centimeters. This feature significantly enhances the ability to pinpoint a hidden tracker in challenging environments like a cluttered car or a bag.

The research methodology itself also involved a deep dive into data collection and analysis:

• Notification Reliability Study: This involved distributing AirTags to 50 participants for two days, collecting data on whether and when notifications were received, along with smartphone hardware and software details. Statistical data analysis was used to compare iOS and Android performance.
• Deception Study & User Understanding: Participants were recruited under false pretenses, carrying disguised AirTags. After notification, a thematic analysis involving three authors was performed on recorded interviews to identify common themes regarding understanding, threat recognition, and notification perception.
• Locating Task: The same participants from the deception study were then asked to find a hidden AirTag in a prepared car, simulating a real-world scenario. This experiment, also analyzed thematically, evaluated the practical effectiveness of the sound and UWB locating features.

Collectively, these technical features represent Apple's attempt to counter AirTag misuse. However, the research clearly demonstrates that their real-world effectiveness is hampered by implementation inconsistencies, particularly on Android, and significant gaps in user awareness and intuitive design.

Demo / Proof of Concept

▶ Watch: Key finding: Android notification reliability issues (5:20)

While the talk didn't feature a live "demo" in the traditional sense, a crucial experimental component served as a proof of concept for evaluating the effectiveness of the AirTag's locating features in a realistic scenario. This experiment was conducted after the deception study, where participants had already experienced receiving an unwanted tracking notification.

In this phase, participants were presented with a scenario: they had just received an unwanted tracking notification while driving and now needed to locate the hidden tracker. The researchers had prepared a car beforehand, presumably with an AirTag hidden in a challenging but plausible location (e.g., under a seat, in a glove compartment, within a car door panel). Participants were then tasked with finding this hidden AirTag using the available locating features on their smartphones.

This setup allowed the researchers to observe firsthand how users interacted with the manual sound playback and, for iPhone 11+ users, the Ultra Wideband (UWB) precise locating feature. The experiment aimed to answer the third research question about the effectiveness of these features in helping users physically discover a covertly placed tracker. By recording audio from these sessions, the researchers could later conduct a thematic analysis of the participants' strategies, difficulties, and success rates. This "demo" effectively simulated a real-world stalking situation, providing invaluable insights into the practical challenges and utility of the AirTag's physical locating capabilities. The detailed results and discussion regarding this experiment are available in the full research paper.

Defensive Implications

▶ Watch: User understanding impacts alert effectiveness (6:15)

The findings from this research carry significant defensive implications for both individuals and manufacturers. The primary goal is to enhance the protection of potential stalking victims against the misuse of Bluetooth location trackers.

For manufacturers like Apple and Google, who are expanding their Find My networks, several critical improvements are necessary:

1. Improve Cross-Platform Reliability: The most glaring issue is the dismal 56% notification reliability on Android devices. Manufacturers must prioritize a consistent and robust implementation of unwanted tracking notifications across all supported platforms. This means ensuring that Android's operating system and device manufacturers reliably deliver these alerts, perhaps through standardized APIs or tighter integration requirements.
2. Enhance Notification Design: Notifications must convey a clear sense of urgency and explicitly state the potential threat. Instead of a generic alert, the notification should explicitly mention "potential unwanted tracking" or "stalking risk." It should be visually distinct, potentially breaking through "do not disturb" settings with a unique sound, to ensure it stands out from the deluge of daily alerts and communicates the gravity of the situation.
3. Improve User Understanding: The research highlighted users' lack of technical understanding and threat recognition. Manufacturers should provide clearer, more accessible in-app information and educational resources within the notification flow. This could include concise explanations of how these trackers work (e.g., they don't rely on phone GPS/cellular) and actionable steps to take, dispelling common misconceptions (like turning off Bluetooth).
4. Strengthen Locating Features: While UWB is powerful, its availability is limited to newer iPhones. Efforts should be made to explore broader accessibility or alternative high-precision locating methods for a wider range of devices. The manual sound feature is essential but can be difficult to hear in noisy environments or when the tracker is well-hidden.

For defenders and potential victims, the implications are:

1. Be Aware: Users need to understand that small, affordable trackers like AirTags can be misused for stalking. This awareness is the first line of defense.
2. Take Notifications Seriously: If an unwanted tracking notification is received, it should be treated as an urgent and potentially dangerous situation, not just another routine alert.
3. Understand Tracker Mechanics: Learn that turning off your phone's Bluetooth or location services will likely not stop an AirTag from being tracked, as it relies on other nearby devices. The only way to stop it is to find and disable the tracker itself.
4. Utilize Locating Features Effectively: Practice using the sound and UWB features (if available) to efficiently locate a hidden tracker. If unable to find it, seek help from trusted individuals or law enforcement.
5. Advocate for Better Protection: As the market for these devices expands with Google's Find My Device network and third-party trackers, users should advocate for stronger, more reliable, and more user-friendly anti-stalking features from all manufacturers.

The talk concludes with a strong message: while stalking is not new, this technology makes it more accessible. Manufacturers have a responsibility to avoid doing harm with the technology they create and must devote resources to improve these protective measures before the problem escalates further.

Key Takeaways

• Significant Android Vulnerability: Unwanted tracking notifications are unreliable on Android devices, delivering on only 56% of tested phones compared to 100% on iPhones, leaving Android users at heightened risk.
• User Comprehension Gap: Many users lack the technical understanding of how Bluetooth trackers work and often fail to recognize the severe threat of stalking when they receive a notification.
• Ineffective Notification Design: Current notifications are easily overlooked due to their generic appearance, lack of urgency, and failure to explicitly state the potential danger, leading many users to disregard them.
• Misguided Defensive Actions: Users with limited technical knowledge often attempt unhelpful actions, such as disabling Bluetooth or location services on their own phones, which do not prevent AirTag tracking.
• Locating Features Are Crucial but Imperfect: While audible alerts and Ultra Wideband (UWB) precise locating (on iPhone 11+) are vital, users need to be aware of and effectively utilize these tools to physically find hidden trackers.
• Urgent Need for Manufacturer Improvement: As the market for these trackers grows, manufacturers must prioritize improving cross-platform reliability, enhancing notification design, and providing clear user education to truly protect potential victims.

About the Speaker(s)

Dañiel Gerhardt is a researcher whose work focuses on the security and privacy implications of emerging technologies. In this talk at USENIX Security, he presented detailed findings from his research into the misuse of Bluetooth location trackers, specifically Apple AirTags, for stalking, and the effectiveness of their protective features. His work highlights the critical need for improved safeguards and user education in the design and implementation of ubiquitous tracking technologies.