Apple AirTags could enable domestic abuse in terrifying ways
Last week, Apple announced its new AirTags—$29 location-tracking fobs that can help find your keys or purse anywhere in the world. The devices, which are roughly the diameter of a quarter, have since been tested and lauded by tech journalists, including our own.
But technology often comes with unintended consequences, explain representatives from the National Network to End Domestic Violence (NNEDV), a leading nonprofit with the goal of ending violence against women. NNEDV sits on advisory boards for Facebook, Twitter, Snapchat, and Uber and has consulted for both Google and Apple in the past (but not on AirTags). The organization’s representatives say that while Apple AirTags are a cheap, easy-to-use product to find a lost item, they are also a worrisome surveillance tool that could be leveraged by an abuser to discreetly track a partner. An AirTag simply needs to be slipped into someone’s bag or jacket pocket to track exactly where they go.
“When somebody tries to leave an abusive person, or they are planning to leave, that can be one of the most dangerous times that stalking and assault can escalate,” says Erica Olsen, safety net project director at NNEDV. “So it’s extremely important if people are planning to leave an abusive person, they’re able to do so without the person tracking them down and finding them. It’s definitely a concern that people will be using any type of [tracking] product they can.”
AirTags operate through Apple’s Find My network. The network allows nearly a billion active Apple devices, including iPhones and Macs, to be located. Apple claims to discourage stalking by alerting an iPhone user if someone else’s tag has been placed on their person, and by making AirTags chime after three days if they’ve been unpaired with their source iPhone.
In response to our request for comment, an Apple spokesperson provided the following statement:
We take customer safety very seriously and are committed to AirTag’s privacy and security. AirTag is designed with a set of proactive features to discourage unwanted tracking—a first in the industry—and the Find My network includes a smart, tunable system with deterrents that applies to AirTag, as well as third-party products part of the Find My network accessory program. We are raising the bar on privacy for our users and the industry, and hope others will follow.
However, Apple declined to answer any of our specific questions, including whether the company consulted domestic violence organizations when designing AirTags and why they did not extend full AirTag protections to Android users. They also declined to address how domestic abusers might exploit AirTags to harass people close to them.
The connection between surveillance and abuse
Surveillance devices can be a serious issue for survivors of domestic abuse. A woman in Houston was followed constantly by her ex before she realized the culprit was a locater that had been placed in her car. As NNDEV explains, it’s now standard procedure for halfway houses to talk through the technology a person is carrying or left behind. Smartphones are the most obvious tracker, and staff will check that these devices have options such as Find My iPhone turned off. Often, they’ll even search the bags of survivors, hunting down potential trackers. “There are many instances, in doing that, they have discovered a tracker in a bag, or a stuffed animal a little kid brought,” says Olsen.
AirTags are not the first mass-market surveillance tool by any means, nor are they the first tracking fob. NNDEV has published several white papers on the dangers of technology for domestic abuse survivors. One of the biggest problems for survivors is that they typically can’t afford to escape a dangerous situation without technologies such as their phone or laptop, because these connect them to friends, family, and all sorts of basic information and services.
In developing a tracker, Apple is following the path of companies such as Tile, which produced the original, popular fob tracker. But AirTags are being launched at a scale, and a level of platform control, that only Apple can achieve. Tile uses Bluetooth and an app to locate other Tile devices—and 35 million Tiles have sold to date. Meanwhile, AirTags leverage the worldwide network of nearly a billion Apple iPhones and Macs to spot AirTags on Apple’s own encrypted network. Every Apple user is a piece of Apple’s AirTag-hunting web and is passively complicit in the massive AirTag infrastructure, unless they opt out of the Find My network.
Apple has built some protections into this system. If you are an iPhone user, for instance, and someone has placed an AirTag on your person, your phone will eventually alert you that an AirTag that isn’t yours has been found “moving with you.” Apple didn’t clarify how quickly or often this alert will arrive, but it did share that it will occur when you arrive at your home (the address stored in your Apple “Me” card) or at certain other locations that your phone has learned you frequent over time. Apple declined to disclose further specifics, citing the interest of public safety.
If you are an Android user—note that Android made up 87% of the worldwide smartphone market share as of 2019—you don’t have the protection of Apple’s network notifications. Instead, an AirTag that has not paired locally with its iPhone in three days will emit a sound. So if you are an Android user who has had an AirTag placed on you, you will know in 72 hours. (Apple told Fast Company last week that it could lengthen or shorten that time span in the future, and it reiterated that point for this article.) If you are an Android user living with an iPhone abuser, however, a hidden AirTag could be pairing far more often.
This is part of Apple’s larger “walled garden” strategy of product development. Generally, Apple’s walled gardens mean that Android users appear as second-class-citizen green bubbles in iMessages, or they can’t connect to FaceTime calls. These decisions keep people in the Apple ecosystem, spending money on Apple products. But with AirTags, every Android user can be discreetly tracked by an AirTag for longer than an iPhone user. Apple has built an invention that sits atop its unparalleled network of devices and that puts users outside of it in more danger.
So abusers who live with partners using Android can constantly pair and re-pair an AirTag so that it won’t set off an alert, a problem so core to the design of AirTags I’m skeptical it can be fixed with a software tweak.
“Three days won’t work if you’re going home every day to the same person tracking you. . . . That’s a learning space [that] hopefully Apple will consider and work to build in protections with that threat model,” says Corbin Streett, technology safety specialist at NNEDV. “[Apple] is thinking about the threat model where it’s a stalker who is walking by someone on the street they don’t know—that stranger danger model—but what about when it is the person you come home to every day?”
Streett floats that Apple, and all the companies that make tracking devices, could be approaching products such as AirTags differently. Apple could have partnered with Google to develop a shared standard (as they did in their COVID-19 contact-tracing apps) so that AirTags would offer the same protections to everyone. At a minimum, this would allow Android users to have the same protections against AirTags as offered to Apple users.
“I lose my keys and wallet all the time!” says Streett. “But how do you build it in a way that those folks who are in relationships, so that this can’t be used against them? I hope Apple keeps their learning hat on and works to figure out that piece of the puzzle.”
If you are a survivor of domestic abuse or concerned for someone who may be, contact the National Domestic Violence Hotline at 1-800-799-SAFE (7233) or 1-800-787-3224 (TTY).
(48)
