On April 30th, 2021, Apple released a new product, called the AirTags. Those small, round devices can quickly find and track lost objects such as keys or bicycles. Almost instantly after the announcement, concerns emerged that AirTags could be also be used to track people, too. Apple did, to its credit, add some anti-stalking and anti-tracking mechanisms to the AirTags. An AirTag that is travelling with someone who is not its owner is meant to alert its target thereof, either through a notification (for those who have Apple devices with iOS 14.5 or higher) or through an audible noise that they make after three days. Only a few days after the AirTag’s release, many security experts described their mechanisms as ineffective: an AirTag slipped into somebody’s coat pocket or backpack could easily have revealed their home address by the time the notification shows up or an alert rings.
While most of the security research has focused on how moving AirTags could be used to track people while they are in motion, the devices have one more crucial security flaw: they can be used to offer a regularly updated map of iPhones and, by extension, their owners.