Am I being tracked? Anti-stalking tech from Apple, Tile falls short.

A year later, Apple along with similar tracker-tag makers Tile and Samsung have introduced a host of product updates to deter stalking and help victims learn if they’re being followed. But what I discovered from my stroller test was a patchwork of apps that work better for engineers than for domestic abuse survivors.

Digital stalking is an expression of humanity’s worst impulses but is a problem of the tech industry’s own creation. And tech fixes for it won’t really work until the industry starts working together — something there’s a glimmer of hope might happen.

At least tech companies are now acknowledging the problem. Since my first column, we’ve heard report after report of people finding these poker-chip sized wireless devices hidden in coat pockets and taped under cars, allowing someone to easily track them without their consent. Just last week, Ukraine issued a warning that AirTags and similar devices called Tiles might be used by Russian saboteurs, secretly putting them into humanitarian aid packages.

Apple included some anti-stalking deterrents for iPhone owners in the product’s original 2021 release, but in response to the incidents, last month announced a slew of changes to how they work. Apple has now addressed some of the specific problems I highlighted last year. Most encouraging, Apple and Tile have — better late than never — given advocates of domestic abuse survivors a seat at the table in product discussions.

Now Samsung and Tile also offer apps for a victim’s phone that are supposed to help her or him identify trackers that are following them.

“The reality is that this is a very complicated problem to solve,” Tile CEO CJ Prober told me in an interview after launching the company’s long-awaited Scan and Secure software last week. “This is our first launch. We wanted to get something out that wasn’t confusing and works.”

My job is to hold tech companies accountable. So I slipped an Apple AirTag, Tile and Samsung SmartTag in my son’s stroller to see how useful each company’s anti-stalking features actually are.

Bottom line: I’m glad I wasn’t reliant on some of this tech to combat a real-life crime. Even Apple’s tech, which is by far the most sophisticated, shifts too much work onto the shoulders of abuse survivors who might be stalked by other brands of trackers or, heaven forbid, use Android phones.

Three tags and a stroller

My stroller test helped me understand how this technology works, but of course the experience was nothing like actually being stalked. Tracking people’s location without their consent is a frightening way to exert control that’s often linked to physical abuse. It’s never okay.

To conduct my test, I mirrored how a stalker might use tracker tags to follow his victim. I set up an AirTag, Tile and SmartTag linked to test phones and slipped each into my baby’s stroller. Then I grabbed a different iPhone and Android phone unknown to any of the tags — and went for a 45-minute walk.

Out on the sidewalk, only one of the tiny trackers indicated something might be amiss. After we started moving, the AirTag played a few seconds of chirping, though hard to hear along a busy road. (Apple has announced it will improve the sound but wouldn’t play me a sample.) I heard not a tinkle from the Tile and the SmartTag.

When I returned home, I received one other warning, only on my iPhone and only about the AirTag. After a few minutes passed, an alert read, “AirTag Found Moving With You.” Back when AirTags launched, you’d only get this alert after three days of tracking; now Apple has dramatically shortened that window. This is extremely valuable even if it results in the occasional false positive (like if you’re borrowing a friend’s keys with an AirTag keychain).

The bad news is: This was the only proactive alert I received on either phone.

To discover anything about the Tile, the SmartTag or even the AirTag on my Android phone, first I had to download different apps and master each of their peculiarities. Even for me — a professional gadget guy — it was a lot.

Tile

Tile’s anti-stalking software, now embedded in a “Scan” button in the app’s login screen, let me hunt for unknown Tiles nearby. But it comes with an odd requirement: Those Tiles have to be moving with you over a 10-minute period, so you actually have to go on a walk or drive. Tile said this was to make the app produce fewer false alerts about Tiles that weren’t actually dangerous — but it feels like a strange hoop to make victims jump through.

Samsung SmartTag

Samsung’s SmartTag detector is buried so deeply in the settings of its SmartThings app, I had to ask the company where to find it. Then on my first stroll, the app failed to find my test SmartTag. Later, Samsung told me that its software wouldn’t identify a tag until it had been separated from the phone that owned it for a full 24 hours. (How does this make sense, if domestic violence victims live with their stalkers?) Worse, Samsung’s software doesn’t work on iOS, so I never located the SmartTag with my test iPhone.

Apple AirTag

To find the Apple AirTag on my Android phone, I had to download an app called Tracker Detect that Apple released late last year. I opened the app and tapped scan, and after a few seconds, it reported an Unknown AirTag and gave me the option to make it play the warning sound after 10 minutes passed. Sometimes it actually reported two AirTags, a bug Apple was unable to explain.

Quirks aside, each of these apps suffered from a bigger problem: What if I hadn’t known to be looking for a tracker in the first place?

None of them offer background monitoring or alerts, like with AirTags on the iPhone. Each could only scan at that moment, one at a time.

“It’s a nightmare scenario that’s not practical for most people. It’s barely even practical for the people who work regularly with the survivors of domestic abuse,” said Eva Galperin, the director of cybersecurity at the Electronic Frontier Foundation.

Erica Olsen, Safety Net director at the National Network to End Domestic Violence, said, “It’s better than not having any safeguards, but there is still a significant amount of work that has to be done to address it in a comprehensive way.”

Google, which makes Android, said it’s already possible for Apple’s app to run in the background. “Domestic violence advocacy groups have raised valid concerns about these products, and we encourage the manufacturers to update their apps to improve proactive scanning,” said spokeswoman Kaori Miyake.

Apple spokesman Alex Kirschner said: “We’re committed to making improvements that continue to guard against unwanted tracking, and we are evaluating ways to make unwanted tracking features stronger for Android users. Continuous background scanning with Tracker Detect on Android would negatively impact battery life and other features that use Bluetooth. The most power-efficient way to enable this type of background scanning for AirTag is to implement it at the Android operating system level.”

Unraveling all of this was frustrating enough for me — but Olsen encouraged me to imagine it through the lens of someone in trauma. How does trying to download and figure out all of these apps work for someone who’s trying to escape their abuser?

The solution

I’ve heard the argument that a flurry of news reports about AirTag stalking are a sign that the current technological deterrents are working.

I’m very glad Apple’s tech enabled people to discover these crimes — but we have no idea how many people it didn’t work for. The current landscape of tech means the bad guys need only mismatch brands, or use the tracker with the worst deterrents and they’ll never be caught.

I know the tech industry can do better because even students have done better. An Android app called AirGuard made by students at the ​​Technical University of Darmstadt offers protections none of the official Android apps do, including background scanning and detecting multiple brands of trackers. When I took it on a walk with my stroller, it popped up alerts to report it discovered the AirTag and Tile, complete with a map of where it spotted the tracking.

How’d they do that? Project leader Alexander Heinrich told me that his team documented the Bluetooth signals from different kinds of tracker tags, then taught their app to log and sort through the relevant ones.

The tech industry can, and should, follow their road map: building the capability to sense for known Bluetooth trackers right into smartphone operating systems like iOS and Android. It could be passive, so you didn’t have to download an app or even know the stalking protections existed on your phone — it just worked when you needed it.

“It would be really good if the industry came up with a shared standard,” said Galperin of the EFF.

Tile’s Prober told me this makes the most sense to him, too. “It's actively being worked on and discussed,” he said. “Where I get concerned is that Apple does not have a history of participating in these type of cross-platform enablements that take away from their platform lock-in.”

Apple wouldn’t answer questions about its involvement in cross-industry efforts. That seems strange to me, for a company that has staked its brand on privacy and security. Apple has worked with competitors before, including developing Bluetooth-based Covid-19 exposure notifications that work on Android and iOS devices alike.

Google is already at work. Earlier this week, sleuths at the blog 9 to 5 Google spotted test code in a work-in-progress version of Android that includes “Unfamiliar device alerts” and an “Unfamiliar Tag Detected Notification” for Bluetooth.

Google wouldn’t comment on that discovery, but Miyake said the company encourages tracker makers “to work with the ecosystem and advocacy groups on a long-term solution with safety built in.”

An industry that likes to push for self-regulation needs to demonstrate it can summon the will to work together at least to conquer this common enemy. Lives depend on it.