Since September this year, auto theft investigators from York Regional Police in Aurora, Ontario, have seen five incidents of Apple’s AirTag trackers being used to steal cars, and now it appears to be happening in the US, too. The tags are hidden on high-end cars when they are parked in public spots. Thieves then track the tag to the victim’s home, typically in a less public spot, and steal it by breaking into the car and using a mechanics’ diagnostic rig to convince the car to accept the thieves’ key. And unfortunately, AirTags’ designed-in privacy might be so good that Apple cannot do much to help. “Whether or not Apple is equipped to identify thieves who mainly target AirTags, the company will still be obliged to fully cooperate with any legal investigation that may require their help, as well as be held legally liable if anything is proven to be a consequence of any discovered gaps in their safety features, privacy policies,” lawyer Collen Clark told Lifewire via email.
Track and Trace
Apple’s AirTags work by emitting a regular Bluetooth pulse. This pulse is picked up by any passing Apple device, anonymously, tagged with a location, and sent off to Apple’s servers, where it sits, encrypted. When the owner wants to trace their tag, the little data package is downloaded and decrypted, giving its location. It’s an ingenious yet simple method that lets Apple use its billions-strong network of active devices to track your AirTags, anonymously and safely. But that doesn’t mean the system cannot be abused. The police in the York cases have not shared all details, but it’s a fairly safe assumption that the thieves set up fake Apple IDs to use with their AirTags, rather than using their own Apple IDs with their names and addresses. But even with the recovered AirTags in hand (some of the owners noticed the AirTags—more about which in a moment), it’s not certain that Apple could give details because the system is designed to retain as little information as possible. Police could trace the found tags to the retailer that sold them, but that won’t work when a car is stolen, and the tag is not recovered—only if the AirTag is found first can they be used to track down the person they’re registered to, but then what crime has been committed? Putting an AirTag under a fuel flap?
How Can You Prevent This?
Presumably, the owners of these high-end cars found the tags and realized what was happening. But there are better ways to protect yourself than just chance. For example, if your iPhone detects an unidentified AirTag riding along with you, then it will warn you with an alert. This works for tags hidden in your car or dropped into your purse. At launch, a tag could be hidden near you for up to three days before triggering the alert, but this has since been reduced. The next version of iOS—iOS 15.2—has a new option to scan for hostile AirTags. Users can see nearby unknown trackers under a new ‘Items That Can Track Me’ tab in the Find My app. “That’s ironic,” writes AirTags user Vertsix on the MacRumors forum. “I use one in my car precisely to avoid a car theft and track down a potential criminal.” In future versions of iOS, Apple could add a version of this to its CarPlay software, which lets your iPhone integrate with your car via Bluetooth. It could automatically scan for tags when connected, for example. But the beauty of this scam, from the thieves’ point of view, is that it’s quite undetectable, and the consequences are, so far, low stakes—AirTags cost as little as $25 each when bought in four-packs. Meanwhile, car owners must keep on guard at all times to notice any trackers. Otherwise, the standard police advice applies. If possible, park your car in your garage, put a lock on your diagnostic port, etc. Or, and this is radical, why not sell the car, buy a bike, and take public transport? Everybody wins, except those car thieves.
