Uncovering Digital Footprints: The Forensic Frontier of Apple AirTags

In an era dominated by technological accessibility, physical tracking devices have become easily accessible, presenting a double-edged sword of convenience and potential misuse. Tracking devices offer a range of legitimate applications, from physical items to locating the rogue family pet. However, the ease of acquisition has also paved the way for nefarious purposes, as individuals with ill intentions exploit these devices for unauthorized surveillance, stalking, or even criminal activities.

Tracking devices such as the Apple AirTag lets you easily track things such as your keys, wallet, handbag, backpack, luggage and more. Simply set it up with your iPhone, iPad or iPod touch and attach it to your item, and your AirTag will appear in the Items tab in the Apple application Find My app.

Apple AirTags include features to guard against unwanted tracking.

This article focuses on features specifically designed to deter unauthorised tracking using an Apple AirTag or similar devices without one’s awareness, which is often misconstrued as being the target of tracking oneself.

Having served as a former police officer, I’ve participated in hundreds of criminal investigations involving serious offenses where tracking devices were employed.

Important: If you suspect you're being tracked by a tracking device please reach out to law enforcement to discuss your concerns. 

Is it illegal to track someone using a tracking device?

Yes, using tracking devices to track people without their consent is a criminal offence in Australia and in other countries. For example, in New South Wales, under Section 9 of the NSW Surveillance Device Act 2007, a person must not knowingly install, use or maintain a tracking device to determine the geographical location of (a) a person–without the express or implied consent of that person, or (b) an object–without the express or implied consent of a person in lawful possession or having lawful control of that object.

For applicable laws relevant to your area, seek formal legal advice.

How do Apple Air Tag devices work?

There is plenty on information out there already on this, so its best to go straight to the source at https://www.apple.com/airtag/

How do I know if there is a Apple AirTag device near me ?

This is the most important information to remember.

To mitigate the risks associated with unwanted tracking, Apple has implemented several anti-stalking features:

• Unwanted Tag Detection: If an unknown AirTag is detected traveling in proximity with an iPhone user for an extended period, the user will receive a notification, alerting them of the potential stalking threat.

• Audible Alerts: If an AirTag has been separated from its owner for a certain period, it will emit an audible sound, drawing attention to its presence.
• Privacy Measures: AirTag location data is end-to-end encrypted and not accessible by Apple. Moreover, location data is not stored on the AirTag itself.
• NFC Capability: Apple and Android users can tap an AirTag with their NFC-enabled smartphone to access information about the tag and disable it if necessary.How to reset your AirTag – https://support.apple.com/en-us/102577

Is it possible to identify the identity of the owner of the Air Tag?

Potentially yes, if you have found an unknown AirTag, you can follow these steps to see information about it or to disable it:

1. If you have found an AirTag, hold the top of your iPhone or NFC-capable smartphone near the white side of the AirTag until a notification appears.
2. Tap the notification. This will open a website that provides information about the AirTag, including its serial number and the last four digits of the phone number of the person who registered it. This can help you identify the owner, if you know them.
3. If the owner marked the AirTag as lost, you may see a message with information about how to contact the owner.

If you need to see a list of all AirTag and Find My Network accessories about which you have been notified, launch the Find My app on your iPhone, iPad or iPod touch. Tap Items. Scroll to the bottom and tap Items Detected With You. Items that have recently triggered an unwanted tracking alert will be listed. If the option to play a sound isn’t available, the item may not be with you any more, may be near its owner or, if it was with you overnight, its identifier may have changed.

I’m getting this notification, am I being tracked?

If you find a physical tracking device on your person, your car or property, there is a good possibility you may be actively being tracked by someone

Importantly, don’t jump to conclusions but seek advice where necessary

If you receive notifications on your device similar to that depicted below, ensure you read the information thoroughly.

The red dots show where the unknown item was detected near your iPhone, iPad or iPod touch. The dashed lines connecting the red dots help indicate the sequence where the item was detected with you. The red dots do not indicate when the item’s owner is viewing the item’s location.

Need help ? The Alvarez and Marsal Forensic Technology Team is ready to assist you with your matters.

Resources:

During researching this topic, I came across a wealth of useful resources as below

• What to do if you get an alert that an AirTag, Find My network accessory or set of AirPods is with you – https://support.apple.com/en-au/HT212227
• UCI Police Department – AirTag Safety – https://police.uci.edu/how-do-i/airtag-safety.php
• AirTags and Stalking: A Deep drive into the forensic science behind Apples tracking devices –https://thetruthaboutforensicscience.com/airtags-and-stalking-a-deep-dive-into-the-forensic-science-behind-apples-tracking-device
• IoT Forensics – Apple Airtag and Crowd Sourced Tracking https://www.magnetforensics.com/resources/iot-forensics-apple-airtag-and-crowd-sourced-tracking
• [Air]Tag You’re It! – https://blog.d204n6.com/2022/04/airtag-youre-it.html