In mid-2021, Apple released a new product advertised to provide a private and secure way to easily locate items that matter the most, called the AirTag.
An AirTag can be attached to everyday items, including handbags, keys, even cars. When an AirTag has been attached to an item or placed within an item, it provides owners the exact distance and direction to their AirTag, through a combination of sound, haptics, and visual feedback. While this relatively new product makes finding lost items convenient, people are finding ways to use the technology for nefarious purposes or activities.
AirTags are lightweight and roughly the size of a quarter, making an AirTag easy to conceal and surreptitiously track items and/or people for malicious purposes. AirTags have some built-in safeguards, such as alerting Apple users if an unknown AirTag has been traveling with them for a while. However, the parameters for when this notification is delivered have not been defined. This potential delay could give an AirTag owner instant access to the location of the thing or person the AirTag was intended to be tracking. If an AirTag is away from its owner and not located within 8-24 hours, Apple reports that a beep will be emitted. However, the beep is only 60 decibels and could easily be silenced if well hidden.
Even with these added security measures, these features do not eliminate the possibility of unwanted tracking.
There will always be an opportunity for misuse of technology, and AirTags are no different. When considering how an agency can address potential misuse of AirTags, consider the various scenarios that could incorporate their misuse, such as employee stalking, or student stalking and bullying. Due to their size, it is unlikely that an agency can effectively ban the use of AirTags. However, agencies can expand their Acceptable Use Policies to incorporate appropriate and inappropriate uses of AirTags and other tracking devices. School Districts should also clearly define the disciplinary action students face if they misuse any technology, including AirTags. For additional assistance or questions regarding Acceptable Use Policies, please reach out to PRISM Risk Control.