AirTag 2 doesn’t break crowdsourcing or anti-stalking measures

After my article on 2nd-generation AirTag compatibility issues a few weeks ago, in which I explained that the 26.2.1 or later release of each of Apple’s operating systems was required to pair and view the revised tracker, my friend Adam Engst posted a question about compatibility, and Six Colors member Scott wrote in with a related query.

If you can’t use a 2nd-generation AirTag with an iPhone, iPad, Mac, or Apple Watch—because you can’t upgrade the device to its respective 26.2.1, or have chosen not to—does that mean that this newer AirTag model is invisible to those devices when reporting its location? And—me partly extrapolating a related question—does this prevent anti-stalking features, created by Apple and by an Apple/Google industry initiative, from “seeing” an unwanted AirTag 2?

Fortunately, the ability to pair and track a 2nd-generation AirTag is distinct from participating in Apple’s crowdsourced Find My network, allowing its encrypted, privacy-protecting broadcasts to be recognized by all generations of Apple hardware. And the new AirTag doesn’t create an accidental loophole in deterring and detecting unwanted tracking—in fact, it might even be a better “citizen” due to its ability to emit a louder noise and its longer Bluetooth range.

Think quick, hot spot! Which one of these AirTags is first-generation and which is second? The AirTag 1 is at left, with upper and lowercase type on its back plastic battery panel; the AirTag 2, at right, is all uppercase and calls out the IP67 water resistance. (Images: Apple)

Find My network counts on you

When you’re within Bluetooth range of an AirTag (either generation), a third-party Find My tracker, or a device with one embedded, Bluetooth lets you find your devices. This includes most Apple and Beats audio hardware and Apple’s Internet-connectable hardware.

But outside that range, the Find My network kicks in. It relies on crowdsourcing. When your “device” (iPhone, iPad, Mac, or Apple Watch) lacks an Internet connection, it begins broadcasting over Bluetooth using a network name that contains encrypted information. Audio hardware not near a paired device does the same, and AirTag and Find My items broadcast all the time.

This signal is picked up by any nearby iPhone, iPad, or Mac with an Internet connection. It takes the encrypted Bluetooth identifier, which reveals nothing to the device’s owner, packages it with the currently derived location (using a combination of GPS, cell tower finding, and Wi-Fi positioning), and uploads it to Apple. Because the data is encrypted, only a device registered to the same Apple Account can download and decrypt it, which is why native Find My apps are required on each major device platform.

The 2nd-generation AirTag broadcasts the same kind of information as the 1st-generation model. In fact, due to a newer Bluetooth chip, it will likely be picked up at a greater range than its predecessor, making tracking more likely.

Unwanted tracking

Technology is always turned to dark ends, and it’s our job, as people who buy, make, or critique devices, to appreciate the good uses and to mitigate or eliminate the poorly developed ones. So far this century: Bad work, everyone!

The AirTag is a great case in point. Before it existed, Tile offered trackers that worked within Bluetooth range and had developed a crowdsourced passalong technology, but needed a vastly larger installed base to make it valuable—and dangerous. Besides Tile, if you wanted to track something (or someone), you had to get a GPS tracker with cellular connectivity, which could be expensive and have relatively short battery life.

This was useful for expensive hardware, families of people with dementia or cognitive decline, and for stalkers, whether domestic (or former) domestic partners or others. But the cost, size, complexity, battery life, and other details put them out of reach of most people.

Apple shipped the AirTag, and it immediately changed the equation. Because an AirTag can rely on a billion pieces of Apple hardware already in the field, and because it has a lithium-ion cell that can last about six to 12 months, it’s a boon for making keeping tabs on our bags, cars, and bikes. But also a boon for the creeps and abusers of the world.

I won’t relitigate the critique Apple received for its initial settings, but the company made changes over time to make it more likely that we would become aware that someone was trying to track us without our knowledge. Here’s a rundown of the two main features and how the new AirTag improves discoverability:

Planted on you or your stuff: When an AirTag is separated from its paired device, it makes a sound when moved. Initially, the delay was three days; Apple reduced it to a random duration of 8 to 24 hours. Thus, if someone stuck a tracker in your bag while you were out and about, when you picked it up within a day, you’d get an audible alert. The 2nd-generation AirTag is 50% louder (according to Apple’s measurements) than the 1st-generation model.

Moving with you: In whatever fashion a tracker comes to be near you for a persistent period of time—Apple doesn’t disclose, but it’s likely 15 minutes or longer—you will receive an alert on your iPhone or iPad about it, and be able to play a sound on the tracker. It should appear when you arrive home or at a significant location, defined and securely stored locally on your devices, or by the end of the day if the previous trigger didn’t occur. The 2nd-generation AirTag’s 50% louder volume helps here, too. Apple and Google co-wrote a standard for anti-tracking that led both companies’ mobile operating systems to recognize each other’s devices as moving with you.

Google has adopted additional countermeasures that I wish Apple would consider:

Trackers’ locations are relayed only when they’re in “high-traffic” areas, like an airport, a path, or a street people commonly walk on. This prevents tracking in homes or when someone is out for a drive or bike ride. It makes it less likely to be useful for finding someone on their own, for sure.

If you mark your home address in your Google Account, this prevents any Android device from relaying trackers in or near that location. That can keep a stalker from knowing when you leave or return home.

A tracker’s owner is limited in how frequently they receive updates. Google doesn’t provide details says they “rate limit” and “throttle” requests, as most lost items remain in stationary locations.

Apple may have implemented some aspects of the above, but the company doesn’t disclose or document them.

For further reading

Since my last column, I’ve updated my book Take Control of Find My and AirTags to incorporate all the details related to the 2nd-generation AirTag and the new availability of Precision Finding for certain Apple Watch models.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]