AirTags and Find My: from finding your keys to following you

TL;DR

An AirTag is a genuinely clever little device: drop one on your keys, lose them in a taxi across the city, and a map still shows you where they are. It has no GPS and no SIM, just a tiny Bluetooth beacon and a year of battery, and it finds itself by quietly borrowing every nearby iPhone as a reporter. That is brilliant for a lost object. The problem is that the exact same qualities, cheap, silent, and self-locating, make it just as good at following a person who has no idea they are carrying one.

This episode is about how that trick works, why thirty euros of hardware is all it takes, and, most importantly, how to find a tracker that does not want to be found. It is also the one topic in this series where the misuse is genuinely dangerous to real people, so I will be clear throughout about the line between understanding the problem and the serious harm of pointing it at someone. I build both halves into the Evil-M5Project: the thing that builds a beacon, and the thing that catches one.

The clever little disc

It is easy to be charmed by an AirTag, and honestly you should be. For the price of a cheap meal you get a coin-sized disc that can reunite you with your keys, your luggage, or a forgetful teenager’s backpack from anywhere in the world, with no subscription and a battery you change about once a year. As a piece of engineering it is close to magic, and most of the time it is used for exactly the harmless thing it was built for.

But every property that makes it great at finding your keys makes it great at finding you, and that is not a flaw you can simply patch away, because it is the whole design working as intended. So it is worth understanding how the trick actually works, because once you see it you understand both why it is so powerful and why the defenses against its misuse are harder than they look. And you understand what it takes to catch one that was never meant to be found.

How Find My actually works

Here is the part that surprises people: an AirTag does not know where it is. It has no GPS and no way to locate itself at all. It is a tiny Bluetooth beacon that does one thing, sending out a short code every couple of seconds, and that code itself changes roughly every fifteen minutes, so to anyone but the owner it is a meaningless, constantly shifting string. On its own, sitting in a drawer, it means absolutely nothing and tells no one anything.

What gives it power is everyone else’s phones. An iPhone that happens to pass by hears the beacon and quietly reports where it was when it heard it, back to Apple, encrypted so thoroughly that even Apple cannot read the location and only the tag’s owner can. With something like a billion Apple devices wandering the world, that adds up to a free, silent, worldwide tracking network that nobody had to build on purpose. Lose your keys down the back of a sofa in another city, and a stranger’s phone you will never meet reports them home for you, without that stranger ever knowing they helped.

The same network, pointed at a person

Now take that exact system and put the tag in someone’s coat pocket instead of on their keys. The network does not know the difference and does not care; it treats the two cases identically. It reports that person’s location to whoever owns the tag, with precision that ranges from a few metres in a busy city, where phones are everywhere, down to a rough neighbourhood in a quiet area where few phones pass, for about a year, for the price of a cheap meal.

There is no monthly fee and no SIM card to trace back to a buyer. A system built to find lost objects turns out to do an unnervingly good job of following a person who has no idea they are carrying one, and it does it using the phones of thousands of innocent bystanders who are all, unknowingly, part of the surveillance. That is the uncomfortable heart of this: the capability is not a side effect that slipped through, it is the same capability that makes the product good, aimed the other way.

Technical deep dive: BLE beacons, rotating keys, and the crowd

This is the part worth slowing down on, and you can skim it if you only want the defenses. The tag broadcasts a Bluetooth Low Energy (BLE) advertisement, a tiny message any nearby device can hear. Crucially, what it broadcasts is a public key that rotates on a schedule the owner’s devices can predict but nobody else can, which is why a passing stranger sees only a string that changes every fifteen minutes and cannot be linked from one sighting to the next. That rotation is what stops the network itself from becoming a way to track the tags.

When a passing iPhone hears the beacon, it takes its own current location, encrypts it using that broadcast public key, and uploads the encrypted blob to Apple. Because only the tag’s owner holds the matching private key, only the owner can later download and decrypt those location reports. Apple relays sealed envelopes it cannot open, which is genuinely good privacy engineering for the honest use case, and also exactly why a stalker’s reports are just as unreadable to everyone but the stalker. A research project called OpenHaystack showed that this scheme is open enough that you do not need an Apple tag at all: load your own keys onto a cheap microcontroller, broadcast the right kind of advertisement, and the billion-device network will happily carry your beacon’s location to you for a few dollars of hardware. The network authenticates the format of the beacon, not the legitimacy of the device sending it, and that single gap is where homemade trackers live.

Apple tried to fix this, and mostly did

Apple saw this coming and built in real defenses, and it is only fair to say they work and have caught genuine stalkers. An iPhone that notices an unknown AirTag travelling with you over time will warn you. Android users can run Apple’s own Tracker Detect app to scan for one, and Google has since added its own background alerts for unknown trackers. A genuine AirTag that has been separated from its owner for a while starts beeping to give itself away. None of this is theatre; it has prevented real harm.

The catch is where those defenses actually live. They sit in Apple’s genuine AirTag hardware and in the phone software, not in the Find My network itself, and the network will relay any beacon that speaks its language. A homemade tracker built on the same open scheme rides the exact same network while sidestepping the safeguards. The alerts follow a cross-platform standard that flags any tracker built to comply with it, so a compliant tracker does get caught on an iPhone or Android, but a homemade beacon that deviates from that standard, or that targets a phone with the alerts switched off, can slip past. And the one defense it can never trigger is the beep, because a bare board simply has no speaker. The safety story is real, but it stops at the edge of Apple’s own hardware, and a homemade tag starts just past that edge.

Where it shows up

Most of the time, thankfully, this shows up in the cheerful way everybody loves: finally knowing where your own luggage actually is, or clipping a tag to a bag so a forgetful family member can be found. That is the overwhelming majority of real use, and it is genuinely useful. It would be dishonest to pretend the technology is mostly sinister, because it is not.

But the serious misuse has to be said plainly, because it is the reason this topic matters more than most in the series. Cheap, silent, long-lived location tracking is precisely the wrong capability to hand an abusive ex or a controlling partner, and police and victim-support services increasingly report exactly these cases. There is also covert vehicle tracking, a tag dropped into a car, and the legitimate use of trackers in authorized physical security work against someone who has agreed to it in advance. The gap between the happy use and the dangerous one is not technical at all. It is only consent, which is exactly why the detection side matters so much.

The disc in the car seat

Say you are Nadia, and over a few weeks you have had the odd, creeping feeling that someone always seems to know where you have been. You do not own an iPhone, so you never saw a single tracking alert, because the warnings mostly assume you carry the very hardware the attacker is exploiting. The feeling is easy to dismiss as paranoia, right up until it is not.

One evening a friend with an iPhone is sitting in your car and her phone pings: an unknown tracker has been moving with you. You search, and tucked into the lining of the passenger seat is a small white disc, or in a nastier version, a bare little board with its own battery that never made a sound at all. It had been quietly reporting every trip you made to someone who had no business knowing any of them. The device cost almost nothing, it beeped at no one, and the only reason you found it was a borrowed phone that happened to be the right brand.

Why it works

Pull apart why this works and nothing exotic falls out. The tag makes no noise, so nobody notices it riding along in a seam or a pocket. It needs no GPS and no signal of its own, because it leans on every phone that happens to pass. And the trail of locations stays locked to whoever holds the keys, encrypted so thoroughly that nothing about it points back to the person who placed it. Three ordinary design choices, each sensible on its own, combine into something that follows a person almost perfectly.

None of those choices were added for stalking. They are simply what you get when you design something to track small objects extremely well, cheaply, and privately, and then try to patch over the misuse afterwards with alerts bolted onto one brand of phone. The capability is the point of the product. The harm is the same capability without consent, and that is a much harder thing to engineer away than a bug.

What to do if you think you are being tracked

This is the part that matters most, so take it slowly, and start with safety rather than curiosity.

• If there is any chance this is a domestic-abuse situation, put your safety first and talk to a support service or the police before you touch anything. Specialist organisations handle exactly this, and moving or disabling a tracker can tip off whoever placed it, which can escalate the danger. Everything below assumes you are not in that situation.
• On an iPhone, make sure tracking notifications are on (they usually are by default). On Android, run Apple’s Tracker Detect to scan, and keep Google’s own unknown-tracker alerts enabled. These catch genuine AirTags well.
• Take any alert seriously and search properly: bags, coat linings, and the car in particular, under the seats, in the boot, and around the wheel arches.
• If you find a genuine AirTag, an iPhone or an NFC-capable Android (the same tap-to-pay chip) can tap it to show some owner information, and removing the battery stops it. Keep it rather than binning it, because it can be evidence.
• The hard part: a homemade tracker will not beep and may not trigger any alert at all. A Bluetooth scanner that watches for Find My beacons travelling with you is the realistic way to catch those, which is exactly what the detection tool below is for.

Doing it with the Evil-M5Project

Evil-M5Project, the firmware I build, has both halves of this, and the fact that it has both is the whole point: the thing that builds a tracker and the thing that finds one. I care far more about the second than the first.

• FindMyEvil turns a cheap ESP32 board into a Find My beacon, and it is worth being exact about what it does and does not do. It broadcasts valid Find My advertisements using keys you load yourself, so it breaks no Apple encryption and can never read anyone’s location. It exists to show how, for a few dollars, you can make something that behaves like an AirTag on the network but never beeps. A real long-life stalking tag would use a lower-power chip than an ESP32, but the beacon it sends is the same.
• Wall of AirTags is the defender’s side, and the one I actually reach for. It scans the air for Find My and AirTag beacons nearby, lists them with signal strength and whether each is getting closer or farther, and logs them. If a tracker is following you, this is where you start looking, including the homemade ones that stay silent.
• Apple BLE Sniff is the broader recon view. Apple gear around you constantly announces little Bluetooth messages (AirPods battery, whether a hotspot is on, Find My presence), and this passively decodes them so you can see the chatter for what it is.

The honest limits keep it grounded. FindMyEvil only ever broadcasts, with keys you own, so it is a way to understand and detect the problem, not a way to locate a stranger, and any location only ever reaches whoever holds the keys, through Apple. Find My beacons shuffle their identifier about every fifteen minutes, so a scanner shows you what is broadcasting nearby right now and how strong it is, but proving that one specific tag has stayed with you across several trips takes repeated sweeps and judgement, not a single reading. Detection depends on the tracker being in Bluetooth range and transmitting, so a sweep is a snapshot, not a guarantee.

Evil-M5Project is for ethical and educational use only. Use the beacon only with keys you own on hardware you control, never to track a person without their explicit consent. If you believe you are being stalked, contact a support service or the police. Follow the laws where you are.

Firmware and docs: https://github.com/7h30th3r0n3/Evil-M5Project.

A map that points both ways

Find My is one of the most quietly impressive systems most people carry without ever thinking about it, and that is exactly why it is worth a second look. The network that reunites you with your lost keys works just as well for a stranger who wants to find you, and the safety features meant to stop that were built for Apple’s own tags, not for the cheap copies that behave the same way while staying completely silent.

That is why I put both the beacon and the scanner in Evil-M5Project, and why I weight the whole thing toward detection. You do not quite believe how cheap and how quiet this has become until you watch a bare board do it, and then watch a second board flag the first one riding along in your bag. If this episode does one thing, I want it to be that: not fear of a clever gadget, but knowing that a silent tracker can be found, and knowing where to start looking.