The Guarantees a Safe Tracker Must Balance
This chapter names the security properties that make a crowdsourced location-tracking system safe or unsafe. The focus is not whether a tag has a password or whether a company uses the word “anonymous,” but what different participants can link, see, detect, and prove. By the end, readers should be able to separate broadcast privacy from location privacy, distinguish useful detection from universal surveillance, and see why accountability needs evidence that resists framing.
A security property is a statement about what an adversary should not be able to do, or what a legitimate user should be able to do under stated conditions. The Tile security study uses four especially useful properties for this subject. Two protect privacy: tag indistinguishability and location indistinguishability. One protects the person being followed: tag detectability. The fourth, framing resistance, protects the integrity of an accountability process. Accountability itself is the response that may identify and punish misuse. Keeping these ideas separate prevents a feature in one category from being mistaken for a guarantee in another.
Two kinds of privacy protect different boundaries
Tag indistinguishability asks whether an observer can tell that two Bluetooth broadcasts came from the same physical tag. If every advertisement contains a permanent identifier, a nearby receiver can record that identifier and follow its appearances. The receiver may not know the owner’s name at first, but a persistent wireless handle can be connected to a person, a home, a workplace, or a routine. Once that connection is made, changing nothing else about the system may leave the owner exposed for a long time.
A common response is to make the broadcast identifier change. An effective construction aims to make a value from one tag look like a value from another tag, so a passive radio observer cannot simply join all observations into one history. This is a property of the tag’s public emissions and of the information available to an observer. It does not mean that nobody can ever recognize the tag. A finding system still needs some authorized way to decide that repeated observations might describe the same accessory when it is traveling with a potential target.
That distinction is important because the two uses of linkability are in tension. A passive observer should not be able to build a movement profile from ordinary Bluetooth traffic. A target’s device may need to recognize persistence across time and distance in order to issue an unwanted-tracking alert. The design challenge is controlled linkability: give the protective function enough information to work without giving every nearby listener the same capability.
Location indistinguishability asks a different question: can the service provider learn the locations contained in reports submitted by finder devices and owners? The crowdsourced network has to route or store reports, but it need not automatically receive readable histories of every tag and finder. The Tile study describes end-to-end encryption as the approach used by other major systems it compares: a finder can protect a location report for the intended owner, while the platform server is not supposed to learn the location itself.
This property concerns the finder-to-network and network-to-owner boundaries, not just the advertisement in the air. A tag might use changing identifiers and still send readable location records to its platform. Conversely, a platform might protect stored locations while a static feature in the Bluetooth advertisement lets an outside observer recognize the tag. Passing one privacy test does not imply passing the other.
The distinction also clarifies what “only the owner can see the location” should mean. It could mean that an ordinary user interface displays the result only to the registered account. It could mean that the platform’s employees or systems cannot read the report. It could mean that a passive radio observer cannot connect the broadcast to a person. Those are different claims about different observers. A serious security statement has to specify which one is being made, what keys or permissions enforce it, and what happens when an account is shared or compromised.
The same separation applies to accountability. A platform may retain enough information to identify an account while also being able to see every location report. That may make investigation easier for the platform, but it weakens the privacy of everyone whose devices participate in the network. A target-facing scan may reveal enough information to locate a tag but too much information about an innocent owner. Privacy is not one dial that can simply be turned down when safety becomes important.
Safety needs controlled linkability and trustworthy evidence
Tag detectability asks whether a potential target can reliably discover that an unfamiliar accessory has been traveling with them over time. This is not the same as noticing one Bluetooth signal. A signal in a café, airport, or crowded train may be a coincidence. Detection becomes meaningful when the system can connect repeated observations, movement, duration, or other context strongly enough to warrant an alert.
The need for controlled linkability appears again. If the system refuses to connect any observations, it cannot recognize persistence. If it exposes a permanent tag handle to every scanner, it may solve the target’s problem by creating a surveillance tool for anyone else. The Tile study describes anti-stalking systems that deliberately make a separated tag easier to link so that a victim’s device can detect it. That design direction accepts a trade-off: the same feature that helps the target may weaken the tag owner’s privacy against other observers. It must therefore be paired with careful access rules and a clear account of who is allowed to perform the linking.
Detection also has a human condition. A system may be able to recognize persistence in principle but fail to protect a person who cannot install the right application, does not know a scan exists, cannot safely inspect a visible phone, or is traveling with a tag hidden in a difficult place. The IETF DULT threat model treats manual scanning, background scanning, alerts from the tag, and activity logs as distinct ways to support detection. It also describes targets with different expertise, resources, expectations of tracking, and access to technological safeguards. A detection algorithm is not a complete safety feature until its result can reach the person who needs it under plausible conditions.
Framing resistance asks whether an attacker can make convincing evidence point to an innocent tag owner. This property is easy to overlook because an identifier can look precise. A scan may return a value associated with an account, yet the value might have been replayed at another location or broadcast by a device pretending to be a legitimate tag. If the system cannot establish that the genuine accessory produced the observation at the claimed time and place, it has an attribution clue, not a reliable proof.
This is where accountability becomes more demanding than identification. Accountability is meant to let a victim, service provider, or appropriate authority identify and punish a responsible party. Framing resistance requires the system to protect an honest party from being falsely implicated. It raises practical questions that an identity check alone does not answer: who collected the observation, how was it authenticated, what did the platform know, who can inspect the record, and how can a disputed result be challenged? The Tile study reports that its Scan and Secure results were spoofable and treats the resulting accountability problem as an open design issue.
The relationships among these properties can be pictured as a path with a deliberate tension at its front:
The arrows do not mean that every system must follow one rigid technical sequence. They show a causal discipline. Privacy limits unnecessary exposure. Detectability gives the target a chance to recognize a threat. Finding and disablement create a way to interrupt it. Evidence integrity makes a later response fairer. Accountability belongs at the end because it relies on the earlier layers; it cannot retroactively supply them.
Why these guarantees pull against one another
The conflict is clearest when a feature serves two legitimate purposes. Tile’s Anti-Theft mode was designed to prevent a thief from scanning a stolen tracker and discarding it. According to the Tile study and the IETF threat model, the mode also prevents the tracker from appearing in the target-facing Scan and Secure results. Tile asks users to verify their identity with government identification and a live photo, and it describes cooperation with law enforcement and a claimed financial penalty for convicted stalkers. Those measures are intended to make hidden use punishable.
But the feature’s first-order effect is still reduced detectability. If the target cannot see the tag through the normal scan, the identity of the person who enabled the mode does not give the target a warning. This is not a minor usability gap. It is a mismatch between the point at which the safeguard operates and the point at which the harm occurs. The tag can be used to generate location information before any investigation or punishment begins.
The study reports a further implementation problem in the tested Tile system: the scanning client sent the observed private identifiers to the server, while the server filtered identifiers associated with Anti-Theft tags from the displayed results. A modified client could reveal what the ordinary interface hid. That result is bounded to the analyzed application and hardware, and it does not prove that every tracker has the same flaw. It does show why a policy label is weaker than a protection enforced at the right boundary. If the system collects an observation before deciding not to show it, “not displayed” is not equivalent to “not detected.”
Privacy creates another necessary limit. A person who finds an unfamiliar tag may need its serial number, help locating it, disabling instructions, or a partially redacted way to contact an owner. They should not automatically receive a full identity and a complete location history. The tag may be lost, carried by a companion, or encountered by coincidence. The DULT model therefore seeks a balance: give a potential target enough information to respond while preserving legitimate owner privacy. Unrestricted disclosure might help one investigation while exposing many innocent users to harassment or surveillance.
False positives and false negatives pull the design in opposite directions as well. A system that alerts on every unfamiliar signal can train people to ignore warnings, especially in shared vehicles or public transportation. A system that waits for very strong evidence may miss a tag during the period when a target most needs help. The DULT draft discusses confidence scoring based on duration of proximity, movement correlation, signal-strength trends, recurrence, hardware identity, and environmental context. It presents these as design considerations, not as validated thresholds. The important point is that detection is a judgment under uncertainty, not a switch that turns a threat into a fact.
Trust settings have the same dual character. Letting a user snooze a family member’s tag can reduce alert fatigue. Letting a shared or trusted tag disappear from future checks can also create a blind spot if an abusive person controls the relationship or if circumstances change. The DULT draft recommends making trust manageable and revalidating it rather than treating it as a permanent exemption. A safeguard must account for the possibility that the authorized relationship itself is the source of risk.
The security properties also fail in different ways when ownership changes. A target’s own tag may be used for surveillance if an attacker gains access to the associated account; the system may suppress an alert because the database sees the attacker as an authorized user. A shared tag may retain old authorization material after a visible sharing relationship ends. These cases do not necessarily look like a rogue accessory to the detection algorithm. They are failures of the trust relationship and its lifecycle. Accountability that records only the first registered owner cannot describe all the parties who could query or influence the system.
A balanced design therefore asks five questions rather than one. Can an outside observer link the tag’s broadcasts? Can the platform read the locations submitted by finders? Can the target receive a meaningful alert without taking an unsafe action? Can the target find, disable, or safely preserve evidence about the tag? Can a later attribution withstand replay, impersonation, account compromise, and a fair challenge? A credible answer to the last question is valuable, but it does not cancel the first four.
The Tile case gives these distinctions operational meaning, while the DULT threat model expands them beyond one implementation. The draft includes multiple tags, modified or impersonated accessories, firmware changes, heterogeneous vendor networks, and GPS trackers because a protection that assumes one conforming Bluetooth tag may fail when the artifact changes. It also includes battery, Bluetooth, operating-system, hardware, accessibility, and connectivity constraints because a property stated on paper may be unavailable on a real device. These are not arguments for abandoning accountability. They are reasons to place it inside a system whose earlier layers already reduce exposure and give the target agency.
The central judgment is now sharper. A safe tracker does not need to make every participant equally powerful. It needs to give each participant only the capabilities required for their role: enough privacy that ordinary observation does not become surveillance, enough controlled linkability that a target can detect persistence, enough assistance to locate and disable a threat, and enough integrity that an accountability process does not punish an innocent owner. Accountability can reinforce those layers. It cannot stand in for them.