The Third Failure: Evidence Can Be Manufactured

This chapter examines the evidence layer of crowdsourced location-tracking systems. The specific question is whether a scan result tied to an account proves that a real tag was at a particular place and time, and therefore whether it is safe to use that result for punishment. The Tile study shows why the answer can be no: replay and impersonation can make a plausible identifier appear genuine, while legitimate account and key relationships can be abused without any rogue tag being introduced. The IETF DULT threat model widens the diagnosis to attackers, targets, and accessories that do not follow the assumed rules.

A plausible identifier is not proof

The useful security property here is framing resistance. It means that an attacker should not be able to create convincing evidence that points to an innocent tag owner. This is a prerequisite for accountability, not an optional refinement added after an owner has been identified. Accountability asks whether a responsible party can be found and punished. Framing resistance asks whether the observation used to make that judgment is authentic, correctly attributed, and open to a fair challenge.

The distinction matters because a scan result often looks more definite than it is. A scanner hears an advertisement and extracts an identifier. The service matches that identifier to an account or key and returns a result that appears to say, “this person’s tag was here.” But the result may establish only that a value associated with an account was observed. It may not establish that the legitimate hardware emitted the value, that it emitted it at the reported location, or that the person attached to the account controlled the device at that moment.

The Tile study reports two ways its Scan and Secure results can be spoofed. First, a party with access to an authKey can derive the tag’s private identifiers and broadcast them at a chosen location. A scan in that location can then display a false positive even though the legitimate Tile is elsewhere or not present. Second, an active radio adversary can record identifiers from an honest tag and replay them in another place. The apparent result can implicate the owner of the honest tag in conduct that never happened.

These are not merely theoretical objections to a legal process. They break the connection between the physical event and the account label before an investigator ever sees the record. The study also identifies Tile’s server as capable of framing a user because the server holds the authKey for Tile devices. A platform that can generate or validate the identifiers has unusual power over the evidence. That does not prove that the platform will misuse it, but it means that a claim of accountability must specify how the platform’s authority is constrained and audited.

The result is a false sense of precision. An identifier can be unique within the system and still be transferable, replayable, or reproducible. A scan can be technically correct about what its radio received and still be wrong about who was carrying a tag or where the legitimate device was. Treating the first statement as the second turns an observation into an accusation without an evidentiary bridge.