The Body, the Car, and the Door

No device in this book’s account has produced a more concentrated legal and criminal record than a tracker the size of a coin, sold for about thirty dollars to help someone find a misplaced wallet.

Apple’s AirTags are the subject of an active class-action docket, Hughes v. Apple, filed in December 2022 by two women alleging Apple released the product despite internal warnings about stalking misuse and failed to build in adequate safeguards before launch; the case has grown to more than three dozen plaintiffs.¹ In March 2024, a federal judge denied Apple’s motion to dismiss in part, allowing three California plaintiffs’ negligence and product-liability claims to proceed on the theory that AirTag’s safety-feature failures were directly tied to their stalking injuries; class certification was later denied because the individualized nature of each incident made a single class impractical, and more than thirty individual lawsuits are now proceeding separately against the company.² An active docket still generating new filings years after the original complaint reflects a recurring pattern, not a single litigated incident.

The criminal record behind that docket is built from real, named cases. A man in Indiana County, Pennsylvania, was arrested in January 2025 after allegedly tracking his ex-girlfriend’s car with an AirTag; she was alerted by her own iPhone that an unknown tracker was traveling with her.³ A Pennsylvania man was charged in April 2025 with allegedly duct-taping an AirTag to a victim’s car.⁴ In Tulsa, Oklahoma, investigators logged a cluster of women who found AirTags planted to track them.⁵ And in the most severe case the courts have actually resolved, Gaylyn Morris hid an AirTag in the back seat of Andre Smith’s car in June 2022, tracked him to a bar outside Indianapolis, and ran him over twice in the parking lot; he died of traumatic asphyxia. A Marion County jury acquitted her of murder and convicted her of voluntary manslaughter, accepting that she had killed in sudden heat rather than by design, and she was sentenced to eighteen years. Smith’s mother is among those now suing Apple.⁶ A Vice investigation obtained police records from eight departments documenting a hundred fifty AirTag-related cases over an eight-month span, fifty of them specifically involving women who received a notification that an unknown tracker was traveling with them. Vice’s own reporting characterized this as “just the tip of the iceberg,” since departments willing to respond to a records request are not a random or complete sample of what’s actually happening.⁷ A related piece of reporting, “The Legal System Is Completely Unprepared for Apple AirTag Stalking,” documents that many jurisdictions’ stalking and harassment statutes were never written with covert Bluetooth trackers in mind, producing real prosecutorial gaps even where police recognize the pattern.⁸

The industry’s response reads as its own form of confirmation: companies do not build dedicated anti-stalking infrastructure for products that pose no real risk. Apple published a direct statement in February 2022 acknowledging the problem and describing new safeguards — unwanted- tracking alerts when an unregistered AirTag travels with a phone for an extended period, a precision-finding tool to locate the specific device, and an audible chirp on trackers separated from their owner.⁹ More tellingly still, Apple and Google, direct competitors, jointly published an industry-wide technical standard in 2023 called Detecting Unwanted Location Trackers, rolled out across both Android and iOS.¹⁰ Two competing platforms building a shared standard is stronger evidence that the risk is industry-wide, not an Apple-specific defect.

A fitness tracker records something no other device here captures: a person’s own body, continuously, whether or not they’re thinking about being tracked. That record has, in one concluded case, done what no smart speaker’s contested legal fight has managed — decided a murder trial outright.

Connie Dabate was killed in her family’s Connecticut home on December 23, 2015. Her husband, Richard, told police a masked intruder had broken in, killed her, and tied him to a chair; investigators found him with superficial knife wounds and zip-tied at one arm and leg. Connie’s Fitbit data told a different story: it showed her still moving inside the house at 10:05 in the morning, a full hour after the time her husband’s account placed her death. That contradiction, timestamped movement data against a suspect’s own sworn statement, became the central evidence in the case. Richard Dabate was convicted of murder, tampering with evidence, and making false statements to police in May 2022, sentenced to sixty-five years, with prosecutors arguing a motive built on a years-long affair with another woman who was pregnant at the time of the killing. Connecticut’s Supreme Court upheld the conviction on appeal despite finding some prosecutorial improprieties along the way¹¹ — meaning this case is as fully and finally adjudicated as any this book has examined. It is this project’s clearest instance of reconstruction succeeding, in an actual courtroom, over belief.

A different mechanic shows what happens when individually anonymous data becomes dangerous only in aggregate. In early 2018, an Australian researcher noticed jogging routes glowing on the fitness app Strava’s public heatmap in the middle of the Syrian desert — precisely where American and allied military bases were located. Journalists confirmed that the aggregated, ostensibly anonymized fitness data was exposing base perimeters, supply routes, patrol paths, and the daily movement patterns of soldiers and contractors across Iraq, Afghanistan, and Syria. The U.S. Department of Defense launched a formal review, acknowledging that personal fitness-tracker data could genuinely endanger military operations, and Strava responded by restricting street-level heatmap detail to registered users only.¹² No single user’s data caused this; the risk existed only once enough individually anonymized routes were stacked together — a distinction worth carrying into any ordinary use of a public fitness app by someone trying to keep an address or daily routine private from one specific person. Anonymized and private are not the same guarantee, and this is the one fully documented, government-acknowledged case of it.

A third mechanic shows the same lesson at the level of a simple default setting. In 2011, Fitbit’s manual activity log let users record any physical activity, including sexual activity, categorized by intensity from “passive, light effort” to “active and vigorous” — and new profiles defaulted to publicly searchable, discoverable through ordinary search engines. Most users never checked or changed this setting. A tech entrepreneur discovered that summer that hundreds of users’ sexual-activity logs were indexed and searchable on Google, Yahoo, and Bing. Fitbit’s response was direct: it had the indexed data delisted, changed the default for new users to private, and removed sexual activity as a trackable category.¹³ It is the same gap this book named in a smart television’s disclosed-but-unread privacy policy: a setting existed, was within the user’s control, and still produced a real, publicly reported privacy failure, because almost no one thought to check it.

Every device in this chapter assumes, implicitly, that the lock on the door itself is at least reliable. The last mechanic is the discovery that this assumption does not always hold — sometimes in the most literal sense.

A researcher presenting at DEF CON’s twenty-eighth conference disclosed a flaw in August smart locks: when an owner revokes a guest’s access through the app, the guest can continue locking and unlocking the door as though nothing had changed, until the owner’s own device next communicates directly with the lock. The revocation takes effect only locally, not immediately, and not remotely.¹⁴ It is the literal scenario this book’s ownership-model material has been building toward across connected cars, hubs, and cameras: a person believes, in good faith, that they have removed someone’s access after a relationship ends, and the removal silently fails at the technical level while the app’s own interface reports success. Whether this particular flaw has since been patched matters less than the class of failure it demonstrates — an interface reporting, in good faith, a revocation the hardware has not yet honored — because specific products age out of any list like this one, and the class survives every patch cycle. The durable question for a reader is not whether the August lock was fixed but whether anything now standing between them and a door has been tested for exactly this gap between what the app says and what the mechanism does. Two further vulnerabilities in the same product line compound the concern: one security researcher found the August Smart Lock Pro transmitted its WiFi credentials completely unencrypted, giving anyone within range full access to the home network, not merely the lock;¹⁵ another documented that intercepting the Bluetooth pairing handshake lets a nearby device unlock the door stealthily, entirely without the owner’s knowledge.¹⁶

A structurally distinct pattern involves not an intimate partner but a landlord. The Electronic Frontier Foundation documented in 2023 that smart locks are increasingly installed in rental units, often without a tenant’s permission, creating a standing stream of entry-log location data accessible to the landlord and sometimes to law enforcement or the lock vendor — and, critically, letting a landlord lock a tenant out instantly and without notice, a capability an ordinary deadbolt has never had.¹⁷ In New York City, tenants forced a settlement in 2019 after a landlord attempted to require smart-lock use building-wide; the settlement required the landlord to offer tenants a physical-key alternative, and the lock vendor involved subsequently changed its own privacy policy to remove references to marketing use and collection of tenants’ location data.¹⁸ A separate case in a Massachusetts housing court involved a tenant alleging a smart lock box had been installed on his unit without permission, and that a subsequent eviction attempt was retaliation for his demand that the device be disconnected.¹⁹ This is the same ownership-model problem, its asymmetry now made structural rather than merely relational: a tenant living behind someone else’s smart lock has, by design, less standing over the device securing his own front door than the person who installed it.

A final, quieter failure mode involves no misuse of legitimate access at all — only a company’s own solvency and competence, which a mechanical lock has never once depended on. In August 2017, a botched remote firmware update from the lock manufacturer LockState disabled smart-code access for an estimated five hundred customers at once, locking them out of the smart-entry function of their own doors; the failure hit Airbnb hosts particularly hard, some of whom scrambled to deliver physical keys to guests who had already checked in.²⁰ A well-funded, high-profile smart- lock startup called Otto suspended operations in December 2017 before shipping a single unit to customers who had pre-ordered seven-hundred-dollar locks, after an acquisition meant to rescue the company collapsed on the day it was to close.²¹ Neither case involves a person misusing access they were never meant to have. Both demonstrate that a smart lock’s security depends on a company remaining solvent and competent indefinitely — a dependency the humblest mechanical deadbolt has never carried, and one worth weighing against whatever convenience a smart version of the same object provides.

Every mechanic in this chapter so far weaponizes a device the target owns. The last one weaponizes the system built to protect them, and needs no device in the home at all. “Swatting” is the placing of a false emergency report — a hostage, a shooting, a bomb — against a target’s address, so that a heavily armed police unit is dispatched to break down their door expecting lethal violence. On December 28, 2017, a swatter named Tyler Barriss, enlisted over a dispute about an online video game, phoned in a fake hostage situation at a Wichita address; officers arriving at the door shot and killed Andrew Finch, a twenty-eight-year-old man who had nothing to do with the dispute and no idea why armed police were outside his home. Barriss was sentenced to twenty years, the longest term yet imposed for the practice.²² The address, the telephone network, and the emergency response all functioned exactly as designed; the attack is simply aiming that infrastructure at a chosen person from a distance, the operator’s hand nowhere near the door the force comes through.

Across all of it, though, this is the layer of the book that has produced the most convictions, not the fewest. An AirTag carries a registration tying it to an Apple ID; a victim’s own phone timestamps the moment it was detected; a Fitbit outlasted the man who invented an intruder to explain his wife’s death; even Barriss, calling from another state, was traced through the network he used and sentenced to twenty years.