AKRON, Ohio — The alarm startled Kar'mell Triplett.
"I was so scared," the 21-year-old Akron woman remembered. "I can't even describe it. I was speechless."
Looking down at her iPhone, she learned that an AirTag — the Apple company's tiny tracking device — was somehow monitoring her every move as she drove her Chevrolet Malibu in Akron last October. But who, and where. and most importantly, why?
"That someone had that much power over my life that I had no idea about, I was scared," Triplett told 3News Investigates.
Startled by the sudden tracking alert, she drove straight to the Akron Police Department. Officers combed her car, determined to locate the coin-sized AirTag tile.
Eventually, an officer found the device, concealed in a plastic sandwich bag and secretly attached to the inside of her car's rear bumper with a strong magnet. Triplett believes the AirTag was placed on her car by a disgruntled former boyfriend. It had been tracking her movements for 24 hours.
"You can't just track people without their knowledge," she asserted. "That's not legal."
But to her surprise, it may, in fact, be perfectly legal under existing Ohio law.
The Apple AirTag — which is slightly larger than the size of quarter — uses Bluetooth technology, relying on the one-billion iPhones worldwide sharing location data to form Apple's Find My network. The wide reach and their Bluetooth connectivity to create accurate and long-range tracking make AirTags especially more powerful than competitors' devices, like Tile.
They're marketed to help people quickly and easily find lost items, such as keys or purses and wallets, even pets. However, increasingly across the U.S., the AirTags are being used by people tracking other people. These cases are raising concerns about stalking, and also exposing shortcomings in state laws that have failed to stay in step with ever-changing technologies.
In Triplett's case, Akron police did not originally pursue an investigation into the Oct. 29 discovery. It was only after 3News inquired last week that police said the incident has been referred to detectives. Summit County Prosecutor Sherri Bevan Walsh said Ohio law on stalking and menacing is murky in AirTag tracking cases.
"Typically, you have to show a pattern of behavior, so you usually need to show two or more instances of stalking behaviors," Walsh explained. When asked if that means a stalker can get away with one incident, she conceded that prosecuting a menacing by stalking charge can be difficult.
"I don't think the intent is ever that we want to allow someone to do it once, but not more than once," she said.
Following our inquiry, Walsh's criminal division chief researched and reviewed whether secretly placing an electronic tracking device on someone else constitutes a pattern of conduct under the menacing by stalking statute. In an internal department memorandum, the conclusion was that "it is still uncertain."
Meanwhile, Ohio's 8th District Court of Appeals ruled in 2018 that such tracking does not amount to invasion of privacy for civil litigation in Ohio. The court reasoned that secretly attaching a GPS tracking device on a person's car and tracking their movements was no different than a citizen watching a car drive down a public road.
A 3News Investigates analysis found at least 19 states with specific laws against electronic tracking, but not Ohio. As a result, victim rights advocates want state lawmakers to update the Ohio Revised Code to ensure some protection from unwanted monitoring or tracking.
"It's hard, and it's hard to keep up with," Megan Gergen, a domestic violence victims advocate for the Journey Center for Safety and Healing, told us. "But it would be really helpful to have some laws that target more specifically."
Ohio Attorney General Dave Yost agreed that the state's laws need to evolve with new technology. "It's true that there is no law [in Ohio] that is right on point," he said. "I've got my folks researching this right now to see if this is something that needs consideration by the General Assembly, or whether we can use existing laws as protection," said Yost.
News reports in several U.S. cities have identified myriad AirTag tracking cases involving unsuspecting victims. In response to these stalking reports, Apple now sends a notification if an unknown AirTag is moving with you for 8 to 24 hours. The company has also issued guidance to law enforcement agencies on how to scan an AirTag for its serial number in order to find the owner of the device.
An Apple spokesperson released the following statement in response to 3News Investigates findings:
"We take customer safety very seriously and are committed to AirTag’s privacy and security. AirTag is designed with a set of proactive features to discourage unwanted tracking — a first in the industry — that both inform users if an unknown AirTag might be with them, and deter bad actors from using an AirTag for nefarious purposes. If users ever feel their safety is at risk, they are encouraged to contact local law enforcement who can work with Apple to provide any available information about the unknown AirTag."
The spokesperson added that paired AirTags are associated with an Apple ID, and that account information can be provided to law enforcement with a valid request.
If you find an unknown AirTag, you can scan the device to learn more about it. Tap the white back of the AirTag to the top of your iPhone, to pull up the serial number along with instructions on how to disable it. To disable it right away, simply push down on the metal circular plate with two fingers, twist counter-clockwise, and remove the battery. Then let police know what you found. Find out more from Apple here.
For Android users, Apple released a free app on the Google Play Store called Tracker Detect that will scan for any unwanted AirTags, however, you have to launch the app every time you think there might be an unknown device nearby.
3News Investigator Lynna Lai let a coworker track her movements with an AirTag to see how Apple's alert system worked. An iPhone 13 in her home received a safety notification in 3.5 hours -- far quicker than Apple's 8 to 24-hour window. However an iPhone 8 that traveled everywhere the AirTag went, received a safety alert after 58 hours. The device did chime during the time for about 15 seconds, but the sound was not very loud.
Cybersecurity experts are now warning of a troubling new trend. "Silent" AirTags are now being sold online.
"The cybersecurity community went insane," said Meredith Kasper, from Hurricane Labs, a cybersecurity firm located in Independence. The silent AirTags are being modified so that they don't make a sound.
"[Sellers] wanted to create an Airtag that wouldn't notify, or wouldn't play a sound if it were on a pet's collar because that would stress out the animal," said Kasper. "But the red flag was raised by saying, 'Hey - this is perfect for someone who wants to use an Airtag for nefarious purposes,'" she said.
Last week in response to increasing publicity of AirTags being used for nefarious purposes, the company announced an upcoming software update to make the devices safer, including a warning upon first use, quicker safety notifications, and a louder chime. The company did not give a release date for the update.
But until laws and law enforcement catch up to new technology, your knowledge is perhaps, your most powerful tool.
"It is so scary -- the power that the Airtag has, to completely devastate someone's life," said Triplett.