How Bluetooth Surveillance Works

Before we dive into Bluetooth surveillance, we'll want to take a look at how Bluetooth itself works and understand what makes the technology traceable. Bluetooth devices use the free 2.4-gigahertzradio frequency band known as ISM, which stands for industrial, scientific and medical devices. The band is unlicensed for low-power use, so headsets and other Bluetooth accessories use very little in the way of batteries. Bluetooth's worldwide availability and low power requirements make it a very popular standard for connecting all kinds of devices, from consumer electronics to business applications to devices on the Internet of Things.

Many of the Bluetooth applications we're most familiar with are short-range uses, such as computer peripherals, wireless headphones and connections to automotive entertainment systems. Bluetooth signals can travel farther, however, even more than a kilometer (three-quarters of a mile).

The most basic security feature on Bluetooth-enabled devices is the ability to go into one of two modes: "discoverable" or "non-discoverable." This information is typically found in the "settings" option of a device's control panel, where you can select whether or not to make your phone or laptop visible to others within the area. If you want to pair a Bluetooth keyboard to your computer, you make both devices discoverable and choose the keyboard in the computer's Bluetooth settings. It will ask you to type in a code displayed onscreen, a security measure designed to verify that you and your computer agree on the correct device to pair.

Simpler devices, such as wireless headphones, don't require a security code when you pair them. Once the two connect, they store the information that identifies the other as a remembered device.

If several Bluetooth devices are set on discoverable mode, they all have the ability to search for and locate each other, so long as they remain within range. Every device has its own address, a unique 48-bit identifier with six bytes of information that might look like this: 01:23:45:67:89.10. The first three bytes (01:23:45) are assigned to the specific manufacturer of the device, while the last three bytes (67:89:10) identify the device itself.

So how could someone track your movement if you left your phone on discoverable? Would they have to follow you around all day long, or is there a simpler way?

Locating several Bluetooth users with a typical mobile phone is relatively simple: You just turn on your phone and see which devices are discoverable in your Bluetooth settings. But you can only monitor the people moving in and out of your Bluetooth's range, which is most likely a 10-meter (33-foot) circle around you. If you wanted to track a specific address, you'd have to visually locate that person's physical device and follow it around all day, which would easily blow your cover. And locating someone else's smartphone doesn't let you listen in on what they're doing or read their email.

But If several Bluetooth-enabled receivers are strategically placed to cover a large area, they can track the positions of any discoverable device, recording and sending any data back to a single address. Each Bluetooth receiver acts like any regular Bluetooth device: It searches for every device within range. If a person walked down a 100-meter-long (328-foot-long) street and each Bluetooth receiver had a range of 10 meters, five receivers with a radius of 20 meters (66 feet) would be needed to track that person's movement. As he walked toward the street, the first receiver would track him for the length of the first 20 meters, the second for the next 20 meters, and so on for the length of the street.

So how have people used this system to track people? One of the earliest uses of Bluetooth positioning and tracking technology is the Aalborg Zoo, the largest zoological garden in Denmark, in 2003. The point of installing the system was not to put the zoo's patrons under surveillance or to see which exhibitions people went to more often. Instead, special "Bluetags" were made available to prevent parents from losing valuable belongings that tend to wander off — their children. A parent could attach a "Bluetag" onto a child, and Bluetooth receivers around the zoo would track the child's movement.

Bluetooth beacons (hardware transmitters) have become commonplace for customers to find their way around retail environments. A shopping mall, for example, could install a Bluetooth surveillance system throughout its entire area to monitor the movements of Bluetooth owners. Although it wouldn't present a perfectly accurate description of a person's movement, the system could create a general map of his path and even compare how long someone stays in a certain area.

For instance, in 2018, Bluetooth reported that the giant Mall of America in Minneapolis was using its technology. "With a Bluetooth beacon infrastructure in place, guests can select their destination on the Mall of America app and pinpoint where they are in the facility. From there, the app can get customers moving in the right direction while providing additional information, such as store hours, estimated time of arrival, and vertical transportation factors like escalators that impact accessibility for shoppers utilizing strollers or wheelchairs," the company wrote.

With this knowledge, store owners could analyze shopper's behavior and change advertisement positions accordingly without anyone ever knowing. Some retailers use this surveillance to enhance services, knowing when a shopper with an appointment has arrived and where they are, even in a busy store.

You may have been using this same technology without realizing it. Personal Bluetooth trackers such as the Tile series and Apple's AirTags are very helpful for finding things you misplace often, such as your keys. An app on your smartphone can tell you where they are, as long as they are near another Bluetooth device that can identify the tracker. But this requires many people to have Bluetooth enabled. If you left your keys at your desk, your work neighbor's phone might be able to tell you right where they are. They're doing a kind of Bluetooth surveillance, and so are you — you've opted into the network of people looking for these trackers and passing on that info to someone who may have lost something important.

During the COVID-19 pandemic, several governments have used Bluetooth technology in tracking devices that citizens download on their phones. In the case of Britain, if someone has tested positive for COVID-19 (and the person agrees), the National Health Service will send them a link where they should fill out the contact information (names, addresses, phone numbers) of anyone they have had contact with. The tracing app will then alert these people and may suggest self-isolation depending on the type of contact. The app also lets users know if they are near someone who has tested positive for COVID-19.

Since many terms related to Bluetooth surveillance use some variation of the Bluetooth brand name, it helps to get a few sorted out. Many refer specifically to attacks on smartphones. One of these is bluesmacking, a denial-of-service attack that sends an overwhelming amount of data traffic to the device in an attempt to shut it down.

Bluejacking, a prank that involves sending fellow Bluetooth users unsolicited text messages, doesn't actually have anything to do with hijacking, even though the name implies it. The term is simply a hybrid of Bluetooth and "ajack," the username of the Malaysian IT who discovered the glitch and spread the news over the internet. Bluejacking is mostly an annoyance, although the technique could be used in a phishing attack to convince someone to share personal information using social engineering.

Bluesnarfing, on the other hand, happens when an attacker reads, changes or copies information from a person's phone, such as a phone book, address book or calendar. More serious infringements of bluesnarfing include taking over someone's phone and using it to make phone calls, send text messages or surf the web.

Bluebugging is an attack designed to install a backdoor on your device. A backdoor is a vulnerability that allows someone else to gain access to your device, like leaving the back door open in your house. A bluebugging attack can be used to gain access to your personal information or for surveillance. Key Negotiation of Bluetooth, or KNOB, exploits the link manager protocol in Bluetooth to set a security key only one byte long on devices before they establish a connection. Someone within range can then crack the one-letter passcode to gain access to information on the phone or to log keystrokes.

Discovered in 2019, the KNOB vulnerability has since been patched. If you've never updated your older Bluetooth devices, you should. Even though Bluetooth tracking is mostly harmless, if you are concerned that it can violate your privacy, you should turn Bluetooth off when you're not using it.