How hackers are using Bluetooth to track police activity

Cops use all sorts of tech to track individuals — facial recognition comes to mind, as does mimicking cell phone towers to get pings or mobile data tracking. But some people are finding ways to use technology to listen back. Bluetooth signals might reveal where police are and when they are and when devices like body cams or Tasers are activated.

“It’s be really weird if you had your volume turned all the way up and all of your devices are just screaming, right?,” Alan “Nullagent” Meekins, cofounder of Bluetooth tracking platform RFParty, told Engadget. “But that’s really what you’re doing in these wireless spectrums, they’re just constantly shouting.”

All Bluetooth devices have a unique 64-bit identifier called a MAC address. Often a chunk of that address is composed of an Organizational Unique Identifier (OUI); essentially, it's a way for a device to say who it's made by. A look at the IoT devices that are used by many police forces led Meekins and his cofounder Roger “RekcahDam” Hicks to Axon, a company best known for Tasers. Modern police kits are overflowing with Bluetooth-enabled tech (often also made by Axon), from Tasers and body cams, to in-vehicle laptops. Even the gun holsters supplied to some cops send a Bluetooth ping when a sidearm is unholstered. By just reading company documentation, they were able to find the OUI.

A Bluetooth identifier seems trivial, but it could reveal a lot of information about where cops are and what they’re up to, like when their body cams are recording or they turn on the sirens to respond to a call. “There's the signal that is sent when a police officer basically thinks something's recording worthy, if that's the case, people can document that, detect that and there won't be any question whether or not hey, there's a body cam or there wasn't body cam,” Meekins told Engadget. It’s a way to potentially determine whether certain evidence exists so that it can be produced more quickly in a records request — something police often "slow walk" Meekins said.

As people run RFParty, the app will collect historical data. In the case of body cams, if the device begins recording, it typically sends a Bluetooth signal out to other devices. If a cop turns on a camera (or Taser or other IoT device), someone running the app could collect this data to record details about the incident.

It's similar to radio waves: If you have the equipment to get past the music and news stations into the bands used by emergency response personnel (and once you know the language and codes to make sense of whats being broadcast there), you can listen in on cop radios to hear about arrests and where police might be patrolling.

An Axon spokesperson confirmed that the company uses Bluetooth capabilities for pairing in-car systems with mobile apps, and for its camera recording devices. Using Bluetooth connectivity helps with "ensuring that incidents are captured and that devices are connected to maximize visibility," the spokesperson said. "Axon is working on additional measures and improvements to address concerns of tracking our devices over time. Specifically, rotation of unique BLE device addresses (known as MAC addresses) that can specifically identify our devices, and removing the need for including serial numbers in Bluetooth broadcasts to reduce the ability to track a specific device over time."

No features in RFParty are designed specifically to track police, it’s a general Bluetooth scanning service, similar to existing services like Wigle.net or nRF Connect. But some of what's displayed on its maps includes common Internet of Things devices used by police, including body cams. Anecdotally, users are already using RFParty for police tracking purposes.

“We have all this technology that there's certain people who understand it, and can exploit it. But you know, most people can't and I think there needs to be more knowledge given out,” Hicks told Engadget. In a talk at DefCon 31 this past August, Meekins showed what the Axon OUI is and privately provided a live demo to me of how a knowledgeable RFParty user could leverage that information.

Of course, having that historical data handy for accountability purposes requires people to be running RFParty in the vicinity of potential abuses of police power, and it's unlikely the app will become popular on a scale where that data will be available for almost any such incident. Still, when cops have the power to use technology against nearly anyone, it's interesting to see the tables turned.