Siri, Find My Ex

Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation, argues that for survivors of intimate partner abuse, surveillance often begins at home. Abusers typically have physical access to a victim's devices and intimate knowledge of their routines. She explains how commercial stalkerware hides on phones and how abusers obtain Apple ID credentials, often by coercion, so that stalkerware services can pull iCloud backup data and show it in a web portal.

She reviews Apple's iCloud restrictions and two-factor authentication, which block most backup retrieval, and cites a test of popular stalkerware products where few could pull data from iCloud. Older approaches such as WebWatcher, which depends on local iTunes Wi-Fi sync, are easier to detect. Galperin praises Apple's guide for reviewing device and account settings. The central focus is the AirTag. Its Find My network turns nearby iPhones into a tracking mesh, yet the anti-stalking safeguards are weak: an alert sound that is easily muffled, no Android alert at launch, and a reset timer that dropped from three days to one, which an abuser living with a victim can easily keep resetting.

She closes by describing IBM's principles for building products resistant to abuse: diverse teams, privacy and user control, reliable activity logs, strong security, and intuitive design. Her point is that Apple's blind spot was users outside its ecosystem. For practitioners, the takeaways are to check device and account access with people at risk, and to test new products against the abuse case, especially as connected devices spread.