Paul Haskell-Dowland, Edith Cowan University

The ABC has revealed a major cybersecurity flaw in Bluetooth-enabled police tasers and body-worn cameras that means officers can be tracked.

The exposé shows how anyone can use simple software tools to detect the presence of a police officer carrying one of these pieces of equipment. Not only can you detect their presence, but it is possible to track their location over time – representing a potential threat, especially to those operating covertly.

But if police equipment can be tracked via Bluetooth, what about your phone, watch and headphones which use the same technology? Can they also be used to track you using simple software tools?

The short answer is yes. The long answer is a bit more complicated.

 

How does Bluetooth work?

Bluetooth is a short-range wireless communication technology that enables devices such as phones and speakers to connect with each other.

To effectively communicate, Bluetooth devices have a unique address – a bit like a phone number. These addresses are represented as 0s and 1s in their digital form. But they are typically viewed in hexadecimal, using the digits 0–9 and letters A–F (for example “00:25:DF:68:5D:1F”).

Each device has a distinct address. But these addresses are distributed to manufacturers in blocks, in a similar way that our phone numbers are grouped by geography.

As such, it’s possible to identify a Bluetooth device’s manufacturer by monitoring and detecting the signals being broadcast (sometimes called sniffing). This sniffing is usually over a short distance, but can be undertaken over longer distances with the right equipment.

A Bluetooth device address typically includes two parts: the manufacturer’s code and a unique device code. Once you know the manufacturer’s code you can easily identify devices they make by simply listening for their Bluetooth traffic.

How are police being tracked?

Police officers across Australia are issued with tasers and body-worn cameras manufactured by Axon, a US-based weapons and technology company.

These devices use Bluetooth as part of their operation. But a flaw allows anyone within a few hundred metres to be able to detect the presence of Axon technology. By listening to Bluetooth communications and filtering for the known manufacturer’s code, anyone can “detect” an officer carrying the Axon products. With enough monitoring stations, you can track officers across a geographical area.

At first glance it may seem odd that Bluetooth should feature on a taser. But there is a genuine benefit.

According to Axon, sensors integrated in the Axon product range can generate alerts over Bluetooth. For example, removing a gun from a holster or enabling a taser can alert nearby body-worn cameras to start recording.

While the general public has only just learned of the vulnerabilities in Axon’s equipment, police and some in academic and tech circles have known about them for longer. The ABC reports, for example, that Victoria Police were notified in 2024.

A Facebook page and a couple of GitHub repositories where code and files are stored and publicly available (for example PoliceDetector and JudCrandall) have been active for some time, with computer code available since September 2023.

While Axon indicates that devices can have firmware upgrades, it’s not clear if this extends to Bluetooth functionality. As a highly integrated device, the Bluetooth functionality may be hard-coded into the technology and may not be upgradeable.

So it’s possible the only solution would be to replace the devices or find some mechanism to disable the Bluetooth functionality – something that may reduce safety and accountability.

So, can any Bluetooth device be tracked?

In principle, yes.

Any device that emits a radio-frequency signal (such as WiFi, Bluetooth or 5G) can be detected with appropriate hardware. Unique identifiers are used for many kinds of wireless communication.

If you build up a list of these identifiers, you have the ability to track devices. And if you can link devices to people, you can track people.

If you are using wireless communications you can certainly be detected. But most modern devices such as iPhones have privacy modes that create random addresses. This ensures that most devices aren’t trackable in the same way the Axon devices are.

It is, however, possible that less sophisticated devices (such as the cheap earbuds you bought online) will not support random addressing.

While this means they are likely trackable, walking around with a mobile phone continuously transmitting and receiving is already ensuring you are very visible.

Unless you go completely offline, you can’t completely eliminate the risk of being tracked. If you are worried about being tracked, one step you can take is turning off WiFi and Bluetooth when not in use.

But remember there are many other ways we can be surveilled in our modern lives.

Paul Haskell-Dowland, Professor of Cyber Security Practice, Edith Cowan University

This article is republished from The Conversation under a Creative Commons license. Read the original article.