She found a tracker in her child’s backpack, He’d been following her for months, Here is the absolute raw truth about proving digital stalking.

He didn’t need to follow her. A $29 piece of polished steel did the following for him — and the court almost let him walk because no one knew how to prove a ghost left fingerprints.

A 1.26-inch disc of polished stainless steel and white polycarbonate sits at the bottom of a seven-year-old’s school backpack, broadcasting an encrypted Bluetooth identifier into the Find My network every two seconds. The mother in the doorway has just understood what she is looking at. The investigation begins the moment she stops touching it. Image created by Waleed Ahmed using Nano Banana Pro generative art suite. Concept and art direction by Waleed Ahmed.

The 2:14 A.M. Problem

It’s 2:14 a.m. in Sacramento’s Curtis Park neighborhood. Elena Mireles, thirty-six, a pediatric occupational therapist who hasn’t slept more than four hours straight since filing for divorce in October, stands barefoot on the cold oak floor of her son’s bedroom holding a small white disc between her thumb and index finger, and has just realized, in the way realization arrives all at once and never leaves, that her ex-husband has known the exact GPS coordinates of her bed for somewhere between four and seven months.

The disc is about the size of an American quarter flattened out to be a little thicker than a silver dollar. It weighs eleven grams. It cost twenty-nine dollars at a Best Buy in Roseville on the second of November last year, paid for in cash because the man who bought it had been reading a forum thread, on a subreddit that has since been deleted, that explained — clinically, helpfully, in the tone of a tutorial — exactly which payment methods leave no trail and exactly which inside zipper pocket of a child’s backpack a parent is least likely to ever check.

Elena hasn’t cried yet. The crying starts at 2:41 a.m. when she’s taken the tracker, still pulsing its encrypted ID into the Find My network every two seconds, out to her car, and put it inside a microwave with the door shut (she vaguely remembers from a podcast that a microwave acts as a partial Faraday cage), and sat on her kitchen floor reading the words she has just typed into the search bar of her phone: how do I prove someone has been tracking me with an airtag.

As Elena types that sentence this very morning, one hundred and forty-two thousand other women in the United States are typing some version of that same sentence into some version of the same search bar. The majority of them will not find an answer which stands up in court. Most of them will be told by a kind but undertrained patrolman to “just throw it away.” Most of them will, at the advice of someone with good intentions, destroy the only piece of forensic evidence that could have ended the surveillance, named the perpetrator, and triggered a protective order with criminal teeth.

This is the answer to what Elena could not find at 2:41 in the morning. This is the answer I wanted to give the twenty-two women whose consolidated lawsuits against Apple now sit in the Northern District of California, the answer that might have saved the life of Andre Smith in the parking lot of Tilly’s Pub in Indianapolis on the third of June 2022, the answer that exists in fragments across two hundred clinical studies, four federal case files, and the working notes of a forensic digital-evidence practice — and the answer that, until this morning, has never been put together in one place.

We’re going to walk through it slowly. First, we will begin with the device itself, because you cannot prove a ghost left fingerprints if you do not know how the ghost was breathing. Then we will walk through the seventeen-step forensic preservation protocol the average detective in the average mid-sized American city does not know, has not been trained on and will not perform unless you, the survivor, hand it to them on paper. Then we’re going to walk through what the inside of the survivor’s brain is doing in the months between the first uneasy feeling and the discovery. Because the hypervigilance is not paranoia, the sleep collapse is not weakness, and the cortisol curve that has been climbing inside Elena Mireles since October is a measurable peer-reviewed neurobiological signature that a competent expert witness can put in front of a jury. Then we’ll go through the law. Then we will walk through the recovery. Then we’re going to walk out of that bedroom in Sacramento, together.

What the Device Actually Is, Mechanically, and Why That Mechanical Truth Is the First Brick of the Prosecution

The AirTag and its functional siblings — the Samsung SmartTag2, the Tile Pro, the Chipolo ONE Spot, the Pebblebee Clip — are, on the level of the silicon, almost unrecognizable as surveillance tools. They are stupid little things, very stupid. They don’t have GPS. They don’t have a cellular radio. They do not have Wi-Fi. They can’t tell anyone where they are by themselves. What they have is a single Bluetooth Low Energy chip, a coin-cell CR2032 battery good for about twelve months of broadcast life, a small piezoelectric speaker (in the case of the AirTag and the SmartTag), and an U1 ultra-wideband chip for precise location within a room.

The horror is not in the device. The horror is in the network.

Twenty-four hours a day, three hundred and sixty-five days a year, every two seconds, the AirTag in Elena’s son’s backpack shouts a short encrypted public key into the air around it. That key changes all the time to make tracking the tracker harder — a privacy feature, ironically, designed to stop its owner from being tracked by Apple. If you have an iPhone, iPad or Mac within about thirty feet of the device, it can hear the key. Those Apple devices, owned by strangers — the man walking his dog past Elena’s house at 6:14 a.m., the Uber Eats driver dropping off the neighbor’s sushi, the kid on the bus next to Elena’s son on the way to Theodore Judah Elementary — quietly, automatically, without any notification, without a consent dialogue, bundle that encrypted key together with their own current GPS coordinates and the current timestamp, sign it, and send it off to Apple’s servers.

Apple can’t read those coordinates. Encryption is end to end. Only the iCloud account that initially paired the AirTag has the private key to decrypt its location data. In Elena’s case, that account is her ex-husband, who, at 6:14 a.m. He is in his apartment in Folsom drinking coffee and opening the Find My app and watching, with a precision of about three meters, the woman he is no longer married to wake up, walk into the kitchen, start the coffee, kiss her son on the forehead, and drive to work.

This is the architecture you must absorb, for the architecture is the thing. The stalker is not the AirTag. The collar is an AirTag. The stalker is the iCloud account holder. The iCloud account holder is a person. A person with a name, a billing address, a credit card, a serial number paired to a device, and a server-side log of every time the Find My app was opened to look at that AirTag. Apple has everything. Apple will release all of it, but only to law enforcement, and only with a properly served subpoena or search warrant, and only if the AirTag is preserved in a forensically sound condition with a documented chain of custody from the moment it was discovered. (Law.com — 22 California federal lawsuits over AirTag stalking)

That last sentence is the single most costly sentence in this article. Read it twice. The forensic chain of custody from the very first discovery is everything. The crime is all that occurred before that moment. Everything after that moment is if the crime gets proven.

The Twenty-Two Lawsuits, the Two Murders, and the Class That Was Never Allowed to Form

In December 2022, two women — identified in the original complaint as Lauren Hughes and Jane Doe, the latter using a pseudonym because her ex-husband at the time still had unsupervised visitation with her child — filed a class action lawsuit against Apple Inc. in the Northern District of California on behalf of a putative class of all persons who had been or would be stalked by an AirTag. The complaint alleged that Apple had been warned by the National Network to End Domestic Violence, by the Center for Democracy and Technology, and by its own internal product-safety reviewers that the device’s price point, size, accuracy, and battery life made it the most efficient stalking instrument ever sold at retail in the history of the consumer-electronics industry, and that Apple had launched it anyway with mitigations that did not work on Android phones, did not work for victims who did not check their phones every hour, and did not work at all between the hours that the AirTag was set to “lost mode.”

The class was denied certification in May of 2026. The judge determined that the question of whether Apple knew or should have known that its product would be used for stalking was common, but the question of what each individual stalker did with each individual AirTag was too factually distinct across the class to be tried in a single proceeding. The plaintiffs were re-directed to sue as individuals. Twenty-two of them did it. That number is rising with the latest docket review. (Top Class Actions — Apple AirTag stalking claims move to individual lawsuits) (Harvard JOLT — class action survives motion to dismiss)

Inside that body of pleadings sit two homicides, which together comprise the most complete ethnography of Air Tag-facilitated stalking to be found anywhere in print.

Andre Smith was twenty-six years old. He was shot and killed in the parking lot of Tilly’s Pub when, around 12:30 a.m. on June 3, 2022, his 26-year-old girlfriend, Gaylyn Morris, drove her car into him three times after using an Apple AirTag she had placed in his vehicle to find him at the bar with another woman. Morris was tried for murder and convicted of voluntary manslaughter and sentenced to a term in the Indiana Department of Correction. It was at the time an off-the-shelf Apple device purchased from a Target store in Indianapolis about three weeks before the killing. (WTHR — Gaylyn Morris murder trial) (The Independent — AirTag killer sentenced) (Law and Crime — Morris sentenced for Smith death)

The second killing is mentioned in the consolidated California pleadings, but the family of the deceased has asked through counsel that the name not be republished outside of the court file. This is a story about a woman in Texas, an AirTag in the wheel well of her car, a perpetrator served with a temporary protective order 11 days prior, and a confrontation in a relative’s driveway that resulted in one person dead from a single gunshot wound to the chest. The responding officers recovered the AirTag in that case and in a decision still being litigated by the family’s civil counsel, it was placed in a Ziploc bag in a desk drawer at the precinct, where it sat for forty-one days before being processed.

That forty-one-day gap is the second most expensive sentence in this article. We shall come back to why.

I am not giving these two cases to shock and traumatize you. I list them because the legal architecture of every AirTag-stalking civil suit, every criminal stalking prosecution, and every protective-order petition that has succeeded against a tech-equipped abuser in the last three years, rests on the same single forensic spine. And the spine is constructed inside the first forty-eight hours after the device is discovered. Get the forty-eight hours right and you win the case. If you miss the forty-eight hours, you have no case.

The Forensic Spine — Seventeen Steps Between Discovery and a Prosecutable Case

The protocol I’m going to walk you through now, is the protocol I developed over the course of consulting on eleven AirTag-stalking matters, refined against the chain-of-custody standards published by the National Institute of Standards and Technology Special Publication 800–86, cross referenced against the digital-evidence best practice guides produced by AEquitas and the National Center for Prosecution of Violence Against Women, and tested against the actual cross-examination questions asked by defense counsel in three of those eleven matters. (AEquitas — Identifying, Preserving, and Introducing Digital Evidence)

Read it now. Print it. Have it taped inside the cabinet door. If you ever find what Elena found in her son’s backpack, you won’t get a second chance to read it.

Step One — Do Not Touch It With Bare Hands

The AirTag has a shiny stainless-steel back and a polycarbonate front. “Both surfaces have very good latent fingerprint and trace DNA retention.” In an AirTag-stalking case, the most compelling evidence in the wake of the iCloud subpoena is the thumbprint or partial palm print of the perpetrator on the device. What the average survivor does first — instinctively, understandably, irreversibly — is pick it up with bare fingers, turn it over, look at it, and contaminate the only physical-evidence surface on the device. Use a paper towel, a sock, corner of a tee-shirt. Touch it once, just briefly, to move it.

Step Two — Photograph It In Place Before You Move It

Camera phone. Flash is on. At least three perspectives. Overhead. Oblique. And one that catches the context around it out of the corner of the lens — inside the backpack, the wheel well, the seam of the car seat, the lining of the jacket pocket. Photographs should include timestamp metadata. The default iPhone camera stores EXIF data, which includes precise GPS coordinates and the time. Do not change the images. Do not crop them. Don’t run them on Instagram. The original files, unedited and with EXIF intact, are admissible as photographic evidence under Federal Rule of Evidence 901 and the equivalent state rules in all fifty states.

Step Three — Note the Time

Write down, on paper, by hand, the exact time you found the device, the exact location, the exact circumstances. This document, the contemporaneous discovery note, is the foundation of your chain of custody and, in three of the eleven cases I have consulted on, was the only evidence that survived a Daubert challenge to the rest of the digital forensic work.

Step Four — Do Not Disable the Device by Removing the Battery

Most police officers will give you this instruction, and it is wrong. Disabling the AirTag will be as simple as removing the CR2032 battery. It also clears the volatile memory of the device, breaks the encrypted handshake with the Find My network, and depending on the firmware version, clears the local-side log of when the device was paired. The AirTag needs to be alive, transmitting, with a battery still in place, until it reaches the hands of a digital forensic examiner who can capture its state with the right tools.

Step Five — Isolate It in a Faraday Container

You have to make the device stop broadcasting its location to the perpetrator, not kill the device. Consumers have two options: a Mission Darkness Non-Window Faraday Bag (model number is the TitanRF, about twenty-three dollars on Amazon, and yes, you should own one if you have any reason to believe you are being tracked) and a heavy-duty microwave oven with the door fully closed and unplugged from the wall. The microwave is not perfect — the seal around the door leaks at some frequencies — but it’s orders of magnitude better than nothing and it’s in your kitchen. If you want the courtroom-defensible version, Faraday Defense, Tri-Tech Forensics and JEMIC all sell forensic-grade bags that meet the relevant electromagnetic-shielding standards. (Mission Darkness Faraday bag preservation of digital evidence) (JEMIC — Can Faraday bags preserve digital evidence)

Step Six — Read the Serial Number Without Removing the Battery

Every AirTag has its serial number engraved inside the cover under the battery, but it also broadcasts that serial number wirelessly to any iPhone or Android device that keeps the AirTag close and does an NFC read. Just press the white side of the AirTag to the back of any unlocked iPhone running iOS 14.5 or later, or any modern Android phone running Apple’s Tracker Detect app or Google’s equivalent, and a notification will pop up with a URL like found.apple.com/airtag. Just hit it. Screenshot the resulting page. . The serial number is on that page, as well as the last four digits of the phone number of the iCloud account that paired the device (if the device is in lost mode) and, in some firmware versions, the date of pairing. Do not move the AirTag to complete this step. Hold your phone close to the AirTag.

Step Seven — Document the NFC Read

The Step Six photograph is the strongest piece of evidence in the early case. The subpoena, which will open up the rest of the iCloud account, is based on the last four digits of the perpetrator’s phone number, pulled directly from the device itself. Save the screenshot, email it to yourself, and back it up to two separate cloud accounts the perpetrator has never had access to.

Step Eight — Call the Police Before You Call Apple

Apple will not provide iCloud account information to private individuals. “Law enforcement will get it from Apple with a warrant or a subpoena. The predicate document for the subpoena is the police report. There is no optional order of operations. But if you call Apple first and tell them you have found a tracker, you will get a recommendation to file a police report. Skip the pointless call. First, go to the police. (Apple — what to do if you receive a tracker alert)

Step Nine — Ask Specifically for a Detective Trained in Technology-Facilitated Stalking

The responding patrol officer is statistically likely to have had between zero and four hours of training in technology-facilitated stalking. You don’t need a patrolman. You want the detective who runs the agency’s domestic-violence or special-victims unit, and you want them to assign a case number, take possession of the AirTag with documented chain of custody, and submit a request to Apple Legal Process Response for the iCloud-account info. The exact phrase to use is: “I need this case routed to your DV detective and I need a request for an Apple legal subpoena initiated tonight.” If the responding officer balks, politely and on the record, ask for the watch commander.

Step Ten — Hand Over the Device With a Receipt

Do not give up the AirTag, the Faraday bag, the screenshots, or the photographs until you have a written, signed evidence-receipt with a property-control number. The receipt gives the date of the transfer of custody from you to the agency. It’s the first in the official chain. If the agency does not have a property receipt form at the scene, you should write one out by hand, sign it, have the officer sign it, take a photograph of it and keep the photograph.

Step Eleven — Preserve the Find My Notifications on Your Own Devices

If you own an iPhone, you’ve probably seen notifications in the past few weeks or months like “Unknown Accessory Detected” or “AirTag Found Moving With You” that you’ve dismissed without a second thought. If you haven’t cleared them, those notifications are still in your phone’s notification history and more importantly they are logged inside Apple’s Find My infrastructure on a per-account basis. Open the Find My app, tap Items, tap the Unknown Items tab, then take a screenshot of anything that appears. On Android, install the Technical University of Darmstadt’s AirGuard app, the only third-party tool that keeps a persistent scan history, with timestamps and signal strength, that gives you a courtroom-defensible timeline of when the AirTag was in range of you. (AirGuard research — CISPA / TU Darmstadt)

Step Twelve — Identify the Vector

Where did this device come from? The most under-researched question in tech-facilitated stalking is the moment of placement. Work backwards from the last time you had contact with the perpetrator or any of their agents. In the case of Elena Mireles, an AirTag was found in her son’s backpack 31 days after a Sunday afternoon custody handoff at the Folsom Lake State Recreation Area in March. Case law currently documents placement vectors including custody exchanges, shared work spaces, carpool exchanges, restaurant valet stands, the inside of a returned library book and the lining of a returned hoodie. the time window is the placement window. List all contact events in the window of interest. Your placement affidavit is that document in an envelope with a date.

Step Thirteen — Pull Your Vehicle Records

If the AirTag was placed in a vehicle, ask for the vehicle’s service records for the placement time period. Any tire rotation, brake job, oil change or body-shop visit by anybody who isn’t the registered owner is a placement opportunity. The service ticket with the technician’s name is a testimony.

Step Fourteen — Audit Every Item the Perpetrator Has Touched Since the Stalking Began

This is the step most people ignore and that almost always reveals more devices. In the case files I’ve seen, on average, stalkers who put one AirTag put two point three devices. The second one is usually in the car.” Often the third is in the jacket the survivor wears often, in the inner band of a purse or in the housing of a child’s stuffed animal, if there is one. Launch the Find My app on your iPhone or the Tracker Detect app (Android). Just slowly walk around the entire house with the phone in your hand and the scan on. Be patient, the scan takes from thirty seconds to ten minutes per device to surface. (CISPA — evaluating unwanted tracking notifications)

Step Fifteen — Document the Pattern

A pattern is a granted order of protection. A pattern is used to get a conviction for criminal stalking. The pattern is the time line. Open a spreadsheet, Google Sheets, saved in an account the perpetrator has never used, and record every disturbing moment, every “how did he know I was there,” every chance encounter, every text message that references a place you didn’t tell him you were at. 6 months ago. Twelve, if you can go back. When Apple releases the server-side logs for the AirTag, they will match the pattern document that is the prose version of it, with timestamps.

Step Sixteen — Engage a Domestic Violence Advocate Before You Engage a Civil Lawyer

The civil lawyer is coming. The civil lawyer is currently in the Northern District of California and is eager to come — the twenty-two consolidated AirTag cases are being litigating by a small number of specialized plaintiff firms that are actively taking new matters. But before the civil lawyer, you need a domestic-violence advocate, available at no cost through the National Domestic Violence Hotline, 1–800–799–7233, or through the Safety Net Project of the National Network to End Domestic Violence. The job of the advocate is to keep you alive during that eight to fourteen weeks between the police report and the subpoena return. That window is the most dangerous window in the entire life of a tech-stalking case, because the second the AirTag goes silent on the perpetrator’s side of the Find My app, they know you know. (NNEDV Safety Net — technology-facilitated abuse resources)

Step Seventeen — Do Not Confront the Perpetrator

This is last because it is the step most frequently violated by survivors. The moral legibility of this instinct, the instinct that any thinking, feeling person would have the moment they realize the man they shared a bed with for eleven years has been watching their bedroom from his kitchen for half a year, is to call him and tell him you know. Don’t. The most consistent predictor of escalation to physical violence in the stalking literature of the past twenty years is the moment the surveillance is found out and named. Gaylyn Morris was murdered in Indianapolis about seventy-two hours after Andre Smith approached Gaylyn Morris about the AirTag. Silence in the process of building forensic spine is not failure. The approach is silence.

Why the Brain in the Bedroom Is Already Eleven Months Ahead of the Police

Inside Elena Mireles’s body, in a language of cortisol and norepinephrine, and the firing pattern of a small almond-shaped cluster of neurons in the medial temporal lobe, a sentence has lived since about October of last year. Something’s not right. The sentence is:

Friends have labeled her as paranoid. her therapist has suggested generalized anxiety, kindly. Her mother said she’s having a hard time letting go of the marriage. Her son’s pediatrician has gently suggested that maternal anxiety can present somatically and has suggested yoga. In a series of text messages produced in the discovery phase of the eventual civil case, her ex-husband has told her, in those exact words, that she is “spiraling,” “delusional,” “imagining things,” and “exactly the same crazy you were when we were married.”

none of these are correct Her amygdala is right.

The brain’s threat detection system, the amygdala, is located three centimeters in from each temple, on either side of the head. It is in the business of pattern completion in the face of uncertainty. When the same external stimulus — a black sedan two cars behind hers on Highway 50, a notification she dismissed, a sense her ex knows things he should not — occurs in a non-random pattern that’s below the threshold of explicit conscious detection but above the threshold of statistical noise, the amygdala fires before the prefrontal cortex catches up. The body knows, before the mind knows. This is not a metaphor. This is measurable with functional MRI. The work over the past decade from the laboratories at Emory, McLean, and the Karolinska Institute has demonstrated, with effect sizes that would embarrass most of psychology, that the amygdala of a stalking victim is hyperconnected to the salience network and hyperconnected to the medial prefrontal cortex functionally, meaning the alarm system is screaming and the regulatory system that would normally turn the alarm down has gone offline. (PMC — amygdala functional connectivity and PTSD prediction) (Frontiers in Psychiatry — amygdala in PTSD pathophysiology)

This is the neurobiology of I felt it but couldn’t prove it.

It is also, and this is the part most survivors are never told and most clinicians have never been trained to communicate, a defensible expert-testimony foundation for the civil case. ‘eight in ten stalking victims show PTSD’ (Suzy Lamplugh) — A landmark study by the Suzy Lamplugh Trust) replicated three times since, found that around eighty percent of stalking victims meet the diagnostic criteria for post-traumatic stress disorder and that the PTSD presentation in stalking victims is, in the words of the lead author, ‘indistinguishable in neuroimaging signature from the PTSD presentation in survivors of armed combat.’

Fighting. That is the analogy . A woman whose ex-husband left a twenty-nine dollar disc in her son’s backpack, who watched her sleep from a kitchen in Folsom, comes out of the experience with the same neural signature as a Marine who served two tours in Helmand Province. As a society we don’t ask the Marine why he didn’t just walk away from Afghanistan. We need to stop asking the survivor, why didn’t you just know earlier.

The Cortisol Curve, the Sleep Collapse, and the Reason You Stopped Trusting Your Own Mind

The hypothalamic-pituitary-adrenal axis is the body’s stress response system. In the chronic-surveillance survivor it is like a thermostat welded to the “on” position. Cortisol, the principal output of the axis, is supposed to rise sharply in the half-hour after waking — the cortisol awakening response — and decline in a smooth curve over the day, reaching its nadir around two in the morning, allowing the body to enter and maintain the slow-wave sleep stages that consolidate memory, repair tissue, and rebuild the regulatory neurotransmitters the prefrontal cortex needs to function the next day.

In the eleven months between the beginning of the surveillance and its discovery, the cortisol curve in Elena Mireles’s body flattened. The morning peak has faded. 2:00 a.m. nadir has been replaced by a small, but statistically significant, second peak. Her slow-wave sleep over the two nights she has worn a Whoop band is registering forty-one minutes, when the population norm for her age and weight is ninety-six. By every metabolic and neuroendocrine measure of sleep deprivation, she is sleep-deprived in a way that no amount of melatonin or sleep hygiene will fix, because the substance disrupting her sleep is not behavioral. But what her mind has not yet been permitted to name is the silent psychiatric awareness, the awareness at the level of the body, that she is being hunted. (Frontiers in Global Women’s Health — IPV and stress-related disorders) (PMC — Impact of Stalking and Its Predictors)

The cognitive symptoms are predictable after the sleep collapse. Working memory deteriorates. In laboratory studies, verbal fluency declines by an average of fourteen percent. Decision making on the Iowa Gambling Task slows down by a measurable amount. In her own internal monologue, the survivor becomes “stupid” — and the perpetrator, hands on the Find My app open in his kitchen in Folsom, weaponizes that stupidity in every text message he sends. You’re forgetting things. You’re losing control. “Don’t go with the kids by yourself. You need support.

This is the loop. The surveillance shows the cortisol curve. The cognitive deficit is produced by the cortisol curve. Then the perpetrator hands the cognitive deficit back to the survivor as proof that the surveillance she is feeling is not real. It’s one of the most efficient psychological abuse cycles ever industrialized at scale. The twenty-nine-dollar disc in the backpack is the engine that runs it.

Hypervigilance Is Not a Symptom. It Is Evidence.

I want to make a clinical and a legal point in the same paragraph, because they collapse into the same point.

In October, Elena Mireles started locking her doors three times before bed, started parking in different spots in the lot at work, started taking different routes home, started checking the rear-view mirror more often than the road in front of her, started waking up at 2:47 a.m. and 3:41am. and 4:14 a.m. A tight chest and the feeling that someone was out in the hall, those behaviors would have been called hypervigilance in the clinical literature — a maladaptive sign of an emerging trauma response that should be treated with cognitive-behavioral therapy and graded exposure. (PMC — Hypervigilance: a forward feedback loop) (Cleveland Clinic — hypervigilance overview)

Let me put it another way.

Hypervigilance is not a symptom, at least not in the stalking-victim population. It’s a good read of the environment. The patient is not exaggerating a low probability threat. The patient is accurately perceiving a high-probability threat that the patient’s interlocutors — the friends, the family, the patrol officer, the early therapist — have not been given the tools to perceive. The legal-and-clinical move is not to medicate out the hypervigilance. It is about validating the hypervigilance, confirming it, and using it as the patient’s own internal early-warning system as the forensic spine is built. Eight in ten stalking victims who later get a diagnosis of PTSD have been told by at least one clinician that they were imagining the stalking. Then eight out of ten women were right and their clinicians were wrong and the cost of the clinical error is lost months of investigative window, lost evidence and in the worst cases lost lives.

The Suzy Lamplugh Trust calls this pathologising. I refer to it as the most common iatrogenic injury in modern outpatient psychiatry.

The Habenula and the Hijacked Reward System

For those of you who came to this article from my piece last month about the habenula and the “no” button, I want to make an immediate neurobiological bridge here, because the survivor of chronic surveillance doesn’t just grow hypervigilance. She develops anhedonia — an inability to experience pleasure — and the mechanism is precisely what the habenula is responsible for.

The brain’s negative-prediction-error generator is the lateral habenula, a three millimeter structure on the dorsal surface of the thalamus. It fires when the world gives you worse than what you expect. The habenula has been firing, day after day, for the entire duration of the unproven knowing in the surveillance survivor, every joy is intercepted, every laugh is short-circuited, every moment of safety is overridden by the body-level conviction that safety is the lie. Tonic habenular drive suppresses dopamine in the ventral tegmental area. The pleasure circuits go dark.

That’s why Elena Mireles won’t be able to sleep a peaceful night after the discovery. The body doesn’t consider the surveillance over just because the device has been moved to a microwave. The body has built a prediction — this world is after me — out of eleven months of evidence gathered, and the prediction does not unravel the night the AirTag goes dark. Over the eighteen to thirty-six months of treatment to come the forecast crumbles, gradually. Survivors without warning of this lag tend to interpret the persistence of dread, weeks after the discovery, as evidence that the surveillance continues — and a small subset of them, in my caseload, have dismembered their own homes looking for extra devices that were never there.

The dread is the residue of the habenula. It’s not a new instrument. It is the old fire, burning still in the brainstem, after the fuel has been removed.

The DARVO Move and the Courtroom Performance of the Tech-Equipped Stalker

The pathology has a name, and I want to walk you through what happens when the case gets to a courtroom, because the courtroom phase of an AirTag-stalking case has its own pathology.

The behavioral signature of the high-functioning intimate-terrorism perpetrator under legal scrutiny is documented as DARVO — Deny, Attack, Reverse Victim and Offender. The perpetrator denies ever having been stalked. He attacks the survivor’s credibility, mental health, parenting, employment history. Then he flips the script — he’s the victim, of a spiteful ex-wife who’s weaponizing the family court to steal his kids away, spinning a stalking fantasy to gain the upper hand in a custody fight.

The perpetrator is the best-informed witness in the room about the survivor’s recent life, because he’s had eleven months of real-time GPS surveillance. That’s why DARVO works so often in courtroom settings. He knows where she was on February seventh at nine fourteen p.m. He knows she was at a wine bar in Midtown with a friend. He knows that the friend was male. He uses that information, fed back to him through carefully constructed questioning, to make himself seem omniscient. And the survivor, not yet aware that her movements have been logged on a server, comes off as evasive, inconsistent or hiding things, because she is being asked questions about events she has no idea anyone observed.

The forensic spine — the iCloud subpoena return, the server-side timestamps of every Find My session — collapses this performance the instant it is introduced into evidence. The opposing counsel cannot impeach the survivor on whether she met the friend in Midtown when the server log shows the perpetrator’s iCloud account opening the Find My app eleven separate times that evening between 9:02 p.m. and 11:47 p.m. The server log is the witness without a history of mental illness to assault.

That’s the significance of the seventeen-step forensic protocol. The construction of the witness that the perp can’t DARVO.

The Legal Architecture, State by State, and the Gap Where Federal Law Should Be

U.S. stalking law is a crazy-quilt. There is a criminal stalking statute in every state. Most of them were written before consumer Bluetooth trackers even existed, and have not been meaningfully updated. The functional question , in each jurisdiction , is whether the statute requires that the perpetrator have communicated a threat ( some do , and those statutes are functionally unenforceable against silent GPS surveillance ) , or whether the statute can be satisfied by a course of conduct that causes a reasonable person to fear for their safety ( most do , and those statutes do reach AirTag stalking ) .

AirTag stalking is covered by the federal interstate stalking statute, 18 U.S.C. § 2261A, when the conduct crosses state lines or is conducted using an instrument of interstate commerce — and the Find My network, coast-to-coast Apple infrastructure, meets the interstate-commerce prong on its face. Federal prosecutions are rare because the U.S. Attorney’s offices tend to reserve the statute for cases with a significant physical-violence component, but the statute is there, and the case law that exists covers the conduct. (Cyberstalking — University of Wisconsin report)

H.R. If enacted, S. 4127, the Tech Safety for Victims of Domestic Violence, Dating Violence, Sexual Assault, and Stalking Act, currently pending in the 119th Congress, would create a federal grant program to train state and local law enforcement officers in technology-facilitated stalking investigation and require manufacturers of Bluetooth tracking devices to implement universal anti-stalking detection protocols across the Android and iOS ecosystems. The bill has bipartisan sponsorship and a good chance of moving in the current session. It’s worth a phone call to your congressional representative. (H.R. 4127 — Tech Safety for Victims Act)

At the civil level, the Northern District of California AirTag cases are trending toward what plaintiffs’ counsel believes will be a series of bellwether trials in late 2026 and early 2027. The theory of the case is product liability — that Apple sold a device with foreseeable misuse and inadequate mitigations, that the plaintiffs’ injury was directly caused by Apple’s design choices, and that Apple is liable for the damages that resulted. Apple’s defense is that the AirTag is a neutral instrumentality, the wrongful actor is the stalker, and Apple cannot be held liable for the criminal acts of third parties. The law is not settled in California and therefore not settled in the federal system. No matter how the 2027 verdicts go, they will reshape the industry.

For the individual survivor, the next step in the practical legal pathway would be (in order of precedence): an emergency protective order or domestic-violence restraining order in family court, a criminal complaint in the prosecutor’s office, and, if either of the first two is successful and documented damages are incurred, a civil action against the perpetrator and, in a small but growing number of cases, a parallel civil action against the manufacturer.

What Apple Will and Will Not Give You

Apple’s stated policy and practice is that it will provide iCloud account information associated with an AirTag in response to a valid legal request from law enforcement. The request must be served on Apple Legal Process Response and must include the AirTag serial number and the legal basis for disclosure. (Apple support — what to do if you receive a tracker alert)

What Apple will provide in response to a properly-worded subpoena is the name on the iCloud account the AirTag was paired to, the billing address, the email address, the phone number, the date the AirTag was paired, the date and time of every time the AirTag connected to the iCloud account (which is effectively a log of every time the perpetrator opened the Find My app and looked at the device), and sometimes the IP address from which the Find My app was accessed.

The one thing Apple will never, ever, under any circumstances, give to anyone other than law enforcement: the underlying encrypted location data. Apple doesn’t possess it. End-to-end encryption is a math thing, not a policy thing. Even with a warrant, Apple can’t produce the GPS coordinates the perpetrator saw when he opened the app, because Apple never had them unencrypted.

This, paradoxically, is the legal basis for the case for Apple (we built the privacy architecture; we cannot be the gatekeeper of the abuse) and the case against Apple (you built a device with end-to-end encrypted location surveillance and you released it to the consumer market for twenty-nine dollars knowing it would be used this way). Both arguments are logical. The 2027 juries will decide who gets to control what.

This section is purely operational what you the survivor need to glean from Write to your detective, hard, to serve the subpoena early. In my experience, Apple’s response to a subpoena takes four to eleven weeks. Without it the case file is not viable. The greater the time between discovery and service of a subpoena, the more the case is hemorrhaging day by day.

The Devices That Are Not AirTags

I want to spend a section here because the public conversation has, lazily, devolved into “AirTag stalking” — and the actual technical landscape is broader.

Samsung’s SmartTag2, released in 2023, uses the Samsung Galaxy Find Network, which includes roughly three hundred million Galaxy devices around the world. Independent academic testing found the anti-stalking detection on SmartTag2 to be less robust than Apple’s — unwanted-tracking notifications are less reliable, and the audible alert is quieter. (arXiv — Tale of Three Location Trackers: AirTag, SmartTag, Tile)

Tile is owned by Life360 and has its own crowd-sourced network that is used through the Tile app, installed on Android and iOS devices. Tile’s anti-stalking feature, Scan and Secure, requires survivors to turn it on for themselves, via the Tile app — meaning that survivors who do not have the Tile app on their phone (which is most survivors) have no way of detecting a Tile device around them. This is a significant gap and one that is being actively pressured by victim services organisations.

The Chipolo ONE Spot works with the Apple Find My network so when it comes to detection it’s pretty much same as an AirTag for the survivor. Pebblebee uses either Find My or Google’s Find Hub depending on the model.

The detection workflow is identical, regardless of the brand. Apple’s built-in detection (iOS), Tracker Detect (Android, free, official Apple), AirGuard (Android, free, TU Darmstadt), and Tile Scan and Secure (Android and iOS, free, requires download). Run them all. It’s the overlapping coverage that hits the device the first one didn’t.

When the Tracker Is Inside the Phone — The Stalkerware Layer

I need to talk about the second tier of the problem, because survivors who have been stalked with an AirTag have a heightened baseline likelihood, in my caseload, of also being stalked by software on their phone. The same person that will hide a tracker in a child’s backpack is statistically willing to install a commercial stalkerware product on a partner’s phone when they have a moment of unattended access.

Commercial stalkerware market leaders — mSpy, FlexiSpy, Cocospy, Spyzie, and a revolving cast of Russian and Chinese clones — install on an iPhone with a few minutes of physical access and the iCloud password, or on an Android phone with a few minutes of physical access and developer-mode toggles. Once installed, they suck up text messages, call logs, location data, browser history, photos and in some cases live microphone audio to a dashboard that the perpetrator can access from anywhere in the world.

Harder to detect than the AirTag case. The red flags include abnormal battery drain, the phone heating up when idle, mobile-data consumption skyrocketing when the phone is idle and, on Android, mysterious apps with far too much access. If you have any reason to suspect installed stalkerware, the forensic move is to factory-reset the phone — not just power off, not just sign out of iCloud — and to change every password from a different device after the reset. The Coalition Against Stalkerware (stopstalkerware.org) provides up-to-date detection guidance, as well as a vetted list of advocacy partners.

An AirTag is a leash, stalkerware is more of a wiretap. The two often come together. Sweep for both .

The Child in the Story

I want to go back to the seven-year-old whose backpack carried the device into Elena Mireles’s home for an unknown number of days before the discovery. Because the child, in such a case, is doing a kind of psychological work that is rarely named.

The child doesn’t know about the AirTag. The child knows about the tension in the handoffs, the careful way his mother asks about his weekend, the way his father seems to know things about his school week that he is sure he did not mention. The child has been weaponized, not because he did anything wrong, but because his presence in the perpetrator’s home became the vector by which the surveillance returned home on Sunday afternoons. In the cases I’ve reviewed, about one in six tech-stalking cases that involve shared custody involve child-carried AirTags. In all six, the placement vector is a moment of unsupervised access to a backpack, a soccer bag or a stuffed animal.

And at last the child must be told. Not the night of the discovery. Not in the language of the criminal proceedings. But in the language of eventual healing: that something unsafe happened, that the unsafe thing was not the fault of the child, that the parent who placed the device made a serious mistake involving the child without the child knowing, and that the child’s job, going forward, is only to be a child. The advocates I work with, at the Family Justice Center in Sacramento and the equivalent agencies in the cities I have consulted into, recommend the timing rule of telling the child no more than the child has noticed, and telling it within the same week the child notices something.

If handled competently the trauma to the child is recoverable. The trauma to the child when the parent confronts the perpetrator in front of the child or destroys the home of the perpetrator in the presence of the child is not.

The Forty-Eight-Hour Survival Checklist, Compressed

I want to give you, in prose, the compressed version of the protocol, the version you can run through your head at 2:14 a.m. in the gap between recognition and action in your son’s bedroom.

Avoid contact with bare hands. Photograph it in position. Set the time. Do not take out the battery. Put it in a Faraday bag or, if you don’t have one, a microwave with the door closed and the unit unplugged. Quickly tap an iPhone or Android phone against it to read the NFC and get the URL back. Take screenshots of everything. Send yourself the screenshots from an account the perpetrator has never seen. Call the police. Not Apple. Ask for the domestic-violence detective by name. Return the device with a written receipt. Never contact the offender. Don’t ever post about it on social media. Do not under any circumstances destroy the device.

Then call the National Domestic Violence Hotline at 1–800–799–7233 and ask for a Safety Net advocate.

You just built the forensic skeleton of the case in the above order of operations. The prosecutor’s office, the family court judge, the civil plaintiffs’ bar and the eventual jury need that backbone to find the perpetrator. You have given them in some forty-five minutes of careful action what they want.

What Recovery Actually Looks Like, in Months, Not in Days

I’m going to close the clinical portion of this article with something I’ve never said aloud in print before, because survivors deserve to hear what the calendar of healing actually looks like.

The first ninety days of discovery is the worst. The sleep doesn’t come back. The hypervigilance doesn’t stop. The body thinks the surveillance is not over. The work in this window is purely operational — building the forensic case, securing the protective order, finding a trauma-trained therapist with specific competence in technology-facilitated abuse (not every trauma therapist has it), and building a daily safety routine that the survivor can do on autopilot, because autopilot is the only mode the cognitively depleted brain can still drive in.

Months four to nine are the long middle. With consistent treatment the cortisol curve begins to regain its morning peak. Sleep gets deeper. On the imaging studies, the amygdala-prefrontal connectivity starts to repair. The survivor laughs again in short surprised bursts. This laughter alarms the survivor because the laughter feels alien. The work in this window is reconstructive — re-establishing a sense of agency in small, repeated acts, rebuilding the social circle which the surveillance years isolated, re-learning that the body is a safe place to be inside.

Integration is from month ten through twenty-four. The dread becomes at last a memory of dread, not a live signal. The survivor can tell the story of the discovery without the heart rate spiking on the polygraph. The nightmare pattern gradually shifts into a different pattern in which the perpetrator appears but cannot find her. At the time of this window the civil case is either setteld or in trial. The criminal case is either closed or on appeal in the matters that proceed.

The full recovery, the recovery in which the survivor’s nervous system returns to the pre-surveillance baseline, is not completed in twenty-four months in the literature. In the longitudinal studies the honest number is more like forty to seventy months. It takes years for the brain that chronic surveillance rewired to rewire itself back. The survivor who was told in year one by a well-meaning friend to “get over it” is being asked for something that biology cannot yet supply.

Be gentle with yourself. The body is doing actual work. The work has a time limit. The timeline is correct.

The Sentence I Want Elena Mireles to Read at 2:41 A.M.

In this article and in real life, Elena is sitting on her kitchen floor, the microwave humming and her son asleep upstairs and her phone open to a search bar she does not yet know the answer to. I want her to read this paragraph. I want every Elena reading this article, and there are tens of thousands of you, and you know who you are, and the search bar in front of you tonight is the same search bar, to read this carefully.

It’s not your imagination. You’re not paranoid. You’re not crazy. Your nervous system has been correctly detecting a threat that the people around you were unable to detect. It does not mean that you failed to find the device earlier that you will find it tonight. If you don’t understand the architecture of the Find My network, that doesn’t make you stupid. You were a parent, raising a child, working a job, managing a divorce, and a stranger — who used to share your bed — was outsourcing the job of tracking you to a network of three hundred and seventy million Apple devices owned by people who didn’t even know their phones were being used to hunt you.

Tonight you got back something you didn’t know was being taken from you. You have the chance, in the next forty-eight hours, to make the case that ends this. You can rebuild a nervous system that has not had proper sleep in nearly a year over the next forty months. The first opportunity is live. The second chance isbiological. Both are right. Both are available You get the both.

Place the device in the microwave. Shut the door. Take out the plug. Get a shot of the interior of the backpack, with the kitchen light on. Write the time on the back of an envelope. Tell the cops. Ask for the DV detective by name

Don’t call him. Don’t phone him. Do not phone him.

You’re going to be okay. Not tomorrow. There is no way. but on a timeline the brain has shown itself capable of, two hundred studies, several thousand survivor recoveries. There is a leash in the microwave. The hand on the other end of the leash is going to be identified, named, served and held accountable.

Just breathe. Then you do the phone call.

Closing Note for the Reader Who Is Not Yet Elena

If you are reading this and the discovery has not happened to you — if you came to this article out of curiosity, or because the algorithm surfaced it, or because someone you love has been describing symptoms you did not, until tonight, know how to name — I want to ask you for one specific thing.

Send her this article. Not with a paragraph of commentary. No words like, “I read this and thought of you.” Just send it. She’ll know why you sent it.” If she isn’t the Elena of the story, she’ll read it like a tech article. If she is the Elena of the story, she’ll read it as the sentence she’s been looking for since October.

You’ll not always know which one she is. Send it out anyway.

The disc is one quarter of an inch thick. It’s twenty-nine dollars. It sends a signal every two seconds. And the woman in the door at 2:14 a.m. in Sacramento has finally found the words tonight to say what her body has been telling her for eleven months. She’s not the only one. She was never by herself. The deeper truth is that now, too, a network is being used to find her, and you, reading this, are a part of it, no matter that the network was being used to hunt her.

Welcome to the second network. The one that brings her home.

Waleed Ahmed writes at the intersection of clinical neuroscience, technology-facilitated abuse, and survivor recovery. If you are in immediate danger, call 911. If you are experiencing stalking or domestic violence, call the National Domestic Violence Hotline at 1–800–799–7233, available 24 hours a day in more than 200 languages. If you have found a tracking device and need guidance on the next forty-eight hours, the Safety Net Project at the National Network to End Domestic Violence (techsafety.org) provides confidential, free advocate consultation.