The Inside Story of Tea

UbiKeys are the original passkeys, small, sturdy, and easy-to-use physical security keys that prevent phishing attacks and account takeovers.

UbiKeys are manufactured by UbiCo, a company with headquarters and manufacturing centers in Sweden and the United States.

Unlike basic multi-factor authentication or MFA methods such as SMS, which is text messages, one-time passcodes, or mobile authenticator apps, UbiKeys provide modern MFA and are a proven security solution that can't be hacked or bypassed by malicious actors, stopping AI-powered cyber attacks, online identity scams, fraud, and account takeovers.

UBKeys help businesses of all sizes, from large banks and tech companies to critical manufacturers, energy concerns, and government agencies, stay ahead of evolving cyber threats and regulatory requirements.

They also protect individuals and everyday users by securing email, banking, and social media accounts, password managers, productivity tools, developer tools, and more.

For more information on how UBKs secure applications, services, and accounts for both individuals and businesses, visit ubico.com/slash 404media.

And for a limited time, get $10 off your order of exactly two keys from the YubiKey 5 series or security keys series using the code 404media10 at checkout.

That's ubico.com/slash 404media.

Use code 404media10.

Hello, and welcome to the 404 Media Podcast, where we bring you unparalleled access to hidden worlds, both online and IRL.

404 Media is a journalist-founded company and needs your support to subscribe.

Go to 404media.co.

As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments.

Gain access to that content at 404media.co.

I'm your host, Joseph, and with me are 404 Media co-founders Sam Cole.

Hey.

Emmanuel Mayberg.

Hello.

And Jason Kebler.

What's up?

All right.

Final warning.

The second anniversary party for 404 Media is happening this Thursday.

Well, presumably, if you're listening to the podcast when it comes out, August 21st, Thursday, 6 to 9 p.m.

Sam, are we getting close to sold out?

There's a few more tickets left.

What's the deal?

We're so close to selling out.

We're very close.

We're like two dozen tickets away.

So please get your ticket now.

Yeah, it's going to be fun.

It's at Farm One in Brooklyn.

We're going to have open bar, really good cocktails, really good local beers.

We're going to record something short and sweet for the podcast and then also take your questions.

So please come with questions, mail us your questions ahead of time.

Um, if you're not able to be there in person, but if you're there, you can bother us with your questions live and in person.

Yeah, the details are in the show notes, it goes to a post on the website where you can buy the tickets.

Again, this is free for paying for me to subscribers.

There's a code in there, you then enter it and you get a ticket.

You do have to get a ticket to be able to get in just so we can keep track of how many people are coming and going and that sort of thing.

Otherwise, it's $20

or you could subscribe for $10

and then you get access to an open bar.

It seems like a very easy sell to me.

I think also, I mean, this is our last podcast before our two-year anniversary.

So if you're not a subscriber, we recorded a second anniversary podcast, which is, it's out now, right?

It's on the feed.

Yeah, it sure is.

So you can get that if you subscribe.

So good, good time to subscribe because we talked about how 404 media is going and that sort of thing.

I thought it was fun.

Yeah, absolutely.

All right.

We'll leave that and we'll go to this week's stories.

This first one is one written by Emmanuel, a really amazing, deep investigation here.

The headline is, How T's Founder Convinced Millions of Women to Spill Their Secrets, Then Expose Them to the World.

Again, this is a massive investigation.

involves former employees, people directly involved,

documents, text messages, all of this other sort of stuff as well.

So, we're not going to be able to talk about everything.

So, I'm pulling out some important parts that I think are worth talking about on the podcast.

But that said, Emmanuel, could you just remind people what T

is exactly and sort of what it promised, and then we'll go from there?

T is an app that went viral in late July.

It pitches itself as a women's dating safety app.

And basically, the way it works is

women can create an account after they verify that they are, in fact, women.

And

they then share information about men that they know or have dated,

thereby allowing other women to stay away from them if they're bad or have other women vouch for them if they're safe and good to date.

The

app was hacked in late July, just like a week after I went viral.

It

initially,

we found out about it on 4chan because they gained access to the back end,

got all these

selfies and images of IDs that women shared with the app in order to verify that they're women.

That was the initial hack.

Shortly thereafter, we discovered a second hack via an independent researcher, which was far worse.

This one included a lot of private messages between

users.

Over 1.1 million, I think, is what we could verify was leaked.

And these are incredibly sensitive conversations between women talking about very personal, very intimate

things like abortions, cheating partners, things like that.

Yeah, and the app is still popular, it seems.

I was trying to load the app.

Far, far, far more popular than it was when these hacks happened.

I think at the time when we wrote these stories about these two hacks, they were at 1.16 million users after their like viral moment in the news before the hacks.

And then now they claim almost 7 million.

So

many times over more popular.

It is weird the impact that data breaches can have, even those that put people's safety at direct risk.

I I mean, okay,

we'll move on from that.

So that's what T is.

Let's step back a little bit in time.

Who is Paula Sanchez?

And what did T want with her exactly?

Yeah, so,

Sam, not to put you on the spot, but

Paula Sanchez is the founder of this movement and community and collection of Facebook groups called Are We Day in the Same Guy?

And essentially, that does

basically exactly what T

advertises, but it does it on Facebook and it kind of grew organically.

Initially, the first group was started by Paula in New York, and it became very popular.

People opened other groups across the country and in Canada dedicated to different cities.

And that just like exploded in popularity.

Also, there's over 200 groups, 7 million members across all these groups.

And Paula is still like the administrator of all of it.

But

we first heard about

Are We Dating the Same Guy from Sam?

If you kind of want to talk about how that came up for you and

why these groups

are useful and popular.

Yeah.

So I think we first started reporting on these, at least when

this man sued

like 27 women and a bunch of different parts of like Facebook and Meta and Patreon and GoFundMe and all these other entities because he was included in an Are We Dating the Same Guy group in Chicago.

So he had started this hoping to be a class action,

but started this complaint against

Pala and then a bunch of other women

saying that these women were in these groups defaming him.

His issue with these groups was that these women were calling him clingy and psycho specifically,

accused them of being like outrageous and cruel and malicious

because they were posting his picture, which was like publicly available on his Facebook, posting his picture in the groups and then asking like, what are the red flags with this guy?

And those are the red flags that came up.

People said, oh yeah, I dated him and he pressured me into sex, or you know, like that's that's what happened in these groups: people brought up their own experiences that were like, quote unquote, red flags about a guy.

So, yeah, that was the first time we came across this, and

it's it's only gotten bigger from there.

That was in 20, early 2024.

Um,

yeah, that complaint didn't go anywhere because that guy went,

I think he got taken down for like tax fraud or something.

So,

yeah, didn't go very far.

Yeah.

So

we write these stories about the T-Hacks.

Sanchez reaches out to us and says, basically,

I never talked to the press.

I am under a lot of pressure because of lawsuits like this, because

of something our friends at Wired covered where there were these groups of men who, again, were upset about the information women were sharing about them on the Are We Dating the Same Guy Facebook groups?

They organize on Telegram to like dox women there.

She's just been through a lot because she's behind this community.

But she said,

I need to,

I don't want to do this, but I need to tell you some stuff that I know about tea.

And the gist of that is that beginning in late 2022,

people from the T app, even before it officially launched, reached out to Sanchez and says, hey, we're doing exactly what you're doing, but we're doing it in an app.

We think we could do it better than you.

We need a face and founder to kind of go around and present this app to the world.

And we think you'd be perfect for this because you're behind the Are We Dating the Same Guy

community.

And

she never responded to that, again, for the same reason that she doesn't respond to a lot of requests that she gets.

And from there, things got

pretty weird and I would say aggressive from T's direction.

Yeah.

So T is trying to create this app.

Obviously, eventually they do create the app.

They ask Sanchez, who is the face of this phenomenon.

Basically, are we dating the same guy?

Hey, we really would like you to come on board with T and be the face of our app.

Obviously, there's probably some incentives there in that the CEO of T is a man, and it would probably be useful to have, well, first of all, a woman, secondly of all, a very respected woman who's already been doing all the safety work.

You can see the reasons why there.

You say something changes when she doesn't reply.

I mean, I have a short list here of things, and I'll make sure we touch on all of them.

But what starts to happen when Sanchez sort of turns down T's request?

The first thing they begin to notice,

not just Sanchez, but this community of moderators that are helping to keep the Facebook groups healthy and useful to women, is that all these users are showing up and posting about T

and replying.

Like, let's say a woman comes into a group in San Diego

posting about a man she's about to go on a date with.

Like, does anybody know him?

And a bunch of the replies are like, yeah, I know him, and there's nothing about him in this group, but you should check out T.

I think I saw something about him there.

And this is happening again across like 200 groups.

And the moderators are noticing that it's the these accounts are behaving like spam.

And some of the women are reporting back in reviews on the T app, on the app stores, and then just like talking amongst themselves, being like, I signed up because someone told me that I can find information about this man there, and there's nothing there.

And

to be clear,

we did not find any evidence that T itself was behind this, but it was very clear that

these accounts were not authentic activity.

These are probably accounts that were hijacked by some sort of like spam operation.

And this is something that is common on Facebook.

There's all these accounts that are compromised.

Then, some sort of company, you can pay them to advertise whatever you want.

And they just like use compromised accounts in mass to promote a certain product or message or or what have you.

So again, we couldn't confirm that T was behind us, but

it's clear that there was like inauthentic marketing of the T app specifically targeted that are we dating the same guy groups.

Yeah, that's pretty weird and pretty suspicious.

Jason, maybe just briefly, because you have reported a lot on hijacked Facebook accounts.

What does that look like?

Like, how can you tell an account on Facebook has been hijacked?

Yeah, so

again, we can't say for sure that T

knew that these accounts were hijacked.

I feel the most likely mechanism was probably

they were paying for like boosting on Facebook, which is a service that a lot of companies offer.

And it's basically like promote my company across Facebook or promote my Facebook content by having a lot of likes, a lot of replies, et cetera, et cetera.

And I bring this up just because

this has been the case with a lot of the AI slop reporting that I've done, where a lot of the accounts that are commenting on Facebook slop are hijacked accounts.

And the way that you can tell that they're hijacked accounts is,

well, sometimes

the name and the URL, like the name on Facebook and the URL name are totally different.

And so someone has like taken,

I don't have the exact specifics in front of me right now, they'll take like

facebook.com/slash Jason Kebbler.

They will take that account and then they'll change it to like Diane Smith and change the Facebook profile picture.

They will then,

you know, change all the information on the account as well.

But that URL is permanent and can't change.

And so that is like one way that you can tell.

And in one case, Emmanuel was able to find a woman's new account where her first post was, My old account got hijacked.

Um, oh, yeah,

and so I mean, that was like a really good uh tell, you know, but uh, basically, it's like this happens in huge, huge numbers on Facebook, and so it's a it's a very common thing, um,

you know, super shady and bad that this happened in this case.

But there are so many services out there that sort of sell, like,

we'll boost your content using our army of Facebook bot bot accounts.

And sometimes they might not even advertise them as bot accounts.

They might just say, we'll boost your content on Facebook.

But then the way that they're doing it is through like a botnet of zombie accounts, more or less.

Yeah, that makes sense.

But T

did other stuff on Facebook.

So again, they couldn't convince Sanchez.

So then they start doing these other things like boosting the T app.

It sounds like potentially misleading some people to join the app and then finding there isn't actually any information about the guy they're looking into or dating or whatever.

What's with these fake Facebook groups that look a lot like Are We Dating the Same Guy, but they're not?

So, what's the deal there?

Yeah, so one of the former employees I talked to at T, Veronica Mars,

she had

a lot of tasks that were related to promoting the app.

But one thing she did is she was handed a number of Facebook groups that were started by the CEO of T, Sean Cook.

And they were just called, Are We Dating the Same Guy?

And insert name of city.

And then at the very end, it said T app.

So they used the branding of the original grassroots movement, appended the app name to it.

So I think to be fair, like they, they, they had something in there so you could tell that it wasn't, that it was a T-app affiliated thing.

But she said that many times she had to explain to people who reached out to her that these groups were not related to Paula Sanchez's

thing.

They just assumed that it was, and people were reaching out to her looking for Sanchez.

And they were just confused.

This is another thing that you can see in the reviews for the app is that

people thought that it was the Are We Dating, it was an official Are We Dating the Same Guy app, and that just wasn't the case.

Well, it's

funny you bring that up and like that confusion,

especially in the reviews, because after we posted your investigation today, and obviously I just posted it to Blue Sky and various other platforms, I think I got a reply from somebody who it seemed was confused in that respect.

And they're like, whoa, but are we dating the same guy and T are the same thing?

It's like, first of all, please read the article

because that's the entire point.

Second of all, oh, that confusion has permeated where some people believe that, and you can't really blame them because they've been misled by these Facebook groups.

Yeah.

And

it was very targeted.

And there was a lot of effort put behind it.

It was going for a long time.

And then at some point, it shifts.

So

they definitely had some users, they had some traction, but then T's marketing changes from essentially trying to confuse people that they are part of Are We Dating the Same Guy

to directly attacking Are We Dating the Same Guy?

And the main way they did this is they went to this company.

This is kind of like a side quest on this investigation, but I thought it was very interesting.

And I knew these existed, but I've just never seen one.

Like I've never followed the operation of one of these companies so closely.

But there's this company called SG Social Branding, I believe.

And

they

advertise themselves as having 35 Gen Z influencers.

And the whole business plan is basically you come to the company, you pay them to promote your app, and then these 35 influencers kind of spread out and start posting to social media as if they are like real users of your product.

And they're posting popular vertical video formats as like, oh, I'm talking, I'm holding the phone and I'm talking to the camera as if I'm just a normal user talking about how much the T app rules.

And it's so much better than the Facebook groups and so much easier to use than are we dating the same guy?

Or it's like two young influencers on a podcast talking about some dating ordeal they had and how T saved them from like a really bad situation.

But there is no podcast.

It's a fake,

it's a fake podcast that they're pretending to be on because clips of podcasts are very popular on Reels and TikTok.

Yeah.

I know that

while we were editing this and I highlighted that, and you know, it's about halfway through the story, something like that.

And that you have some sort of line that says, except the podcast didn't exist.

And I'm like, that's crazy.

We need to stress that.

And as you just rightly said, and I've seen them as well, oh, you get YouTube shorts or anything or adverts that just look like podcasts all the time.

But as you say,

it's different when you're investigating it in the context of a company like this trying to grow, it sounds like at all costs, or whatever they're able to get away with, essentially.

And it's very, very interesting.

to see that, oh, yes, there's a company behind it.

And they were apparently hired to do that.

yeah and i mean two things about that is the way that i've seen these type of like fake podcast clips go around it's usually some sort of like influencer or someone that's selling you like a class or something like that it's like individuals realizing that it's a popular format on social media and making one themselves i've never seen a company like turn it into a business like that.

So it's like, there's that, like, though there are others, right, Jason?

I'm sure

you've seen others.

i've seen them and i mean honestly like this company uh super interesting that it exists and that they do this regularly and that they brag about it on their website where they're like case study we did this for for tea

um

but i guess it's honestly just how like marketing works these days but they'll do like man on the street quote unquote man on the street interviews, which is like, you know, a

very common thing on TikTok when you're scrolling through and you have people shoving microphones in other people's faces.

And like, spoiler alert, not all of those are real, or at least they're not random people many of the times.

But yeah, I found that part to be like really interesting.

The other reason that it's different, in my opinion, is because,

you know, through the investigation,

we noticed very clearly that there's a pattern, right?

Like, that's why I opened with this message that Sanchez got from T about about them wanting to have a face for the app.

And there's even stuff that didn't make it into this story that it just like, clearly Sean Cook was going around and looking like, I need a woman.

I need like a young, attractive woman to sell this story in order to sell this app.

And the thing that finally works, and I think the thing that actually made him viral in late July was these social videos.

And it's just like the idea that there's a man paying 35 young women to pretend pretend to like authentically engage with this app and talk about how it's so helpful in online dating.

And then all these women that signed up because of this, you know, whatever.

All marketing is deception, but it is deception.

And then like be so severely compromised.

It just like, it's a really, really nasty example of this type of marketing, I think.

Yeah.

And I think that kind of leads into one of the couple of other things I was going to ask, which is that what did we learn about T's CEO during this?

Like, this article is not a profile.

It's much more about the growth of the company.

But, of course, him being the founder and the CEO, he does come into that story.

And of course, he's ultimately responsible for everything that's going on here.

What did we learn about Sean Cook, I believe,

in this piece?

So I would say that Sean Cook is like stereotypical San Francisco Silicon Valley executive had what seems like a pretty big job at Salesforce, which is like

a gigantic company, a gigantic tech company, and was there for many years.

And then he leaves, and then he starts this thing, and he's doing like the startup hustle thing and is trying to grow it very badly, and is bootstrapping it, and seemingly has a lot riding on it.

And just, you know, like classic move fast and break things situation, and it's all extremely sloppy.

You know,

he eventually,

you know, we found that on a podcast,

he says you have like a team of developers in Brazil and how great they are.

But we looked into that, and that is just like two freelancers that were hired from like a software engineer freelancing program and in Brazil.

And I'm sure they do fine work.

Like, I'm not disparaging the platform in general, but

if you're looking to

define

why they had these security issues, it's because you know, he did like the quickest, cheapest way that you can develop an app like this.

Yeah.

And just to remind people, the security issue for the driver's license, one at least, the initial breach, was that it was essentially

an unprotected bucket of data that anybody could log into without authentication, which is obviously security 101.

Right.

And he doesn't know anything about programming.

He admitted that as well in some other interview.

And by talking to other people who worked at T,

he doesn't know anything about how to moderate a community, which again is focused on an extremely sensitive, volatile topics.

He has no idea how the legal aspect of it works and what he's liable for and what the users are liable for.

And I think one of like the

it's not the worst thing, but I think it just indicates how

desperate he was to make this happen is

in interviews and on the website and on his LinkedIn, he has like an origin story for

the company, which is about how his mom was dating and he was trying to help his mom because she got cat-fished, essentially.

But one of the things that the messages show, the messages that he sent Sanchez starting in late 2022

is at the time,

it was his fiancé reaching out on T's behalf.

And she says that they started the app together because of her bad dating experiences.

And that relationship ends.

This, his fiancé kind of leaves the company and exits the picture.

And then, like, the story changes.

And it's like, again, that's not

like the worst thing in the world.

Probably the worst thing is once his fiancé leaves, he takes over like this Tara persona that represented T officially on Facebook and in the app.

So it's like if you needed like, if you had a support issue

and you talk to someone in the T app, you were talking to Tara, which presumably was once his fiancé, but then was him.

So he's on the app

pretending to be a woman talking to other women who are on the app in order to like weed out men who are being deceptive in some way.

And

it just like the

dishonesty in that and like the just like betraying people's trust and his users' trust, I think is pretty bad.

Yeah.

How about to round it off?

I will just read out what T's statement was.

Of course, you sent a very detailed list of specific questions and specific facts that we were publishing in this story.

They didn't answer those, but they did say, and this is quite long, so maybe I won't read all of it, but they say, quote, building and scaling an app to meet the demand we've seen is a complex process.

Along the way, we've collaborated with many, learned a great deal, and continue to improve T.

They then say, what we know based on the fact that over 7 million women now use T with over 100,000 new sign-ups per day is that a platform to help women navigate the challenges of online dating has been needed for far too long.

And then it repeats it's one of the top top apps in the US.

All right.

Shall we leave that there?

When we come back, we're going to be joined by our intern, Rosie Thomas, to talk about one of her stories about GPS trackers on TikTok.

We'll be right back after this.

If you've ever tried to hire, you know that finding the best candidate can be like trying to find a needle in a haystack.

You get lots of submissions, but most of them aren't tailor-made for your role, or people might just be applying at random.

But not with ZipRecruiter.

ZipRecruiter finds amazing candidates for you fast.

And right now, you can try it for free at ziprecruiter.com slash 404media.

ZipRecruiter's smart technology identifies top talent for your role starting immediately after you post your job.

ZipRecruiter's powerful matching technology gets to work right away, showing you qualified people that will fit your company and your role.

ZipRecruiter also lets you be proactive, allowing you to send pre-written invite-to-apply messages to reach top candidates before they know your role is open.

It means you get connected with a great candidate faster than ever.

Ditch the other hiring sites and let ZipRecruiter find what you're looking for, the needle in the haystack.

Four out of five employers who post on ZipRecruiter get a quality candidate within the first day.

Try it for free at this exclusive web address, ziprecruiter.com/slash 404 media.

Again, that's ziprecruiter.com slash 404 media.

ZipRecruiter, the smartest way to hire.

This is an ad by BetterHelp.

These days, people will seemingly try anything to improve their mental health, but using the internet these days is like throwing a dart at a dartboard.

Is a cold plunge, gratitude journal, or screen detox going to work for you because it worked for someone on Reddit?

One thing that's long tested and long trusted is talking to therapists to help you get personalized recommendations and help you break through the noise.

Working with a therapist on BetterHelp means that as they get to know you, you'll get stress reduction techniques, coping skills, and proven strategies that are tailored to help you become the best version of yourself.

BetterHelp is easy to use and even easier to fit into your life.

With more than 30,000 therapists who have helped more than 5 million people globally, you'll be in good company.

Join a session with the click of a button, reschedule whenever you need, and switch therapists at any time.

As the largest online therapy provider in the world, BetterHelp can provide access to mental health professionals with a diverse variety of expertise.

Talk it out with BetterHelp.

Our listeners get 10% off their first month at betterhelp.com/slash 404 media.

That's betterhelp, h-e-l-p.com/slash 404 media.

One of the scariest parts of building any business is figuring out who's going to be on your team and what tools you're going to use.

We know from experience and in our experience, one tool you want to have on your team is Shopify, which makes starting and running your business seamless.

Shopify is the commerce platform behind millions of businesses around the world and 10% of all e-commerce in the U.S.

From household names like Mattel and Gymshark to brands that want to be household names like 404 Media.

Setting up a shop is simple with beautiful ready-to-go templates to match your brand style.

Their easy to use backend helps you manage your store's inventory, add new products, or do a total redesign at the snap of a finger.

Shopify also makes it easy to find new customers, so you'll feel like you have a marketing team behind you.

Easily create email and social media campaigns to find new customers wherever they're scrolling or strolling.

Turn those dreams into

and give them the best shot at success with Shopify.

Sign up for your one dollar per month trial and start selling today at shopify.com/slash media.

Go to shopify.com/slash media.

Shopify.com/slash media.

And

we are back.

Rosie, thank you for joining us.

This headline for one of your stories is: TikTok shop sells viral GPS trackers marketed to stalkers.

So there's a lot of video here.

We're not going to show it right now.

I'm just going to let you describe it.

Could you just describe one of these videos?

What are we seeing in one of these TikToks?

Yeah, so

the videos are extremely creepy,

in my opinion, anyway.

And they basically show kind of

repeated shots of a little black tracker being stuck to like different areas of a car.

So, kind of under the mirror or like between the seats or

like magnetically to the underneath of the engine.

And then there's a lot of these videos, and they all have different voiceovers, but the voiceovers are basically kind of like encouraging people to

track their partners if they think their partners are cheating.

So it's kind of like, if you think your girl is out with friends every night, you should put one of these on her car.

Or,

you know, not everybody who uses this is crazy.

They just want answers.

And so

they're very much being framed as a way to kind of

calm somebody's

suspicions about a cheating partner.

One of them says, don't let what happened at the Cold Play concert happen to you.

And obviously, Jason has reported on the Cold Play concert in the recent past.

So the way I see this is obviously in the context of, yeah, stalkerware, abusive partners, that sort of thing.

Way back at Motherboard, when we worked there before we launched 404 Media, me and our colleague at the time, Lorenzo, we did a big series about stalkerware, which is where abusive partners would get their partner's mobile phone, using Android.

They would install spyware on it, which would track their physical location, record their text messages, listen to their phone calls, maybe get their emails, all of that sort of thing.

And this just seems to be obviously very much in the same realm.

When you first saw the, well, and so there's that element.

And then the second is that it is being marketed so openly on TikTok and TikTok shop that we'll talk about shortly.

Rosie, what did you think when you saw this, not on some weird underground forum, but right there on TikTok?

Like, what did you make of that?

I think it's interesting because

these trackers exist.

I mean, trackers exist in

like a

like Apple AirTags exist and people can buy Apple Air tags.

But the fact is that selling an Apple AirTag with like a very overt and explicit encouragement that the person who is being tracked by the AirTag shouldn't know about it is

fundamentally like

disturbing, I would say.

Yeah.

Sam, you've reported on Apple's AirTags and how that was used.

uh in stalking can you just briefly briefly remind us about that because

everybody knew that was going to be a problem.

Apple introduced these mechanisms where, well, your phone should get alerted if an AirTag is nearby you and that sort of thing.

But that didn't always work out to be the case.

What did you report at the time, Sam, when it came to AirTags and Apple?

Yeah, I mean, this was an ongoing beat for a couple of years, I would say, in like 2023, 2022.

Obviously, it's still a problem that's ongoing.

If I recall correctly, and it's been a while, the reason why we were started reporting on this originally was because we reached out to a bunch of police departments and got a bunch of like incident reports and

narratives back from when people had called the cops or like filed reports about stalkers and

exes and abusers.

who were stalking them via air tags and they were leaving air tags like in their cars or like exactly what Rosie saw on TikTok and what she's describing is taking the air tag and putting it like in the gas like

tank door

in the wheel wells.

I wrote a story about this woman who was fighting for custody of her kids and she

her ex-husband was putting the air tags like in her kids clothes to track her.

And police at the time just kind of like didn't know what to do with that information.

They were kind of like, well, what's an air tag?

And even judges in some of these cases were like, what are you talking about?

That's ridiculous.

And now I think it's become so mainstream that it's something that like a TikTok ad

is using because they know it gets engagement.

I'm sure it gets hate engagement.

I'm sure it gets actual authentic engagement where people are like, oh, that's a useful thing that I want.

But yeah, it's actually, it's like a real problem that a lot of people have and a lot of people deal with is

these tags.

and it's not just Apple's tags, but they are the most popular

being put on their stuff to follow them around by like very pinpointed location to see where they are and when they went somewhere.

Yep.

Yeah.

I have a researcher who reached out, and I'm saying this now to hold myself accountable.

I will reply again to you shortly, but they have something very interesting in this area as well, where basically people can't be tracked and they're not receiving alerts.

And I'll get back to that as soon as I can.

But there's this other component here, Rosie, which is that it's not just people making TikToks and going, ha look at this, I'm being really weird or whatever.

There's a TikTok shop.

Can you just explain to those who don't know what exactly the TikTok shop is?

Like, are they, is the individual user advertising the item for sale?

Like, what's the deal with TikTok shop?

I think there are a different, there are a couple of different things that can be happening with TikTok shops.

So an individual user can be making videos that are for products that they're selling, or they can kind of be

like

contracted to make videos for another user or another organization.

And it's basically creating adverts for different products.

And so

by allowing these videos on the platform, TikTok is saying

it is okay to advertise in a way that encourages coercive control.

Yeah, that makes sense.

So, what's the legality here?

I would say that when law enforcement gets a GPS tracker to put on somebody's car, they have to get a warrant, which presumably means that just throwing a GPS tracker into the back of someone's car is probably

illegal.

But what's the legality as far as you understand it here?

So, as far as I understand it, there are certain states that don't include

tracking as a form of stalking, but stalking is obviously a crime in every state.

There are 11 US states that have kind of an explicit law that says you cannot track somebody using a GPS-enabled tracker, and then 15 further states which say

it's not legal to track a car without the consent of the owner.

So, the law varies between states, but obviously coercive control and harassment and domestic violence are

illegal.

Like those are crimes.

Yeah.

And again, it reminds me of the stalkerware stuff because sometimes we would cover that.

And from a technical point of view, it is very, very boring.

Like there's no fancy exploits.

It's not being delivered over the air.

It's not delivered via text message.

You have to go grab the Android device, plug it in, install the Android APK, or with an iPhone, you have to jailbreak it.

And that's very, very difficult if you're using a modern iPhone, if not impossible for an ordinary person.

And then you get to spy on the person.

And because of that,

A lot of people in information security at the time didn't think it was like very interesting.

They're like, well, you just have to grab the phone.

Like, why do we care about this?

You're missing the security context of that this is happening inside a domestic violence situation where an abusive partner can just demand their spouse to turn over the phone, or they may face physical violence, or they may trick them, or they may coerce them, or anything like that.

So, I find it pretty shocking that TikTok is

openly facilitating the sale of these sorts of things.

And I can't remember off the top of my head, but we've done very similar stories where GPS trackers are being sold, or PI services are being sold on Fiverr, for example.

What did

TikTok tell you and what action did they take, if any?

So

one thing that I would say is that we did find reviews of these trackers that said that they basically were alerting the users and that they weren't like being undetectable in the way that they were being sold.

And one of the reviews was like, this defeats the purpose of the reason that I bought it.

So I do think that there are people who are buying this kind of credibly and deliberately

with the intent to do what is shown in the videos.

And TikTok, when we spoke to them,

basically said, this isn't allowed.

We don't allow content encouraging people to use devices for secret surveillance and have removed this content and banned the account that posted it.

We further prohibit the sale of concealed video or audio recording devices on our platform.

And so they banned the account that I had shown them, you know, a specific account where I'd said these videos are very creepy.

But then the next day, I was able to find a bunch more of the same videos or very similar videos with very similar voiceovers.

Yeah, I guess just to clarify that, how many accounts are we talking about?

And of course, you won't have found every single account on TikTok doing this.

That would require, you know, like some sort of systematic research effort.

But like, how many are we talking about?

Like three, four, five, half a dozen?

Or?

So I found the next day probably 30 of the same videos, and they're from a bunch of different accounts.

And the devices themselves are still for sale.

Yeah, that makes sense.

All right.

We will leave that there.

If you're listening to the free version of the podcast, I'll now play us out.

But if you are a paying for a full media subscriber, we're we're going to talk about how Elon Musk's Grok chatbot exposed its prompts.

And we'll talk about what those prompts are.

And maybe I'll save what they exactly said for that actual section.

I don't even really want to preview it here, although you could go read the really offensive headline that we decided upon.

You can subscribe and gain access to that content at 404media.co.

As a reminder, 404 Media is journalists founded and supported by subscribers.

If you do wish to subscribe to 404 Media and directly support our work, please go to 404media.co.

You'll get unlimited access to our articles and an ad-free version of this podcast.

You'll also get to listen to the subscribers only section where we talk about a bonus story each week.

This podcast is made in partnership with Kaleidoscope.

Another way to support us is by leaving a five-star rating and review for the podcast.

That stuff really helps us out.

Here is one of those from Kussy2344.

The 404 crew do great original reporting, and every single story on the podcast is worth engaging with.

Thank you so much.

This has been 404 Media.

We'll see you again next week.

Start the season with Etsy and make your holiday traditions extra special.

On Etsy, you'll discover original pieces from small shops that will help you celebrate your way.

Shop Etsy for holiday decor that makes you feel seen.

Special starts on Etsy.

Tap the banner to shop now.