Bluetooth tracker hidden in a postcard and mailed to a warship exposed its location — $5 gadget put a $585 million Dutch ship at risk for 24 hours

Warship at sunset in the sea
(Image credit: Getty Images)

HNLMS Evertsen, a Dutch air-defense frigate part of the NATO carrier strike group centered on the French carrier Charles de Gaulle, has inadvertently revealed its position after receiving a postcard containing a hidden Bluetooth tracker. According to The Register, the Dutch Ministry of Defense posted instructions online to make it easier for family and friends to communicate with personnel aboard a navy ship, but didn’t fully consider the ramifications for operational security (op-sec).

Bluetooth trackers like the Apple AirTag cost $29 a piece, but there are cheaper, generic versions available on Amazon that cost $10 for two trackers. By allowing a potential adversary to track the ship in real-time, it could put the vessel and the entire strike group at risk, as that information can be used for other operations against the fleet. The fact that it was mailed in meant that spies do not even need to go near the ship to place a tracker on the $585 million Navy ship.

Dutch journalist Just Vervaart, working for regional media network Omroep Gelderland, followed the directions posted on the Dutch government website and mailed a postcard with a hidden tracker inside. Because of this, they were able to track the ship for about a day, watching it sail from Heraklion, Crete, before it turned towards Cyprus. While it only showed the location of that one vessel, knowing that it was part of a carrier strike group sailing in the Mediterranean could potentially put the entire fleet at risk.

Article continues below

Navy officials reported that the tracker was discovered within 24 hours of the ship's arrival, during mail sorting, and was eventually disabled. Because of this incident, the Dutch authorities now ban electronic greeting cards, which, unlike packages, weren’t x-rayed before being brought on the ship. This isn’t the first time that operational security aboard naval ships has been compromised through carelessness. Just last month, a French officer aboard the Charles de Gaulle posted their running time and route on Strava. This revealed the carrier’s location in the Mediterranean, as open-source intelligence could potentially identify the said officer and their position within the French Navy.

A more egregious incident was reported in 2024, when the USS Manchester, a US Navy littoral combat ship, was found to have an unauthorized Starlink terminal that sailors used to access the internet while at sea. The Wi-Fi network, called “STINKY,” was eventually discovered by officers after six months of being installed on the ship’s O-5 level weatherdeck, where it cannot be easily seen and could be mistaken for part of the ship’s official equipment.

New technologies have always been a problem for many militaries and security forces, as seemingly innocent features like checking in on social media and posting on apps reveal personnel's locations, schedules, and habits. While this might not be an issue for most civilians, these data give intelligence agencies a treasure trove of open-source information they can use to infer or confirm data.

Google Preferred Source

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.

TOPICS
Jowi Morales
Contributing Writer

Jowi Morales is a tech enthusiast with years of experience working in the industry. He’s been writing with several tech publications since 2021, where he’s been interested in tech hardware and consumer electronics.

  • Notton
    While this might not be an issue for most civilians...
    Car thieves will attach Bt trackers onto luxury cars so they can steal it at a later date. Good luck finding the tracker, because they are easy to hide.

    Internet Stalkers will hide them in presents to their victims to doxx them. Which is why many agencies no longer accept gifts from fans.
    Reply
  • 1_rick
    The "journalist" was arrested, right?
    Reply
  • chaos215bar2
    Bluetooth has a range measured in tens of feet. Maybe hundreds with zero artificial interference.

    Technically the Bluetooth tracker here did nothing other than ping nearby phones. It's the phones that then received that ping and transmitted the tracker's ID along with coordinates to, presumably, Apple.

    Why are phones with AirTag tracking enabled allowed at military posts at all? This seems to be a threat model that wasn't even considered when Apple decided to turn every phone they sell into a participant in a worldwide tracking network.
    Reply
  • chaos215bar2
    Notton said:
    Car thieves will attach Bt trackers onto luxury cars so they can steal it at a later date. Good luck finding the tracker, because they are easy to hide.
    Cell tracker, maybe. Bluetooth trackers either don't have the range or would trigger the owner's phone to notify them they're being tracked. (Which is very likely how this tracker was found.)

    Unless they don't use a smartphone, which is a legitimate hole in that mitigation for using these to track other people's property.
    Reply
  • bit_user
    chaos215bar2 said:
    Bluetooth has a range measured in tens of feet. Maybe hundreds with zero artificial interference.

    Technically the Bluetooth tracker here did nothing other than ping nearby phones. It's the phones that then received that ping and transmitted the tracker's ID along with coordinates to, presumably, Apple.
    This.

    IMO, the real question is why smartphones are allowed onboard. When service members board the ship, they should be forced to turn over their phones and tablets, which should be placed in a RF-proof box and kept until the sailors take shore leave. No cell phones = no Air Tags phoning home (or the equivalent, for Android).

    I'm sure it'd be annoying for the sailors to go without their smartphones, but the ship should provide for communication and entertainment needs.
    Reply
  • bit_user
    chaos215bar2 said:
    Cell tracker, maybe.
    These days, I think phones will tell you when there's an air tag moving along with you that's not yours (i.e. not registered to your phone).
    Reply
  • froggy97
    Ships can be seen from space. Everybody knows where they are all the time.
    Reply
  • DeadHeadPhred
    What potential enemy doesn’t already know the position of that ship?
    Reply
  • USAFRet
    DeadHeadPhred said:
    What potential enemy doesn’t already know the position of that ship?
    Is it possibly capturing and transmitting more than just 'position'?

    ID of any nearby devices. Which could be then analyzed and collated when those devices move offship.
    Given enough data points, lots of otherwise unclassified information could be derived.
    Reply
  • doughillman
    chaos215bar2 said:
    Bluetooth has a range measured in tens of feet. Maybe hundreds with zero artificial interference.

    Technically the Bluetooth tracker here did nothing other than ping nearby phones. It's the phones that then received that ping and transmitted the tracker's ID along with coordinates to, presumably, Apple.

    Why are phones with AirTag tracking enabled allowed at military posts at all? This seems to be a threat model that wasn't even considered when Apple decided to turn every phone they sell into a participant in a worldwide tracking network.

    Oh, I'm sure it was absolutely considered, and Apple's conclusion was, "Eh. Not our problem if it gets abused."
    Reply