How Apple Wi-Fi Positioning System can be abused to track people around the globe

Researchers at the University of Maryland demonstrated that Apple's Wi‑Fi Positioning System (WPS) design allows opportunistic return of up to several hundred nearby BSSIDs and, because the API is unauthenticated and unrate‑limited, they were able to compile ~490 million geolocated BSSIDs worldwide; this capability can be abused for mass surveillance, tracking of individuals, groups, and sensitive sites. The paper documents scenarios (e.g., tracking homes, military movements, travel routers, Starlink terminals), reports coordinated disclosure to vendors, and recommends mitigations including appending _nomap_ to SSIDs and implementing BSSID randomization.