Introduction
Imagine sending a small Bluetooth tracker across the ocean, hidden inside a humble postcard, and watching a naval vessel's journey unfold on your phone. This is exactly what Dutch journalist Just Vervaart did in 2023, using a method posted on the Dutch government's website to track a naval ship from Crete toward Cyprus for nearly 24 hours. While the tracker was discovered within a day of the ship's arrival, the incident revealed how easily such devices can be inserted into mail streams and used for surveillance. This guide explains the technique he used, detailing the steps to hide a Bluetooth tracker in a mailed item — for educational purposes only. Always respect privacy laws and obtain proper authorization before attempting any form of tracking.
What You Need
- A small Bluetooth tracker (e.g., Apple AirTag, Tile Mate, or similar device) — compact and lightweight.
- A postcard or thin, flat envelope — standard size, no lumps or bulges that might arouse suspicion.
- Strong adhesive or double-sided tape to secure the tracker inside the card.
- Scissors for cutting the postcard if needed to create a hidden pocket.
- An envelope (if not using a postcard directly) to disguise the tracker further.
- Shipping label and postage — address the item to a location you can monitor (e.g., a ship's mailroom).
- A smartphone with the tracker's companion app installed and configured.
Step-by-Step Instructions
-
Step 1: Select and Prepare the Tracker
Choose a Bluetooth tracker that is small enough to fit inside a postcard without causing a noticeable bump. Remove any metal casing or packaging that could interfere with the Bluetooth signal. Activate the tracker according to the manufacturer's instructions and ensure it is paired with your phone. If the tracker has a replaceable battery, insert a fresh one to maximize battery life — you'll want it to transmit for as long as possible.
-
Step 2: Disguise the Tracker Inside the Postcard
Take a standard postcard and carefully cut a slit along one edge to create a small pocket, just large enough for the tracker. Alternatively, you can use a greeting card with a fold. Place the tracker inside the pocket and secure it with adhesive so it doesn't shift during transit. Close the card and press firmly to flatten any bulge. The goal is to make the postcard look as ordinary as possible — no extra thickness or stiffness that would alert mail sorters.
-
Step 3: Address and Mail the Item
Write or print the recipient's address clearly on the postcard (or on the envelope if you use one). For the Dutch ship scenario, the journalist followed official government guidelines for mailing items to the vessel. Use a standard stamp and send the item through regular mail. Avoid using express or tracked services that might require extra scanning. Drop the postcard in a public mailbox far from the target to avoid raising suspicion.
-
Step 4: Monitor the Tracker Remotely
Once the postcard is in the mail stream, open the tracker's app on your smartphone. You should see the device's location updates as it travels through postal sorting facilities, trucks, and eventually onto the ship. In the original incident, the journalist tracked the vessel for about a day while it sailed from Heraklion, Crete, then turned toward Cyprus. Keep in mind that Bluetooth range is limited — the app typically relies on nearby smartphones to relay the tracker's position (crowd-sourced location). The more populated the area, the more accurate the tracking.
Source: www.schneier.com -
Step 5: Be Aware of Detection and Removal
Navies and security-conscious organizations now screen incoming mail more carefully. The Dutch navy reported that the tracker was discovered within 24 hours of the ship's arrival, during mail sorting, and was disabled — likely by removing its battery or crushing it. Since this incident, the Dutch authorities have banned electronic greeting cards, which, unlike packages, were not x-rayed before being brought on board. If you attempt this method, expect that security personnel may find the device, especially if they use metal detectors or X-ray scanners. The tracker's signal can also be detected by Bluetooth scanners.
Tips for Success and Caution
- Choose a tracker with a long battery life — some trackers last up to a year, but the journey may take weeks. Turn off any unnecessary features like audible alerts.
- Avoid metal enclosures — metal blocks Bluetooth signals. The postcard should be made of paper or thin cardboard only.
- Test the tracker beforehand — mail a dummy card to your own address to ensure the tracker survives the postal system and provides accurate location data.
- Respect legal boundaries — in many jurisdictions, tracking people or property without consent is illegal. This guide is for informational purposes only, based on a publicly documented journalistic investigation. Always consult local laws and obtain necessary permissions before any tracking activity.
- Consider the ethical implications — even if technically possible, covert tracking can invade privacy and create security risks. The Dutch navy's quick discovery shows that such methods are not foolproof and may lead to countermeasures.
For more on related surveillance techniques, see our Tips section above on detection avoidance. Remember that the original incident led to policy changes — what works today may be blocked tomorrow.