Australian police officers can be tracked using publicly available Bluetooth apps due to a design flaw in a popular line of tasers and body-worn cameras.

In an interview with Four Corners, an unnamed, Victoria-based hacker demonstrated how police officers could be tracked to their exact coordinates using one of several publicly available apps in the Android app store.

The man found such apps – which are typically designed to detect nearby Bluetooth devices – could pick up tasers and body-worn cameras used by Australian police.

“I was just logging Bluetooth devices on my phone … and started seeing body-worn cameras and tasers appear in the logs and [thought] that's a bit odd,” the man told Four Corners.

Specifically, the man tracked a line of tasers and cameras developed by US tech giant Axon.

Positioned near a police station, the man gradually received at least ten notifications which alerted him to the presence of nearby police officers.

He was then able to produce the police devices’ latitude, longitude, model and serial number, according to ABC News.

Notifications trickled through as the app picked up nearby devices. Source: Four Corners, Sissy Reyes

Notably, the vulnerability was made possible due to the use of MAC addresses – a unique identifier that can be used to determine a device’s manufacturer.

Though tracking risks are typically mitigated using MAC address randomisation techniques, the anonymous hacker found Axon had failed to do so.

“It just seems like the engineers who developed this were either ignorant or incompetent," he said.

Axon sells tasers to more than 18,000 law enforcement bodies, including those in Australia, while its Axon Body 2 cameras have been deployed in “more major cities than any other police body camera”, according to its website.

Tracking beyond 400 metres

The hacker claimed that custom-made software he developed could operate at distances up to 400 metres.

This range could purportedly be extended using low-cost, Bluetooth scanner units – raising concerns over the possibility of pre-planned criminal operations involving police locations.

“Essentially, it can be weaponised," the man said.

He determined that with the right assortment of hardware, a malicious actor could track police in real-time and potentially detect raids from kilometres away.

Notably, the hacker said he’d broached Australia’s police and national security agencies about the vulnerability.

In his home state of Victoria, repeated warnings that Axon-brand tasers could “leave the entire force essentially wearing beacons that broadcast their location” were allegedly left without a response.

“Im trying to make you realize the danger that frontline officers face due to this vulnerability,” the man wrote to police in 2024.

How are police responding?

After conducting its own testing, a Victoria Police spokesperson told Information Age the agency “hasn't had any issues with unauthorised access or tracking of Tasers or body-worn cameras over Bluetooth or Wi-Fi”.

“While devices are discoverable over Bluetooth and Wi-Fi, they have in-built security features to prevent them being accessed or interfered with,” they said.

“Security advice from the supplier confirms this.”

NSW Police Force confirmed it was “aware” of the security concerns, but was confident in similar security advice.

"Applications, software and methods designed to 'track' or monitor police activity by criminals are not new or unique to Axon devices," it said.

"This type of activity presents ongoing challenges for all law enforcement agencies."

An example of countless Bluetooth tracking apps available on app stores. Source: Supplied

A South Australia Police (SAPOL) spokesperson said the agency was “currently transitioning” to Axon’s latest T10 taser model, but would not be using Bluetooth to integrate them with any body-worn video systems.

“As SAPOL did not purchase Axon body-worn components, Bluetooth functionality has never been a consideration,” they said.

The Australian Federal Police echoed that police tasers and body-worn cameras “have in-built security features that prevent them being accessed or interfered with remotely”, while Queensland Police and Tasmania Police told Information Age they were finalising their responses.

At the time of writing, Information Age has not received a reply from Western Australia Police Force or Northern Territory Police Force.

US border patrol shuts down Axon equipment

Notably, a disclaimer on Axon's trust and security page acknowledges "Axon Cameras' Bluetooth and Wi-Fi radio signals can be generally detected".

Buried in its ‘Trust Center’, Axon recommends clients make “operational security considerations” for its cameras. Source: Axon

ABC News reported the alleged security flaw is already being exploited overseas.

US Border Patrol agents were reportedly told to stop using Axon body cameras in the field after potential tracking-related risks were uncovered in the devices last year.

The interviewed hacker noted the tracking flaw occurs at the hardware level – meaning Axon “can’t patch it” or simply “update the software”.

“The whole system would have to be redesigned from scratch … so if they were forced to recall the devices, they'd be put in a horrible position,” he said.

Axon has been contacted for comment but did not respond prior to publication.