Bluetooth tracker hidden in a postcard and mailed to a warship exposed its location — $5 gadget put a $585 million Dutch ship at risk for 24 hours

HNLMS Evertsen, a Dutch air-defense frigate part of the NATO carrier strike group centered on the French carrier Charles de Gaulle, has inadvertently revealed its position after receiving a postcard containing a hidden Bluetooth tracker. According to The Register, the Dutch Ministry of Defense posted instructions online to make it easier for family and friends to communicate with personnel aboard a navy ship, but didn’t fully consider the ramifications for operational security (op-sec).

Bluetooth trackers like the Apple AirTag cost $29 a piece, but there are cheaper, generic versions available on Amazon that cost $10 for two trackers. By allowing a potential adversary to track the ship in real-time, it could put the vessel and the entire strike group at risk, as that information can be used for other operations against the fleet. The fact that it was mailed in meant that spies do not even need to go near the ship to place a tracker on the $585 million Navy ship.

Dutch journalist Just Vervaart, working for regional media network Omroep Gelderland, followed the directions posted on the Dutch government website and mailed a postcard with a hidden tracker inside. Because of this, they were able to track the ship for about a day, watching it sail from Heraklion, Crete, before it turned towards Cyprus. While it only showed the location of that one vessel, knowing that it was part of a carrier strike group sailing in the Mediterranean could potentially put the entire fleet at risk.

Article continues below

Navy officials reported that the tracker was discovered within 24 hours of the ship's arrival, during mail sorting, and was eventually disabled. Because of this incident, the Dutch authorities now ban electronic greeting cards, which, unlike packages, weren’t x-rayed before being brought on the ship. This isn’t the first time that operational security aboard naval ships has been compromised through carelessness. Just last month, a French officer aboard the Charles de Gaulle posted their running time and route on Strava. This revealed the carrier’s location in the Mediterranean, as open-source intelligence could potentially identify the said officer and their position within the French Navy.

A more egregious incident was reported in 2024, when the USS Manchester, a US Navy littoral combat ship, was found to have an unauthorized Starlink terminal that sailors used to access the internet while at sea. The Wi-Fi network, called “STINKY,” was eventually discovered by officers after six months of being installed on the ship’s O-5 level weatherdeck, where it cannot be easily seen and could be mistaken for part of the ship’s official equipment.

New technologies have always been a problem for many militaries and security forces, as seemingly innocent features like checking in on social media and posting on apps reveal personnel's locations, schedules, and habits. While this might not be an issue for most civilians, these data give intelligence agencies a treasure trove of open-source information they can use to infer or confirm data.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.