I’ve worn and owned a lot of Apple Watches over the years. But the watch I love is my Tudor Black Bay GMT.
It’s mechanical. A mainspring, a set of gears, and a lot of craftsmanship packed into a steel case. No battery, no Bluetooth, no app. It tells me the time here and the time somewhere else, and it keeps no record of where I wore it. I like my Apple Watch for what it does. I love the Black Bay for what it doesn’t.
I’ve been thinking about that difference since reading “Your Apple Watch & the Surveillance Economy” from Watches of Espionage, written by a former CIA case officer. Apple just added features to the Apple Watch that can record the audio around you and turn your day’s conversations into a transcript. It’s opt-in, and I can see why people will want it. But the author made a point worth sitting with. Nobody had to discover this as a vulnerability. Apple put it on the box and sold it.
The net is always listening
As a radio operator in Afghanistan, I worked from one assumption. Anything you put on the net, someone else might be hearing. So you kept it short and said what the mission needed, nothing extra.
The radio was never the problem. How you used it was. The military learned the wearable version of that lesson the hard way. In 2018, a fitness app’s public heat map traced the outlines of bases, including one in Niger that wasn’t supposed to be known. Nobody hacked anything. Service members wore a watch, went for a run, and the app shared it by default. Two years later a researcher identified 14 British special operators the same way, using nothing but the app’s standard settings.
Same problem, different uniform
I think that’s the part most business owners miss. We spend real money keeping attackers out. Then we hand data out the front door ourselves, through tools we picked and never configured.
The AI notetaker that joins every client call and keeps the transcript. The camera system that uploads your office to someone else’s cloud. The company phones sharing location with a dozen apps. The step challenge you rolled out for team morale.
Every one of those can earn its place in your business. But you bought them, approved them, and somebody clicked accept. That makes the settings your responsibility.
Where we get it backward
We treat risk as something that happens to us. The risk we choose is harder to see, because choosing it feels like control.
The article lays out what happens after you click accept. Data brokers buy this information, package it, and resell it with no expiration date. And deleted doesn’t always mean gone. Earlier this year, the FBI recovered doorbell footage that looked deleted, pulled from the company’s backend systems. The owner thought it was erased. The company still had it.
What I actually do
I’m for this technology. I’ll keep wearing an Apple Watch, and I spend most of my day building with AI tools. The answer isn’t running from it. It’s using it on purpose.
So before something new goes on my wrist or into the business, I want two answers. What does it collect by default? And who else ends up holding it? If I can’t answer both, I don’t turn it on until I can. That usually costs me an afternoon reading settings, not the tool itself.
The author’s advice is to switch to a mechanical watch, and I don’t need convincing. The Black Bay is the one I’d keep if I could only keep one. But I’m not willing to give up what the smart one does either. So I wear both, and I own the settings on the one that talks back. Same goes for your business. Use the tools, take the advantage, and make sure you’re the one deciding what they share.
So here’s this week’s pause point. Think about the last tool you rolled out to your team. Do you know what it’s collecting right now, and did you decide that, or did the default?
Thanks for pausing with me. If any of this connects to what you’re dealing with, you can find more of what we do at itauditlabs.com.
Common Questions Asked
Wearable devices can collect sensitive information, including location history, health data, activity patterns, and potentially audio recordings. Depending on the device, application, and privacy settings, this information may be stored or shared with third parties, creating potential privacy and security risks.
Yes. Smartwatches and other connected devices can introduce security risks when employees use them in professional environments. Location tracking, connected applications, and data-sharing permissions can potentially expose sensitive business information if not properly managed.
Businesses can reduce risks by reviewing device permissions, limiting unnecessary data collection, establishing clear device-use policies, and educating employees about privacy settings. Understanding what information a device collects and where that information goes is an important first step.
Default settings may enable data collection, cloud storage, or information sharing that users don’t fully understand. When organizations adopt new technology without reviewing these settings, they may unintentionally expose sensitive information.
Operational security focuses on protecting sensitive information that could reveal activities, locations, or patterns. Wearable technology can unintentionally expose this information through location tracking, fitness applications, and other connected features.
