UPS Tracking Hack Can Reveal iPad Orders and Destinations

I ordered two iPads – one to keep and another to give away as a door prize at Tech Field Day next week. Like the many fanboys I interact with, I was excited to track my iPad’s progress as it left Shenzhen, China, landed in Anchorage, Alaska, and worked its way to my door. But I noticed something odd about my UPS tracking numbers, and it inspired a hack that could reveal the true number of iPads to be delivered as well as their destination, two pieces of information Apple does not want us to know!

Note: No, the iPad is not a Hoax!

The UPS China-Alaska Route

As discussed over at ZDNet yesterday, items shipped by air from China normally stop in Anchorage, Alaska on their way to the United States. This reduces the amount of fuel needed, thus increasing the amount of cargo that planes can carry. UPS, it seems, ships from Hong Kong through Anchorage on the way to their “Worldport” hub in Louisville, Kentucky.

Although Anchorage might seem pretty far north to be on the way from Hong Kong to Louisville, the opposite is actually true. The ideal “great circle” route between the two cities actually passes far to the North of Anchorage, way up near the North Pole! Anchorage also provides an ideal location for freight processing on the way to the United States, explaining why both FedEx Express and UPS Airlines have such a major presence there.

Tracking Your Package

So pretty much every iPad to be delivered on Saturday is passing through the FedEx and UPS tracking systems on the way to the United States. And every one of these pre-orders is accompanied by a tracking number. Interestingly, Apple is shipping each iPad in multiple orders as a separate package. So those who ordered two will get two tracking numbers. This was my first insight.

Although my iPads were ordered at the same time, the tracking numbers were not merely one digit off. Although the first 15 characters were identical, the last two were off by nine digits – one was “74” and the other was “83”. My experience with coding suggested that the last character might be a check digit, making the packages numbers a more logical 7 and 8 sequence.

A quick Google search revealed that this is indeed true – the standard UPS format is “1ZAAAAAATTIIIIIPPC”, where AAAAAA is the account, TT is the service type, IIIII is the invoice, PP is the package, and C is the check digit. These numbers are not encrypted or at all random, and CodeProject has a complete decoding method.

Exploiting the Sequence

As a public company, Apple has been coy about releasing exact order numbers. And there is a great deal of marketing value in knowing the distribution of iPad orders around the country. But the UPS tracking numbers can be used to obtain both of these pieces of information!

The check sequence is super-simple to work with. In fact, one can just incrememt the package number and decrement the check code to obtain neighboring packages. For example, given my tracking number ending in “74”, I could substitute “65”, “56”, “47”, “38”, and “29” to obtain valid tracking numbers for 5 other packages. Entering these on the UPS web site reveals iPads heading to Brooklyn, NY, Los Angeles, and Corona, CA.

Since the iPads are all shipping together, I can assume that these are all iPad orders. I can even see the package weight (1.4 kg) to validate that they’re iPads. UPS helpfully links multiple shipments together, so I can see that the fellows in Brooklyn and Corona are only getting one, while the Angelino has two on the way!

Given a bit of programming expertise, a financial analyst could easily generate a bunch of valuable data:

• Exactly how many iPads are shipping via UPS this week
• Apple’s approximate gross revenues on these iPads
• The percentage of customers ordering two
• The distribution of iPad ownership across the country

Scarier is what could happen in a place like little Ellendale, North Dakota. Even though UPS does not reveal the exact address of packages in this way, one iPad package is heading to tiny (population 1456) Ellendale. How many of Ellendale’s 603 households would have ordered an iPad? I imagine any resident could name the 2 or 3 likely families, and rattle off their addresses as well. And a dishonest resident could track exactly when that package was delivered. I certainly hope they’re all upstanding citizens!