SEATTLE - Two University of Washington researchers say holiday gift-givers may unwittingly give their favorite athlete a workout accessory that can double as a tracking device.

In a report posted online at http://www.cs.washington.edu/research/systems/privacy.html, Scott Saponas, a doctoral student in computer science, and Yoshi Kohno, assistant professor of computer science and engineering, say the Nike+iPod, which is marketed to runners, may be equally attractive to stalkers and thieves.

The Nike+iPod consists of two parts. One piece is a chip the size of a dinner mint that acts as a pedometer, which runners slip into their shoe. The other piece is a receiver that fits into an iPod Nano and stores information beamed from the person's foot. After a workout, the runner can upload the data and use a Nike software program to track distance, speed and calories burned.

AP

The Nike+iPod sensor transmits messages using a wireless radio.

It's a great idea, except it allows others to track your every step as well.

"An electronics hobbyist could create this in a day or two," said Saponas.

Saponas and Kohno discovered a security flaw in the system that allows people to watch the whereabouts of a sport kit user in real time, by setting up a simple network of wireless receivers.

"Imagine putting one near the work out facility, the cafeteria and the dorm. Now you have a way of tracking someone who you know has the Nike+iPod Sport Kit where they go throughout their day.

"One nightmare scenario is the jealous boyfriend is stalking you because he knows you have this in your shoe," said Saponas.

And what's more disturbing, you don't even have to have purchased one of the kits to fall prey.

"You could slip this into somebody's shoe or pocket or backpack and potentially you could track someone that way, also," said Saponas.

Nominated by Time Magazine as a 2006 “Gadget of The Year,” about 450,000 of the $29 Nike+iPod Sport Kits have been sold so far. 

Though it has an “off” switch, the sensor is sold with the power on. Saponas and Kohno say most users likely wouldn't bother to remove the gadget and turn the power off after each workout.

"There's a bigger issue here," said Kohno. "When people buy a toaster, they know it's probably not going to blow up when they plug it in. But when they buy a consumer device like the Nike+iPod kit, they have no idea whether the device might enable someone to violate their privacy. We need to change that."

Saponas and Kohno say they have sent the results of their research to both Apple and Nike, but have not yet received a response.