Following on from Part One here…

We were contacted by someone from NW Hub, who said they would try to locate our AirTag and return it to us. Excellent! With the tracking information for the parcel, they were able to ascertain the exact route it took through the labyrinthine escalator system of NW Hub. All the belts are enclosed, so it seemed likely the AirTag had come out of the Jiffy bag when it was split open, and was now underneath one of the belts resting on an inspection panel. Perhaps an engineer could remove a few panels and the AirTag would drop out?

There was also the very curious question of how the Jiffy bag came to be split open in the first place? We surmised that it had been “wooshed” through some rubber rollers at high speed, the AirTag had stuck and the envelope carried on, ripping the tag out through the end of the Jiffy bag. It turns out that’s not how it works, and letters are scanned from above with cameras, in any orientation (presumably they have to be face up) as they go along the belts. It also transpired that the small, light, Jiffy bag should not have been in NW Hub at all (!). Remember back to 25th Dec when the parcel went here before it went into NW Hub?

That is a “Mail Centre” where they pre-process the mail. Apparently, the machines at NW Hub can’t handle items lighter than 50g – they tend to fall off belts, don’t go around bends properly, etc. So the MC should have detected that and not sent it over the road to NW Hub. Where and how did the envelope get ripped, though – still a burning question!

Our contact had a CAD drawing of the machinery in the Hub as shown in the below image. They overlaid the location data we had for the AirTag onto the drawing, and with knowledge of which belts on which floor the parcel went along (from the RM tracking data), they were able to home-in on where the tag might be.

Engineers were dispatched to remove inspection panels in the section of the line the tag was most likely to be in…

But it wasn’t there.

As a poignant footnote to this blog, in early Nov-23 it was announced that “Royal Mail loses 360-year monopoly on delivering parcels from Post Office sites“, and it was noted that “Industry sources said the decision was the result of increasing dissatisfaction at the Post Office with Royal Mail because of customers complaining about the standard of service.”
We can’t help thinking this is not unrelated 😉

Our founder Alex and his friend Andy Stanford-Clark are sharing one of their fun experience here so grab some popcorn, settle down in a comfy armchair, and get ready for a journey that’s been in progress for quite a long time.

This project was conceived in October 2022, when we had some problems sending parcels to customers in the UK. Untracked parcels were sometimes disappearing, so we had to send out a replacement. Sometimes they didn’t arrive at all, or sometimes they showed up weeks later. We started using Tracked 48, which supposedly takes 48 hours, but we were finding these typically took a week to 10 days. So we mocked on Twitter the ridiculous “48” title of the service. Some speculated that “480” might set more realistic expectations. i.e. 20 days. Or a 48% chance of being delivered on time?

We’d heard about Apple AirTags and how people are putting them on luggage to track them when the airlines inevitably lose our cases and wondered whether it might enable us to track a package through the postal service. We were interested to find out how good the AirTag network coverage was, and where the tags would be picked up as they traveled through the postal system. We were very kindly loaned an AirTag, which we paired with our iPhone, and did some experiments close to home. We seemed to get a reasonable amount of tracking data on the Apple “FindMy” app, so we could see where the tag was as shown in the below image.

We wrote some code, based on the FindMyHistory project, which would constantly monitor the FindMy status reports, so we wouldn’t have to watch it all day every day. It would log the reported GPS positions of the tag, so we could draw a map (as in the below images) of the route the parcel was taking and also how long it was being processed in sorting depots.

We tried a few experiments, sending the AirTag in a jiffy bag as a “large letter” at different classes of postage – second class, first class, and Tracked 48. This was in November before the Christmas rush started and we were typically seeing 5-6 days of delivery from the South of England to Liverpool.

It was interesting to see how little time the packages spent actually moving – they spend most of their time in sorting depots, presumably zipping along on conveyor belts being sorted, or maybe just sitting around in large sacks waiting for the next leg of their journey.

As we can see in the above images, it was also interesting (and frustrating) to see the item arriving at the local sorting office, and then sitting there for a couple of days before it was put in a postie’s van and delivered to the house.

We kept thinking that, we could just pop down the road and pick it up!

Then just before Christmas, we decided to throw caution to the wind and send the tag into the Christmas chaos. The tag was posted from Liverpool in a Jiffy bag at lunchtime on 20th December, and almost immediately it set off on its journey. Wow – we thought they were pulling all the stops out to get post-delivered before Christmas! It arrived at the Royal Mail “NW Hub” near Warrington in the afternoon that day, and we assumed it would quickly be sorted and on its way – this was always a stopping-off point for all the post in and out of Liverpool.

But it was not to be. It didn’t move. It continued to not move.

Once we got into January, we complained on Twitter and @royalmailhelp responded and advised us that they were very busy and there were some big backlogs. Then they said we could claim compensation after it was 10 days overdue for delivery. They assured us that the letter would eventually be delivered – it wasn’t really “lost” and would never be dumped or destroyed during a clear-out. So that was quite a relief! We have to say we’ve always assumed that sacks of mail “go missing” for various reasons, but subsequent discussions with RM representatives have reassured us that they would never “dump” undelivered mail, and in fact, that would be illegal.

We passed the 480-hour point on 9th Jan. A week later it had taken 480 “working hours” (i.e. not Sundays, bank holidays, or strike days). All this time we were getting lots of location data from the tag as RM employees unknowingly detected the device with their phones (iPhones and Android are part of the network). If you’re curious about how AirTags and the global tracking network operate, there’s a great blog post here, that explains all.

We got to a whole month in transit (20th Jan), and the tag was still sitting in exactly the same location, in the middle of NW Hub, as it was put on 20th December when it arrived there. All this time, the “tracked” part of the Tracked 48 service was saying “We have your item”, which means it was scanned at the post office where we posted it, but had not yet been scanned on entry to NW Hub. We wondered how it was possible that the package was clearly inside the hub, but had not yet been scanned in.

We submitted the compensation claim and were waiting for that to work its way through the (undoubtedly very busy) complaints department of Royal Mail.

Then on 23rd January, it all started happening! The tracking history on the RM website was updated to say the item had been received at “North West Super Hub”. In fact, it said it was scanned twice – for good measure, presumably.

And then on 25th January, we got a message to say the item had been delivered. Yay! But… the AirTag was still clearly in NW Hub still. The delivery to a friend in Edinburgh was “botched” by the local postie – they put it through the wrong door, a few doors down from the address on the parcel. It was later put through the letterbox of the correct address (presumably by the person whose house it was incorrectly delivered to). We expect the postie did it on purpose (you can’t be THAT incompetent when there are numbers clearly marked on the front doors of a terraced row!), as the Jiffy bag was torn open at one end (as shown in the below image), and the contents were missing (we knew: it was still in NW Hub!). The package had taken 31 days from posting in Liverpool to delivery in Edinburgh. Sans AirTag, though.

We launched another compensation claim, as the first compensation claim for non-delivery was rejected, as the item HAD been delivered, technically.

Dealing with the RM compensation department is extremely difficult. They really don’t make it easy. You submit a claim through the website, wait for ages, and get no acknowledgment that they have received the claim or are doing anything about it. Then eventually, weeks later, you get an email saying they need additional information, with a passive-aggressive time limit of 10 days, otherwise, they will assume the matter has been resolved. OK, not passive-aggressive: that’s just aggressive, isn’t it? But after that, there’s no obligation on them to reply back to you within 10 days – they can just take their own sweet time. In the end, we reverse-engineered the email address of the person who emailed us and sent her a pointed message to respond to our claim. That worked – we got a response the next day (11th April), saying our claim had been progressed and they were raising a cheque, with an additional note informing us that sending emails to employees directly would not get results. Seemingly that’s not the case, as it absolutely did, Helen!

There is an escalation process for complaints to RM. It is described in a PDF document downloadable from the RM website. However, despite saying there IS an escalation process, it gives no information about how to invoke it. Not even an address to write to, LoL! Good ol’ RM, eh. Anyway, after DMing @RoyalMailHelp on Twitter, it turns out there IS a form for complaints escalation – We don’t believe it’s accessible from any link on the RM website, so if you ever need it, it’s here.

Meanwhile, the AirTag was still transmitting its location in NW Hub. We thought a lot about how to try to retrieve it. A friend working at RM had a friend who sometimes visited NW Hub. Maybe they could go onto the factory floor and retrieve it? We tried to contact NW Hub. Not very easy. They don’t have any contact information on their website. We suppose they want us to contact them through “official channels” – there’s nobody there who can help with “normal” postal inquiries, of course. But this wasn’t a normal situation!

As they’re at the Post Office, we decided to write to them – hoping the letter wouldn’t be lost in the post, LoL. We wrote to the “Site Manager” at the address of NW Hub. No reply. I’m sure he or she was far too busy managing the site to talk to the likes of me. In desperation, and a flash of inspiration, we sent a letter marked “URGENT” to the “Head of Security” at NW Hub. That worked!

Tune in for the next thrilling part of the AirTag Saga!

On the 12th October, the Dynamic Devices team were invited along to attend and speak at the Digital Security By Design All Hands Event! This is related to our involvement in the Digital Catapault Morello CHERI technology access programme (TAP).

At the event, we were hugely enthused to speak with many other businesses, all taking part in the Digital Security by Design research project. We had the opportunity to attend multiple workshops and get a much closer look at how CHERI works.

It was a fantastic event to attend and it was great to put faces to the names we’ve seen on the CHERI-CPU slack channel. It gave us the opportunity to introduce ourselves as a contributing member to this project and to speak about our aim of bringing Embedded Linux using the Yocto Project to the CHERI architecture and Morello platform.

We hope to attend more Digital Security by Design events as the project further progresses.

To learn more about the Digital Security by Design all hands event visit here.

Our project plan is open for all to see online via our GitHub.

Introduction

We are proud to announce that we are taking part in the Digital Security by Design programme!

Digital Catapult is the UK authority on advanced digital technology. Along with other companies, we will be working with prototype cybersecurity technology which could massively affect the future of cybersecurity.

Dynamic Devices have been given access to ARM’s Morello SoC and development board which is an industrial demonstrator of a capabiility architecture (CHERI) developed by ARM and Cambridge University. Morello implements a CHERI-extended ARMv8-A processor, GPU, peripherals and memory subsystem. This board will play a vital role for our research into the CHERI architecture.

The vast majority of cyber attacks exploit conventional hardware and software memory vulnerabilities. To overcome this issue, University of Cambridge researchers with colleagues at SRI International developed CHERI (Capability Hardware Enhanced RISC Instructions), a novel instruction set architecture that could stop two thirds of cyber attacks.

As part of the project, Arm designed and built a prototype system on a chip (SoC) and demonstrator board, the Arm Morello board, which was made available to UK businesses for industrial evaluation earlier in 2022. The DSbD Technology Access Programme, managed by Digital Catapult, allows companies to experiment with the Morello board.

– digicatapult.org.uk

In the picture, you can see the ARM Morello board which we will be working on for the next 6 months.

Aim for the DSbD Programme

In terms of what Dynamic Devices wants to accomplish with this programme, we hope to work with the existing Morello build support and integrate this to the greatest extent possible into the Yocto Embedded Linux build system resulting in an accrediated Yocto Compatible meta-cheri layer.

What we’ve done so far

So far, we have:

• Built Cheri-BSD for Morello and QEMU.
• Installed Cheri-BSD onto the Morello board.
• Tested purecap/capabilities on Cheri-BSD with example tests and also developed our own programs to test the secure architecture.
• Researched on Linux/Android for Morello
• Built Android for Morello
• Researched into Yocto support for Cheri

Conclusion

We would like to offer a massive thank you to Digital Catapult for enabling Dynamic Devices be a part of the Digital Security by Design programme. It is fantastic to be working alongside so many other innovative companies to further research these technologies which will undoubtedly shape the future of cybersecurity.

This programme is 6 months long and we will provide updates as we progress our research into CHERI & Morello.

See related information for the DSbD here on Twitter & LinkedIn.

Introduction to Makefest

Hello everyone! We can officially call Makefest 2022 a complete success!

Firstly, Makefest gives us the brilliant opportunity to demonstrate our brilliant Kettle Companion product to a creative crowd of creators and great people.

Kettle Companion

As a matter of fact, you can see our Kettle Companion kit in action on the left!

The two mini kettles are known as our ‘ambient kettles’. These are the devices which indicate using an LED whether the kettle it is linked to has been boiled yet.

Red indicates that the kettle has not been boiled whereas green evidently indicates that it has!

This is signalled through a monitoring plug and communicated via Wi-Fi to a paired Kettle Companion in another user’s home. A text message alert can also be sent to the owner of this appliance if their Kettle Companion has turned red.

Fellow Creators and Makers from DoES & Merseyside

Plenty of our friends from DoES Liverpool were also in attendance and were able to showcase their creative skills!

Have a look at the pictures below for an idea of the inventions featured at Makefest from our friends at DoES.

Additionally, we would like to give a big thank you to everyone who visited our stand at Makefest yesterday as well as everyone who helped bring Makefest together this year.

Also, are looking forward to Makefest 2023 as we’ll have new and exciting projects to show you!

For more info please visit liverpoolmakefest.org

Lastly, click here to see more of our blog posts.