You bought it, but do you control it? The hidden power behind smart devices
When a stolen smartphone can be remotely disabled and a connected car can be tracked or prevented from starting, the question of who controls a device after it is purchased becomes more complicated. Recent reports of stolen iPhones being blocked in France have brought this issue into focus. How far does a manufacturer’s control over a connected device extend, and where does the owner’s right to control their property begin? Qazinform News Agency examines how remote security technologies are reshaping the concept of digital ownership.
How technology can stop stolen devices
On Oct. 17, shops in Paris, Marseille, Lille, Bordeaux, Lyon and other French cities were targeted during looting alongside demonstrations. Electronics, including smartphones and tablets, were among the goods stolen.
A video shared on social media showed a message on a stolen iPhone instructing the holder to return it to an Apple Store in Lille. The message said the device had been locked and was being tracked, warning that local authorities would be notified.
According to French media outlet BFM Tech, manufacturers can remotely disable stolen smartphones and tablets, while mobile operators can blacklist their International Mobile Equipment Identity (IMEI) numbers to prevent them from connecting to cellular networks. A blacklisted phone may, however, remain usable over Wi-Fi.
Yernar Yeleuov, a cybersecurity engineer at the School of Cybersecurity at Astana IT University (AITU), said anti-theft protection works through several mechanisms, including account-based locks, remote commands and network blocking.
Apple’s Activation Lock and Android’s Factory Reset Protection can prevent someone from setting up a stolen phone after a factory reset without the previous owner’s credentials. Services such as Find My and Find My Device allow owners to lock a screen, display a message or erase data remotely.
But these systems are not foolproof. A remote command may not reach a phone that remains disconnected from the network. IMEI blocking also depends on the networks and databases involved, while stolen devices may be dismantled for parts or targeted through phishing attacks designed to steal account credentials.
“These mechanisms are a strong deterrent that reduces the value of a stolen device, but not a guarantee that it will be returned,” Yeleuov said.
From smartphones to connected cars
The same principle is increasingly relevant to vehicles. In April 2026, Stellantis announced an expanded connected-services offering that includes Stolen Vehicle Tracking Assistance through its Connect PLUS package. In July, Ford Canada expanded the availability of vehicle theft-prevention features to selected models, including theft alerts, recovery assistance and a remote Start Inhibit function that can prevent a vehicle from starting remotely under specified conditions.
However, the technology that helps recover stolen property can also create new cybersecurity risks.
“If a vulnerability is found not in a single car but in the manufacturer’s servers or API, the entire fleet is at risk at once,” Yeleuov said.
Connected vehicles also collect location data that can reveal where people live, work and travel. If these systems are compromised, the consequences may extend beyond vehicle theft to unauthorized access and privacy violations.
Yeleuov said critical vehicle systems, including brakes and steering, should be isolated from infotainment systems and external communication channels. Remote commands must be securely authenticated, and an immobilization function should never stop a moving vehicle.
Who controls a device after purchase?
A smartphone or connected car is more than a physical product. It also depends on software, online accounts and services that may remain under a manufacturer’s control.
“The honest answer is that buyers today almost never get full control,” Yeleuov said. “Legally, you own the hardware, but the software that makes this hardware useful is usually licensed rather than sold.”
This distinction matters when companies change software, discontinue services or restrict features. A device may remain physically intact but lose some of its functionality if it depends on a manufacturer’s servers or subscription.
The end of software support can create a further risk: devices that no longer receive security updates may retain vulnerabilities that attackers can exploit.
Yeleuov distinguishes between protective measures, such as security updates and anti-theft tools, and commercial restrictions that can limit repairs or access to features. Both can affect how much control consumers retain after purchasing a product.
Balancing security and ownership
Remote blocking and tracking can make stolen devices harder to use, but consumers also need protection against mistaken restrictions, unauthorized tracking and sudden service shutdowns.
Yeleuov said safeguards should include transparent policies, secure authentication, notifications when remote actions are taken and accessible procedures for appealing incorrect blocks. Consumers should also know before buying a connected product which functions can be controlled remotely and how long software support is expected to last.
“The keys to a device should be in the owner’s hands, not the manufacturer’s,” he said.
Kazakhstan’s IMEI registration system provides a mechanism for managing mobile devices on local networks, but the broader issue extends beyond stolen phones. As more products become connected, ownership increasingly depends on the software and services that determine how they can be used.
The challenge is to ensure that technology protects consumers without making them unnecessarily dependent on the companies that manufacture their devices. Buying a product gives consumers its physical hardware, but meaningful ownership also requires transparency, security and clear limits on remote control.
The issue is part of a broader debate over digital security in Kazakhstan. In September, Qazinform reported that more than 100 experts gathered in Astana for KazHackStan 2026 to discuss emerging cyber threats and the future of cyber resilience.