This is addressed in detail in the article. > the researchers suggest a variety of ways to obtain that MAID, including placing an "active-content" ad that uses

This is addressed in detail in the article. > the researchers suggest a variety of ways to obtain that MAID, including placing an "active-content" ad that uses javascript to pull the MAID from a phone at a certain location... MAIDs can also be intercepted by someone on the same Wi-Fi network as the target phone. > "It’s not a particularly high bar to entry for a very, very highly targeted attack," says Adam Lee... A domestic abuser could, for instance, obtain a spouse's MAID... or a co-worker could do the same in the office... Or an ad buyer could use active-content ads to gather the MAIDs of the people at a specific location, like a protest, or users of a potentially sensitive app like gay-dating apps or religious apps...