Can anyone give a technical account of how this is achieved?

The article makes it sound as though it relies on unsecured wifi data, but also states that "Even when he didn’t connect to a Wi-Fi network, his sensors could track his location through Wi-Fi “pings.”" It also talks about iMessage, and dropbox, and other application layer data.

I couldn't make sense of it.