Data about exercise routes shared online by soldiers can be used to pinpoint overseas facilities

This article is more than 1 year old

This article is more than 1 year old

Sensitive information about the location and staffing of military bases and spy outposts around the world has been revealed by a fitness tracking company.

The details were released by Strava in a data visualisation map that shows all the activity tracked by users of its app, which allows people to record their exercise and share it with others.



Strava suggests military users 'opt out' of heatmap as row deepens Read more

The map, released in November 2017, shows every single activity ever uploaded to Strava – more than 3 trillion individual GPS data points, according to the company. The app can be used on various devices including smartphones and fitness trackers like Fitbit to see popular running routes in major cities, or spot individuals in more remote areas who have unusual exercise patterns.

However, over the weekend military analysts noticed that the map is also detailed enough that it potentially gives away extremely sensitive information about a subset of Strava users: military personnel on active service.

Nathan Ruser, an analyst with the Institute for United Conflict Analysts, first noted the lapse. The heatmap “looks very pretty” he wrote, but is “not amazing for Op-Sec” – short for operational security. “US Bases are clearly identifiable and mappable.”

“If soldiers use the app like normal people do, by turning it on tracking when they go to do exercise, it could be especially dangerous,” Ruser added, highlighting one particular track that “looks like it logs a regular jogging route.”

“In Syria, known coalition (ie US) bases light up the night,” writes analyst Tobias Schneider. “Some light markers over known Russian positions, no notable colouring for Iranian bases … A lot of people are going to have to sit through lectures come Monday morning.”

In locations like Afghanistan, Djibouti and Syria, the users of Strava seem to be almost exclusively foreign military personnel, meaning that bases stand out brightly. In Helmand province, Afghanistan, for instance, the locations of forward operating bases can be clearly seen, glowing white against the black map.

Facebook Twitter Pinterest Helmand province in Afghanistan. Photograph: Strava heatmap

Zooming in on one of the larger bases clearly reveals its internal layout, as mapped out by the tracked jogging routes of numerous soldiers. The base itself is not visible on the satellite views of commercial providers such as Google Maps or Apple’s Maps, yet it can be clearly seen through Strava.

Outside direct conflict zones, potentially sensitive information can still be gleaned. For instance, a map of Homey Airport, Nevada – the US Air Force base commonly known as Area 51 – records a lone cyclist taking a ride from the base along the west edge of Groom Lake, marked on the heatmap by a thin red line.

Facebook Twitter Pinterest Area 51, with a lone cyclist marked on the map. Photograph: Strava heatmap

RAF Mount Pleasant in the Falkland Islands is lit up brightly on the heatmap, reflecting the exercise regimes of the thousand British personnel there – as are nearby Lake Macphee and Gull Island Pond, apparently popular swimming spots.

Facebook Twitter Pinterest RAF Mount Pleasant in the Falkland Islands. Photograph: Strava heatmap

When Strava released the heatmap, an updated version of one it had previously published in 2015, it announced that “this update includes six times more data than before – in total 1 billion activities from all Strava data through September 2017. Our global heatmap is the largest, richest, and most beautiful dataset of its kind. It is a direct visualisation of Strava’s global network of athletes.”

Strava demonstrated that the new heatmap was detailed enough to see kiteboarding in Mexico, to track the route of the Camino de Santiago across northern Spain and to see the sea route of the Ironman triathalon in Kona, Hawaii. Perhaps the closest to the current operational security issues that it noted, however, was the layout of the Burning Man festival in the Nevadan desert. “The unique pentagonal pattern of Burning Man’s pop-up city is forever etched into the Heatmap, thanks to all the runners and cyclists who have used Strava to explore it,” the company wrote.</s>Fitness tracking app Strava may have revealed critical locations of U.S. military bases all over the world. The application’s data visualization map is so detailed it’s possible to map out spy outposts and military base staffing and locations based on the active military personnel using their service.

On November 2017, Strava released a map that shows all the activities of its users. The total data points at that time were more than 3 trillion latitude and longitude points generated from one billion activities. Strava is available on fitness trackers like Fitbit and smartphones. Through Strava, users can take a peel on the exercise patterns on users in remote areas and find favorite running routes in major cities.

While Strava users benefit from this convenient map, military analysts noticed something alarming over the weekend. Strava users who happen to be part of the military on active service may give away sensitive information based on their exercise activity. Nathan Ruser of the Institute United Conflict Analysts noted that Strava’s global heat map could hurt operational security.

Strava users in Syria, Djibouti, and Afghanistan appears to be mainly members of the foreign military. Hence, the location of the bases in those territories stands out. In Afghanistan’s Helmand province shows a white glow against Strava’s black map.

By zooming in the map, it’s possible to see the internal layout of the military base thanks to the jogging routes of numerous soldiers in the area. These locations are visible from the satellite view provided by Apple’s Maps or Google Maps. However, Strava offers a clear view of the map in these direct conflict zones.

In a tweet, Independent International Security Analyst Tobias Sneider noted that the military should be made aware of this lapse.

Strava also makes it possible to get a list of people who traveled on a particular route and generate a list of users. Theoretically, it’s possible to follow someone home.

As reported by the Washington Post, U.S. Central Command spokesman Air Force Col. John Thomas stated on Sunday, Jan. 28, that the U.S. military will look into the map’s implications.

The issue of compromising the operational security is not exclusive to the United States. The detailed heatmap also revealed the location and activity of foreign military bases with Strava app users.

As for Strava, the company urged the public to review the privacy settings of the app.

Strava emphasized that the activities on their Global Heat Map excluded activities in user-defined privacy zones and those that were defined private.</s>Australia's military base Pine Gap is included in the heat map, along with what appears to be a routine patrol lap.

Australia's military base Pine Gap is included in the heat map, along with what appears to be a routine patrol lap.

THEY'RE some of the most secretive and clandestine places in the world but they could be threatened by something as simple as fitness tracking apps like Fitbit.

Data published by Strava, which markets itself as a social network for amateur athletes using fitness tracking apps, has been shown to potentially reveal the location of secret US military bases.

The company's app allows people to track their workouts and share them online. In November, the company released a series of online data visualisation maps which showed all the activity tracked by users of its app between 2015 and September 2017.

The maps which include Australia and the United States show every single activity ever uploaded to the Strava app. According to the company that amounts to more than 3 trillion individual GPS data points.

The problem is, some of it could be rather sensitive information.

Over the weekend Nathan Ruser, an analyst with the Institute for United Conflict Analysts, pointed out that while the "maps look pretty," they included US military bases which were "clearly identifiable and mappable," he wrote on Twitter.

"If soldiers use the app like normal people do, by turning it on tracking when they go to do exercise, it could be especially dangerous," he added.

Mr Ruser, 20, who is currently studying international security at ANU, shared a number of images which purport to reveal FOBs (forward operating bases - commonly used to support tactical operations) established by Western countries.

Fellow security analyst Tobias Schneider also took to Twitter to share apparent military activity highlighted by the heat maps, writing: "A lot of people are going to have to sit thru (sic) lectures come Monday morning."

Joining the online chorus was former British Army officer Nick Waters who tweeted: "Patrol routes, isolated patrol bases, lots of stuff that could be turned into actionable intelligence."

In locations like Afghanistan, Syria and Djibouti the users of Strava seem to be almost exclusively foreign military personnel. As a result, the military bases stand out brightly against the dark backdrop of these Middle Eastern countries.

Speaking to the ABC, Mr Ruser recalled what he first thought when he looked closely at the images.

"You can see the main supply highway for US forces in Syria, and I just remember thinking: 'F**k, that's not good'."

The map of Australia, on the other hand, is covered in light due to the high rate of people who use the Strava apps and other related devices like Fitbit. Nonetheless, you can identify activity at Australia's Pine Gap outside of Alice Springs, including what appears to be a routine patrol lap.

News.com.au has reached out to the Department of Defence with questions about protocols in place regarding the use of such location tracking apps by servicemen and women while on site. At the time of publication it had yet to offer comment.

According to The Washington Post, the US military is looking into the matter.</s>Data from fitness trackers that clearly show the movement of personnel at U.S. military bases is sparking major concerns, with experts citing potential dangers to base security.

The data, collected by a host of fitness devices, has been shared by users with fitness tracker app Strava. However, a global "heatmap" of fitness data published by Strava has fueled worries that service members are sharing data about their movements, particularly in dangerous locations such as Afghanistan and Syria.

Movements around the sprawling Kandahar Airfield in Southern Afghanistan, for example, are clearly documented on the map. Stateside bases also show up on the map.

“DoD takes matters like these very seriously and is reviewing the situation to determine if any additional training or guidance is required, and if any additional policy must be developed to ensure the continued safety of DoD personnel at home and abroad,” a Department of Defense spokesperson said in a statement emailed to Fox News.

The U.S. military conducts regular training for service members on data security, although the heatmap suggests that more attention needs to be paid to information privacy.

“Annual training for all DoD personnel recommends limiting public profiles on the Internet, including personal social media accounts,” explained the spokesperson. “Furthermore, operational security requirements provide further guidance for military personnel supporting operations around the world. Recent data releases emphasize the need for situational awareness when members of the military share personal information.”

The global heatmap, which was published in November 2017, tracked 1 billion activities from September 2017, according to Strava. The map is compiled from 3 trillion latitude and longitude points and reflects a total distance traveled of 17 billion miles.

First noticed by Nathan Ruser, a member of the Institute for United Conflict Analysts (IUCA), the map has shone a light on data privacy and its impact on operational security. “It looks very pretty, but not amazing for Op-Sec. US Bases are clearly identifiable and mappable,” tweeted Ruser.

U.S. bases in Syria also show up on the map, according to defense analyst Tobias Schneider, as does the Hmeimim airbase, which is being used by Russian forces in the country. The map, he tweeted, is “excellent for locating military bases.”

Strava does give users the option not to share their data. “Our global heatmap represents an aggregated and anonymized view of over a billion activities uploaded to our platform,” explained Strava, in a statement emailed to Fox News. “It excludes activities that have been marked as private and user-defined privacy zones. We are committed to helping people better understand our settings to give them control over what they share.”

Strava is one of a number of companies that lets users share details of their atheltic endeavors on social media - others include fitness tech giant Fitbit and running app Runkeeper.</s>Information collected and published by the fitness tracking and sharing app Strava has highlighted the locations of secret military bases and revealed sensitive information about the activity of personnel at those bases. On Saturday, an Australian student and security analyst named Nathan Ruser tweeted that Stava’s Global Heatmap of every GPS-linked fitness activity uploaded by users also includes data from app users at military bases operated by the U.S., U.K., Russia, and other countries in places like Afghanistan and Syria. Furthermore, because few residents of a country like Syria are likely to use the app in the first place, it is particularly easy to locate areas of activity by foreign military personnel in some areas.

The data, which was collected by personal fitness trackers like Fitbits that users had linked to their Strava accounts, revealed the perimeters of some secret bases, since those boundaries likely double as jogging tracks:

The map revealed the possible routes of military patrols or supply runs, too:

And also other regular routes that service members are active on — likely indicating where they work, live, eat, and run, inside and outside of their bases, as well as how frequently.

All of this information could be actionable intelligence to enemies or terrorists looking for targets. The Washington Post explains that while the locations of most of the U.S. bases are public knowledge, the detailed activity of service members is obviously not. The Verge points out that the military has tried to put new policies in place to limit this precise risk, including regulations around device use — especially regarding apps that track location data — and the prohibition of any personal devices from certain sensitive areas.

Strava put out a statement in response to the story, more or less noting that it was the base personnel’s fault for not making their accounts private:

Expect a lot of militaries and security agencies to recommend reviewing those settings soon as well.</s>In March 2017, a member of the Royal Navy ran around HMNB Clyde, the high-security military base that's home to Trident, the UK's nuclear deterrent. His pace wasn't exceptional, but it wasn't leisurely either.

His run, like millions of others around the world, was recorded through the Strava app. A heatmap of more than one billion activities – comprising of 13 billion GPS data points – has been criticised for showing the locations of supposedly secretive military bases. It was thought that, at the very least, the data was totally anonymised. It isn't.

By making a quick request of Strava's API, it's possible to de-anonymise the company's data and show exactly who was exercising inside the walls of some of the world's most top-secret facilities. Once someone makes a data request for a specific geographic location – a nuclear weapons facility, for example – it's possible to view the names, running speeds, running routes and heart rates of anyone who shared their fitness data within that area.

The fitness app – which can record a person's GPS location and also host data from devices such as Fitbits and Garmin watches – allows users to create segments and leaderboards. These are areas where a run, swim, or bike ride can be timed and compared. Segments can be seen on the Strava website, rather than on the heatmap.

Computer scientist and developer Steve Loughran detailed how to create a GPS segment and upload it to Strava as an activity. Once uploaded, a segment shows the top times of people running in an area. Which is how it's possible to see the running routes of people inside the high-security walls of HMNB Clyde.

"Once Strava has gone through its records, you'll be able to see the overall top 10 per gender/age group, when they ran, it where they ran with," Loughran wrote in a blog post. "And, if their profile isn't locked down enough: which other military bases they've been for runs on."

The segment for HMNB Clyde shows multiple people have run through the restricted area in recent years. The Guardian has also reported it is possible to see the names of more than 50 US service members at a base in Afghanistan. Revealing the names of individuals – and their movements around high-security military bases – may be a potential security risk.

"If you can have access to the personnel training and exercises then you also have information about where this person is and when does he or she do certain activities," says Beyza Unal, a research fellow at Chatham House's international security department. She says that over time it may be possible to build-up an idea of a person's behaviour.

"That could lead to getting patterns about the personnel training, that pattern is important for operational military sake. If you are an enemy or adversary you may want to use certain information that you did not have beforehand."

In response to the fallout from its heatmap showing military information, Strava has said it is keen to help people better understand its privacy controls. It also said the company is "committed to working with military and government officials" where sensitive locations are involved. Strava has not directly commented on the ability to see the names of individuals and their movements over time.

Strava has a number of different privacy options but, as has been pointed out by users, they aren't always the clearest. A Quartz article from August 2017 details some of the different options that are available. Some of the privacy settings can only be changed through the company's website rather than in its app.

The company released its most recent heatmap in November 2017, building upon the first version released in 2015. The map shows the popularity of running, cycling and swimming routes completed by people either using the app or importing data from third-party devices. The more popular a route is, the brighter it shows up on the heatmap.

Despite the heatmap being released more than two months ago, the ability to see activity in potentially sensitive locations was only spotted in recent days when Nathan Ruser, an international security student at the Australian National University, noticed data was being displayed around military bases.

Want to know how people are moving around US military bases in Beirut? How about at GCHQ or Area 51? Simple. Just look at the map. The situation has raised questions as to whether people working in the military and related fields should record their movements with a GPS fitness tracker.

On Twitter, Tim Mathews, who has served in the US military, said during his time he was not permitted to use any "non-military issue device with GPS tracking".

UK military guidelines for social media use caution that location services should be turned off. The US Marines also have clear guidelines on when and where fitness trackers can be used.</s>Strava, the fitness-tracking app which relies on the smartphone GPS to track a user’s exercise sessions, which includes cycling, running finds itself the subject of a controversy. According to reports, a heat map shared by Strava, which shows the exercise activity of its users across the world, has ended up revealing secret military bases for the US and other countries as well. The app lets users post their activities on the social network and also follow others, who are into the same fitness activities on the app.

The map, which was first shared by the company in November 2017, includes a total of one billion activities from all Strava data through September 2017. The heat map also shows 3 trillion latitude and longitude points and includes around 10TB of raw input data, according to the company’s original post.

The issue of secret military bases being leaked by Strava’s map was pointed out by analyst Nathan Ruser on Twitter, according to news reports from The Verge and Guardian. Ruser is a founder member of Institute for United Conflict Analysts and he said on Twitter, “Strava released their global heatmap. 13 trillion GPS points from their users (turning off data sharing is an option). http://medium.com/strava-engineering/the-global-heatmap-now-6x-hotter-23fc01d301de … … It looks very pretty, but not amazing for Op-Sec. US Bases are clearly identifiable and mappable”

Ruser goes on to point out that it not just US military bases which are revealed online by Strava’s heat map. The maps makes it possible to see other bases including Russia’s military bases, those in Afghanistan, and Turkish patrols North of Manbij in Northern Syria. According to Russer, the map can be used to figure out known military bases.

He also pointed on Twitter that it was possible to locate jogging routes for soldiers, who had the app on for tracking during these activities, which is dangerous. The Strava map can be used to figure out regular routes that are taken by them and puts them at considerable risk, especially for those posted in combat locations.

Check out his tweets below

In a statement to The Verge, Strave said “the map is an aggregated and anonymised view of over a billion activities uploaded to our platform.” The company says activities which are marked as private are not part of the global heat map. Another report in the Guardian points out that the Strava app also reveals locations of US bases in Afghanistan as soldiers are the sole users of the app in these areas.

For all the latest Technology News, download Indian Express App</s>Fitness-tracking app Strava's new global heatmap reveals sensitive information about military bases and supply routes in the Middle East and around the world, a potential security flaw first spotted by Australian student Nathan Ruser.

Fitness activity recorded by Strava around the Joint Defence Facility Pine Gap in the Northern Territory. (Credit: ABC)

Strava, a fitness-tracking app, is revealing potentially sensitive information about military bases and supply routes via its global heatmap website.

The data map shows 1 billion activities and 3 trillion points of latitude and longitude from "Strava's global network of athletes", according to the American company.

On the weekend, 20-year-old Australian university student Nathan Ruser noticed the map showed the locations and running routines of military personnel at bases in the Middle East and other conflict zones.

Speaking from Thailand, Mr Ruser, who is studying international security at the Australian National University, said he had been following the situation in Syria since 2014.

When he came across Strava's heatmap, he decided to look at the war-torn region and said "the whole thing lit up like a Christmas tree."

When you look at Strava's heatmap in countries like Australia, you see a lot of "noise" from civilians using the app. Sydney, for example, glows gold with people's jogging habits.

That's not the case in the Middle East or Africa, where lone activities stand out against an all-black background.

"In countries where that is not so much a thing, that noise gets filtered out," Mr Ruser said.

"The only people using the apps would be foreign military personnel."

It is also possible that workers from charities and other NGOs might feature on the conflict zone maps.

According to the Washington Post, the US military is looking into the situation.

Strava collects data from phones and fitness trackers such as Fitbit, and allows users to share their routine with friends and followers. Its aggregated heatmap shows information collected between 2015 and September 2017.

While security analysts often use satellite imagery to study military installations, Mr Ruser said the Strava data added an additional, possibly dangerous layer of information.

Using satellite imagery, you can see base buildings, for example. But on the heatmap, you can see which buildings are most used, or the jogging routes of soldiers.

It also shows the turns patrols take when moving through towns in Syria: "You can see the main supply highway for US forces in Syria, and I just remember thinking 'f***, that's not good'," Mr Ruser said.

"Patrol routes, isolated patrol bases, lots of stuff that could be turned into actionable intelligence," tweeted ex-British Army officer Nick Waters.

Other analysts have scoured the map since Sunday, tweeting about missile sites and patrol routes around the world.

Jeffrey Lewis, founding publisher of the Arms Control Wonk blog, wrote at the Daily Beast that "the underlying data that Strava is collecting is a security nightmare."

Edward Farrell, an Australian security researcher, said the risk of being able to spot "military bases in secretive places" may be overstated.

While many of these bases are known, it still presents a potential issue of operational security if the data can be "individually allocated to someone".

"It can certainly allow for tracking of patterns of life and behaviour in those locations," Mr Farrell said.

Some installations seem to have dealt with the risk, he pointed out. The Pentagon, for example, shows no internal Strava data.

Danielle Cave, a senior analyst at the International Cyber Policy Centre at the Australian Strategic Policy Institute, called the heatmap an "open source intelligence gold mine".

She suggested the data also raised a cyber security risk.

"A hacking group, state or non-state, could very easily now target Strava knowing how valuable the data is that they are holding," she said.

"If it does turn out that people can strip out the personal details of some of these Strava users, then I think it's getting into a very dangerous place."



A Strava spokesperson said the heatmap represented "an aggregated and anonymized view" of its users activities.

He added that Strava allows users to create a "privacy zone" — a tool that obscures activity within a pre-selected radius.

Mr Ruser doesn't think the situation is all Strava's fault.

"They probably should have had the foresight to look at the map before they released it, but the app has a policy where you can opt out of data sharing, and that hasn't been done by the soldiers," he said.

"If you ask me, I don't expect the map will be online for that much longer."

Ms Cave suggested the military needs to be clear about where such devices and apps are or are not allowed.

In Australia, the map shows movements taking place around known military installations such as the Joint Defence Facility Pine Gap in the Northern Territory.

The Australian Department of Defence has been contacted for comment.</s>The Pentagon has been interested in fitness trackers since it distributed Fitbits to U.S. troops in 2013. Unfortunately, now they will have a different concern as online fitness tracking has created a global map filled with potentially damaging and sensitive information about U.S. installations abroad. What started as a tool to help users get fit and stay fit has become a matter of national security. At least that's what international security analyst and expert Tobias Schneider thinks. The Washington Post reports that Strava's Global Heatmap, an aggregate worldwide map of where and how we use our fitness trackers, includes information from U.S. troops stationed in the Middle East in sensitive installations.

The Global Heatmap was published in 2017, but the security oversight was only recently noticed. Now that it's come to light (pardon the pun) people are zooming in to see if they can pinpoint places the Pentagon freely admits exist, but aren't anything it likes to publicize. Especially when it comes to the exact location.

Many people wear their fitness trackers all day long to measure their total step counts, and soldiers appear to be no exception, meaning the maps reveal far more than just their exercise habits. Lines of activity extending out of bases and back may indicate patrol routes. The map of Afghanistan appears as a spider web of lines connecting bases, showing supply routes, as does northeast Syria, where the United States maintains a network of mostly unpublicized bases. Concentrations of light inside a base may indicate where troops live, eat or work, suggesting possible targets for enemies.

Strava, a popular app for runners and cyclers alike, is available for many fitness devices, including Fitbit, Android Wear, and Samsung's Galaxy Gear. The 2017 map doesn't show any live data, but the information available provides what would normally be classified data for anyone too see. Including the site of a U.S. base that is yet to be announced.

At a site in northern Syria near a dam, where analysts have suspected the U.S. military is building a base, the map shows a small blob of activity accompanied by an intense line along the nearby dam, suggesting that the personnel at the site jog regularly along the dam

Not only U.S. sites have been exposed through the map, as suspected Russian and Syrian bases are visible, too. Interestingly enough, no Iranian bases are seen. Security experts say this suggests they "either don't use fitness trackers or prudently turn them off." This is an important minor detail — users are told about how their activity is tracked and given an easy option to shut down any sending of fitness data. Enough users to give a clear picture of sites the Pentagon would rather not be publicized aren't doing it. I imagine that has come to a sudden halt. Read the fine print on every app you download and install, folks.</s>In war zones and deserts such as Iraq and Syria, the heat map becomes almost entirely dark—except for a few scattered pinpricks of activity. Zooming in on those brings into focus the locations and outlines of known U.S. military bases, as well as of other unknown and potentially sensitive sites — presumably because U.S. soldiers and other personnel are using fitness trackers as they move around.

Most parts of the United States and Europe, where millions of people use some form of fitness tracker, show up on the map as a blaze of light, because there is so much activity.

Strava says it has 27 million users around the world, including people who own widely available fitness devices such as Fitbit, Jawbone and Vitofit, as well as people who directly subscribe to its mobile phone application. The map is not live—rather it shows a pattern of accumulated activity between 2015 and September of last year.

The Global Heat Map, published by the GPS tracking company Strava, uses satellite information to map the location and movements of subscribers to the company’s fitness service over a two-year period, by illuminating areas of activity.

BEIRUT—An interactive map posted on the internet that shows the whereabouts of people who use fitness devices such as Fitbit also reveals highly sensitive information about the location and activities of soldiers at U.S. military bases, in what appears to be a major security oversight.

The Global Heat Map was posted online in November 2017, but the information it contains was publicized on Saturday only after a 20-year-old Australian student stumbled across it. Nathan Ruser, who is studying international security and the Middle East, found out about the map’s existence from a mapping blog and was inspired to look more closely, he said, after a throwaway comment by his father, who observed that the map offered a snapshot of “where rich white people are” in the world.

The U.S. military did not respond to a question about what the regulations are regarding use of fitness tracking apps. But the Pentagon has encouraged the use of Fitbits among military personnel and in 2013 distributed 2,500 of them as part of a pilot program to battle obesity.

Air Force Col. John Thomas, a spokesman for U.S. Central Command, said Sunday the U.S. military is looking into the implications of the map.

“I wondered, does it show U.S. soldiers?” he said, and immediately zoomed in on Syria. “It sort of lit up like a Christmas tree.”

He started tweeting about his discovery, and the internet also lit up, as data analysts, military experts and former soldiers began scouring the map for evidence of activity in their areas of interest.

Andrew Rawnsley, a Daily Beast journalist, noticed a lot of jogging activity on the beach near a suspected CIA base in Mogadishu.

Another Twitter user said he’d located a Patriot site in Yemen.

Ben Taub, a journalist with the New Yorker, homed in on the location of U.S. special operations bases in the Sahel.

The site does not identify the users of the app and shows many locations that may belong to aid agencies, United Nations facilities and the military bases of other nations—or anyone whose personnel is likely to use fitness trackers, said Tobias Schneider, an international security analyst based in Germany. But he said it is not hard to map the activity to known, or roughly known, U.S. military sites and then glean further information.

The location of most of the sites is already public knowledge, such as the vast Kandahar air base in Afghanistan. The Pentagon has acknowledged publicly that U.S. special operations troops maintain a small outpost at Tanf in the Syrian desert near the Iraqi border, which shows up on the map as a neatly illuminated oblong, probably because U.S. soldiers wearing Fitbits or similar devices either jog or patrol around the perimeter.

But the data also offers a mine of information to anyone who wanted to attack or ambush U.S. troops in or around the bases, said Schneider, including patterns of activity inside the bases. Lines of activity extending out of bases and back may indicate the routes of patrols. The map of Afghanistan appears as a spiderweb of lines connecting bases, showing supply routes, as does northeast Syria, where the United States maintains a network of mostly unpublicized bases. Concentrations of light inside a base may indicate where concentrations of troops live, eat or work, suggesting possible targets for enemies who wished to target the base.

At a site in northern Syria near a dam, where analysts have suspected the U.S. military is building a base, the map shows a small blob of activity accompanied by an intense line along the nearby dam, suggesting the personnel at the site jog regularly along the dam, Schneider said.

“This is a clear security threat,” he said. “You can see a pattern of life. You can see where a person who lives on a compound runs down a street to exercise. In one of the U.S. bases at Tanf you can see people running round in circles.”

“Big opsec and persec fail,” tweeted Nick Waters, a former British army officer who pinpointed the location of his former base in Afghanistan using the map. “Patrol routes, isolated patrol bases, lots of stuff that could be turned into actionable intelligence.”

By no means all of the activity discovered is U.S. activity, said Schneider. The perimeter of the main Russian base in Syria, Hmeimim, is clearly visible—as are several routes out of the base that are presumably taken by patrols, he said.

Other Russian bases also show up, but Iranians either don’t use fitness trackers or prudently turn them off, he noted.

Strava apps and devices contain an option to turn off the data transmission service, making it more the responsibility of the user to ensure that security isn’t breached, said Ruser. “It seems like a big oversight,” he said.

The U.S. military did not respond to a question about what the regulations are regarding use of fitness tracking apps. But the Pentagon has encouraged the use of Fitbits among military personnel and in 2013 distributed 2,500 of them as part of a pilot program to battle obesity.

Strava did not respond to a request for comment.
Researchers note that in November 2017, Strava, which processes data from apps and Internet of Things devices such as Fitbit, accidentally revealed the locations of alleged United States military bases overseas, including in Afghanistan, Djibouti and Syria.