10
Loading video...
By Brendan Cole
Senior Reporter
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
Iran's forces may have used data shared by Strava users at U.S. military bases in the Middle East to target American forces.
The Pentagon launched a review in 2018 into the use by its personnel of fitness apps such as Strava, which track routes and times for running, cycling and swimming.
This was out of concern that information can also be used by an adversary to build up a picture of personnel deployments and movements in what intelligence analysts call a "pattern of life" of day-to-day operations.
Read More on World
The Pentagon concluded they posed a security risk and banned their use without prior permission.
However, Sky News said its analysis pointed to Strava data still being shared by hundreds of users at U.S. military bases, potentially compromising American personnel involved in the front line of the war against Iran.
Special operations expert Jonathan Hackett told Sky News that "lax enforcement and lack of awareness" were behind the sharing of location data, which Iran was likely to be using to track U.S. troop movements across the Middle East.
...
'Tapestry of Data Points'
Joseph Jarnecki, research fellow for cyber and tech at the London think tank the Royal United Services Institute (RUSI), told Newsweek that it was plausible that Iran used the data against American targets.
"There is a tapestry of data points that militaries use to conduct targeting and increasingly those include open-source information as well as closed-source secret information," he said.
"It is totally reasonable to expect that this kind of very easily available publicly accessible data would have been used to inform some of those decisions," he said.
Newsweek reached out to Strava and the Pentagon for comment.
...
Iran Attacks US Site in Bahrain
Sky News found that over 1,300 Strava users had shared workouts taken at U.S. military bases in the region, with most using their real names, making them potential targets for attacks or espionage.
After the start of the joint U.S. and Israeli airstrikes on Iran on February 28, Tehran retaliated with strikes on American bases across the Middle East. Among them was a major naval base in Manama, Bahrain, which was hit on March 1, although it had been evacuated.
Sky News said it had identified the Strava account of a U.S. Navy contractor at the site who recorded runs around the base until one week before the war. Before the war, U.S. personnel at Jordan's Muwaffaq Al Salti Air Base were posting hundreds of runs on Strava.
...
This pattern resumed during a ceasefire in April, but instead of runs around the whole site, they started or ended on the barracks on the base's eastern corner, a location that Tehran attacked on July 17, killing three soldiers.
The RUSI's Jarnecki said that an explanation could be that some U.S. bases in the Middle East had been mischaracterized as low risk.
"It could also be that the policies that they're pushing out apply primarily to registered service people who are employees of those organizations, but not, for example, to contractors or to businesses on the base."
"There are kind of a diverse panoply of individuals who use these bases, who access these kind of applications," he said, "so I think it's unfortunately a story of strategic acknowledgment but operational patchy implementation," he added.
Austin Warnick, senior director of national security intelligence at Flashpoint told Newsweek, “Iran's reported use of Strava for targeting should be of no surprise."
"It reveals a tangible need for updates in the operational security posture of U.S. forces and broader awareness training on open source intelligence techniques.”
Related Story
USS Abraham Lincoln to Be Replaced Amid Growing Concerns for Troops
Shared Data Also Affects UK, Netherlands, and Israel
Troops from other countries have also been sharing potentially sensitive data, according to Sky News, which found serving British soldiers sharing activities from RAF Akrotiri in Cyprus, which has been targeted by Iran. The outlet also found three Strava users tracking jogs inside Israel's Dimona nuclear research center, which is a repeated target of Iranian attacks.
In March, French newspaper Le Monde reported that Secret Service agents and other American security personnel had posted runs on Strava that risked revealing operational routines. One French officer revealed the location of an aircraft carrier deployed toward the Middle East, according to the publication.
...
Its #StravaLeaks investigation also found fitness data mapped sensitive positions of military personnel in conflict zones, including Israeli soldiers near Gaza and members of French President Emmanuel Macron’s security detail jogging near official residences and hotels.
Location intelligence and geospatial data platform Mapulus said on its website that consumer technology can generate intelligence-grade data and that "what starts as personal fitness tracking becomes, at scale, a global surveillance network."
'Classic Case of Open-source Intelligence'
"This is a classic case of open-source intelligence (OSINT): everyday consumer data is becoming a national security vulnerability," Mapulus said.
The head of the Netherlands’ military intelligence service (MIVD), Peter Reesink, kept a public Strava account for years, allowing anyone to follow his cycling and running routes and work out where he lived, Dutch newspaper de Volkskrant reported this month.
In breach of his country’s defense ministry guidelines, Reesink, a vice admiral, logged activities between 2018 and 2025 that revealed his home address, where he stored his camper, and when and where he went on holiday.
Strava told Sky News it takes users' safety and privacy very seriously and provides extensive privacy controls, adding that "we expect people working in sensitive professions to leverage the controls available to them and appropriately limit their content."
Contact Newsweek editors on this story: Federica Bindi, Sam Wilson, Gray R. Thomas
View 0 Comments
Submit Correction
View Editorial & AI Guidelines