A fitness tracking app was used to reveal sensitive data from U.S. military bases around the world – some in war zones.
The security gaff was discovered when a student in Australia, using Strava’s Global Heatmap, tweeted about the military images available through the app.
The app uses a smartphone’s GPS and is meant to track where and when a user is exercising, creating a kind of global social network for athletes. It can also be synced with other fitness tracking devices such as Fitbits and smartphones.
Strava came out with the heat map last November. The map covers 17 billion miles of routes around the world.
Nathan Ruser, a founding member of the Institute for United Conflict Analysts and a student at the Australian National University, tweeted, “Strava released their global heatmap. 13 trillion GPS points from their users (turning off data sharing is an option). https://medium.com/strava-engineering/the-global-heatmap-now-6x-hotter-23fc01d301de … … It looks very pretty, but not amazing for Op-Sec. US Bases are clearly identifiable and mappable.”
“If soldiers use the app like normal people do, by turning it on tracking when they go to do exercise, it could be especially dangerous.”
Ruser noted how the heat map can be cross-referenced with the location of military facilities to monitor movement. The locations of many military facilities are already public knowledge through Google maps and satellite imagery. Potential bases in combat zones and troop movements can also be deduced using the same method.
For example, Ruser posted several pictures from Afghanistan where soldiers were most likely jogging or on a patrol.
He also showed what was most likely a Turkish detail on patrol in northern Syria near the city of Manbij as well as Russian troop movements in the Khmeimin Air Base in Syria.
Although security problems created by GPS tracking devices on personal electronic equipment are not new to the military, U.S. Defense Secretary Jim Mattis ordered a review of security protocols after Ruser’s tweets created a media storm.