The Strava Heat Map That Revealed Military Bases Can Identify Individual Users, Too

More bad news for the GPS tracking company.

Pattern, Design, Graphics, Fractal art,

Recently, GPS company Strava released what it called the Global Heat Map, a map of the locations of everyone using their technology. Because Strava tech is found in a lot of GPS-enabled devices, including fitness trackers like Fitbit, this ended up including a lot of data from a lot of people.

Some of those people, it turns out, are military personnel working at sensitive bases around the world. The countries that own these bases would prefer their locations to remain secret, but thanks to Strava, anyone with a Wi-Fi connection can figure out where they are pretty easily. Internet sleuths have already uncovered military bases in Afghanistan, Syria, and Ukraine.

That’s still not the worst part. When Strava released its heat map, it claimed the data was anonymized so no one could identify individuals from the map alone. But according to a report from Wired, this is not the case. Combining data from the heatmap with data from Strava’s own website, it’s possible to get the name of any one of Strava’s users.

Strava’s website allows users to create "segments," which are essentially small areas where users can compete with each other for the best times. Each segment gets a leaderboard, which is publicly available on Strava’s website. Anyone can create a segment, which means anyone can see the leaderboard, filled with the names of individual Strava users.

Some people have already used this technology to identify individual soldiers working at classified military bases. The Guardian identified 50 service members working on a base in Afghanistan, and blogger Steve Loughran used this technique to identify more than a dozen service members at a submarine base in the U.K.

Strava put out a statement yesterday saying that it’s “committed to working with military and government officials to address potentially sensitive data,” but at this point it might be too late. Once the data is put out there on the internet, there’s no way to take it back.

Source: Wired

Advertisement - Continue Reading Below
More From Security