Every Time Strava Exposed Military Positions

Strava released its Global Heatmap — a visualization of every activity ever uploaded by its users. In major cities, it was a beautiful data art project. In Afghanistan, Syria, and Somalia, it was a classified intelligence disaster. Soldiers running laps around secret forward operating bases lit them up like Christmas trees on a dark map. Bases that didn’t officially exist were suddenly outlined in neon by jogging routes.

Researchers quickly realized the heatmap was just the beginning. By cross-referencing Strava usernames, running routes, and public profiles at the now-exposed base locations, they could identify individual soldiers stationed at classified facilities. Some profiles included real names, photos, duty stations, and home addresses. A few clicks could take you from a glowing dot on a heatmap to a service member’s Facebook page.

Researchers from Bellingcat and De Correspondent demonstrated that Polar Flow — a competing fitness app — was even worse than Strava. Its API allowed anyone to pull the complete exercise history of any user, including locations. They identified military and intelligence personnel exercising near the NSA, MI6, the French DGSE, Guantánamo Bay, and nuclear weapons storage facilities. Individual agents could be tracked from their workplace to their homes.

French soldiers deployed in the Sahel region of Africa were found to have uploaded patrol routes to Strava. The GPS traces showed exact paths, timing, frequency, and rest points of military patrols in active conflict zones. Anyone monitoring these routes could predict patrol schedules and identify optimal ambush points.

In the lead-up to and during Russia’s invasion of Ukraine, Strava data revealed Russian military positions. Soldiers’ running and cycling routes near military installations showed troop concentrations, staging areas, and base layouts. OSINT analysts used the data to track unit movements and verify intelligence reports about the Russian buildup before the invasion was officially acknowledged.

Strava activities uploaded by US Secret Service agents revealed their movements and locations, including details about presidential security perimeters. Agents’ running routes near the White House and at travel locations showed protective detail patterns, advance team movements, and security staging areas. Their profiles were public.

A sailor aboard the French aircraft carrier Charles de Gaulle posted a jog on Strava while the ship was at sea. The carrier’s exact GPS coordinates appeared on the public activity map. A nuclear-powered aircraft carrier — one of the most strategically valuable and heavily defended military assets on Earth — had its position broadcast to anyone with a web browser because someone wanted to log their 5K.