Working out in war zones: fitness app reveals military sites

Where privacy and (in)security collide.


If you’ve ever used an app to record your walking, running or cycling, you’ll know how handy they can be. You may even have seen friends sharing their progress with automatic updates published on their social media accounts. Personally, I prefer to keep my details private, and never publish them – in-app, or beyond.


Last night (27 January 2018), twitter came alive with the news that fitness app, Strava, had released a global heat map of user activity – including sites in conflict zones, areas of military operations, and other sensitive locations.

Researchers, analysts and others had a – somewhat alarming – field day.

Nathan Ruser of IUC Analysts appears to have been first off the mark:

Think-tanker and Syria researcher, Tobias Schneider, picked up on Ruser’s theme:

Journalist, John Beck, also noticed:

As well as Eliot Higgins of Bellingcat:

His response to a query provides a very succinct explanation, for those unsure of the implications of Strava’s release of this mapped information:

Dan Murphy also summed it up, thusly:

And Joshua Forman of MIT gave his summary:

The news, naturally, continued to quickly spread. Some tweets from someone interested in tracking government-supplied arms in MENA:

Here’s journalist Adam Rawnsley of the Daily Beast, also looking further afield, including the South China Sea, Iran and Somalia – and Area 51, naturally:

Adam shared this link to a Foreign Policy piece by Jeffrey Lewis, to provide “an idea of what a reasonably competent adversary could do if they pwned Strava”:

Adam also took a peek at Strava data elsewhere in the US:

He wasn’t the only one – the aforementioned Jeffrey Lewis tweeted:

Kate Oh, of the ACLU, explained Jeffrey’s finding:

Which he also later elaborated:

Across the pond, there was also this find by Phil Chamberlain, Head of the School of Film and Journalism at UWE Bristol and author of Drones and Journalism:

You can almost make out the early modern design of the original fortress defences, intended to deflect cannon shots.

But it’s not all about military installations. The cause of this flurry of activity on twitter and these finds originates with personal data.

Lawyer, Tiffany C. Li, of The Information Society Project at Yale Law School wrote in relation to the privacy aspects:

Here in Ireland, Pat Walshe recalls GDPR requirements and a previous overview of Strava’s data protection compliance:

All of the data used to populate Strava’s heat map derives ultimately from personal data – those people using the app, logged in with their personal details while the app gobbles up and processes data relating to everything they do while using it.

To generate the map, Strava may strive to ‘anonymise’ the data. This may be successful (I stress: may be) in a large and busy metropolis such as New York. However this anonymity breaks down in sparsely populated areas.

In low population areas, it may become easy to identify individual activites – if not the individuals themselves. If this is the case, the data are no longer anonymised: they have become personal data. And, as this information involves location data, this may also amount to sensitive personal data, according to the Court of Justice of the EU (CJEU). (A guidance note from Ireland’s ODPC can be read here.)

Consider, for instance, the example found by one tweeter last night. This (which I am not linking to here) was of a remote compound in a conflict zone which has seen multiple mass atrocities over recent years.

From its appearance, there is a possibility that it is a UN compound. On the Strava heat map overlaid on the site, we can see multiple, overlapping perimeter routes and tracks.

However, we can also see where the individual has kept their device on when they re-entered the compound, and they can be traced through the compound into individual buildings – including their destination building. This may be assumed to be either washing facilities, accommodation, office or (given the small size of the compound) all three.

Let’s say, if I had been based locally and was watching this individual from afar, and wished to know where to access their private rooms, now I know.

Oh yes, by the way: today is 28 January. Happy Data Protection Day!

Discussing Direct Provision with Liveline’s Joe Duffy

Yesterday, I received a call from researchers of RTÉ Radio 1’s Liveline programme, asking me if I would be available and willing to speak about the issue of of local election candidates’ access to Direct Provision centres.

Below is a transcript of my discussion with Liveline’s presenter, with Joe Duffy, which took place at around 2pm.

You can listen to the programme here. (My contribution is about seven and a half minutes long, followed by contributions from Margaret Peters and another caller.)


Politicians are still not allowed to talk to people living in Direct Provision

[UPDATE 16th May 2014 at 9:05am]

The Dr Liam Thornton on the Human Rights in Ireland blog has summarised arguments put forward by the State in an ongoing legal challenge to the system of Direct Provision in Ireland. These arguments include the rationale behind the introduction of the system of Direct Provision.



Does this remedy this? In short: no.

Not least because it seems that the Circular issued by RIA purports to maintain a prohibition on election candidates speaking with residents; nor due to the fact that RIA continues to insist on imposing a designation of “politically neutral environment” upon every Direct Provision centre in Ireland.

More fundamentally, there appears to be precisely zero basis in law for RIA’s missives.

Small change

The headline in TheJournal.ie remains a true statement: Politicians are not allowed to talk to people seeking asylum in Ireland.

The Circular which was issued within 24 to 48 hours of Donnchadh Ó Laoghaire’s initial tweets makes one change to existing RIA policy. Election candidates “may be allowed to drop off election leaflets to be picked up and read by residents if they so wish,” which “may be left in a suitable designated area” within the Direct Provision.

This is the only explicit change in RIA policy. Everything else remains as it was.


An interference with democratic process: the right to vote in Ireland

On 12th May 2014, I attended a conference on women in the media, during which one of the speakers, Katie Orenstein, posed a powerful question:

What is the cost to society if so many voices and minds are missing? Image: The OpEd Project-EDUlibs

What is the cost to society if so many voices and minds are missing?
Source: The OpEd Project/EDUlibs

This question is relevant including and beyond issues of sexism and exclusion of women from positions of power and influence. Yesterday, it emerged (not for the first time), that election canvassers are prohibited from canvassing at direct provision centres in Ireland.

There are approximately 4,360 asylum seekers and survivors of human trafficking residing in direct provision accommodation in Ireland. Every adult among them has the right to vote in local elections.

If candidates for political election are impeded in canvassing the views of some of their constituents, then what becomes of those views? And how can the eventually elected politicians properly represent members of society in their constituencies?