American nightmare: Iran tracked Strava data and launched precise strikes on US bases | Gravitas

Can data from an app which people use every day for recording their fitness activities be weaponised during a conflict?

A new report makes this precise assertion in the context of the West Asia war.

According to Sky News, over 1,300 Strava users on US military bases in West Asia have been sharing workout-related information which could have been used by Iran to target American forces.

This app allows users to share exact routes and timings of activities like running, cycling and swimming.

In May, US Senator Ron Wyden shared a letter in which CENTCOM admitted to having received multiple threat reports regarding exploitation of commercial location data to target US personnel.

The Sky News report also claimed that many of those posting their activities did so under their real names, thereby becoming potential targets for attacks.

Take a look at the example of Bahrain.

This country hosts the US Navy's Fifth Fleet headquarters in Manama.

After Iran launched an attack on this base in retaliation, speculation was rife about the whereabouts of the US military personnel stationed there.

According to Sky News, Strava data of a US Naval contractor gave away their possible location.

A week before the war, his activities were confined to this BASE.

After the Iranian attack, though, he recorded doing laps on Strava around the courtyard of the Crowne Plaza hotel.

Subsequently, Iran also bombed this hotel, which reportedly led to multiple Pentagon employees getting injured.

While it is not confirmed, the report indicated that Iran strategically used Strava data in this case.

While Pentagon had banned soldiers from using this app's location-tracking features without permission during deployment in 2018 itself, experts have flagged lax enforcement of this order.

Now, it is not just individual accounts, which could be an issue.

According to this report, Iran may have figured out a pattern by collecting data from thousands of accounts.

It gave the example of how 76% of Strava accounts at Jordan's Muwaffaq Salti air base were located at the barracks during the ceasefire.

When fighting briefly resumed in July, Iran attacked those very barracks, killing three US military personnel in the process.

Similarly, activities of three Strava users were also detected inside the nuclear research centre located in Israel's Dimona, which was also targeted by Iran.

Now, the danger of fitness apps being misused in military operations dates back several years.

In 2016, a US Defence contractor reportedly used commercially available location data to track special operations forces moving from American bases to a sensitive post in Syria.

Two years later, Strava's public heatmap exposed the locations of secret US and allied military bases in Syria, Iraq, and Afghanistan.

In 2024, media outlets analysed billions of location coordinates obtained from a data broker and reportedly tracked movements of around 11 US military and intelligence facilities in Germany.

This is not all.

In March this year, a French naval officer reportedly exposed the location of aircraft carrier Charles de Gaulle after recording his jogging on Strava while exercising on the ship's deck.

While the Pentagon is yet to comment on this, a Strava spokesperson told Sky News that the firm expects people working in sensitive professions to use privacy controls and appropriately limit their content.