Fitness Tracker Data Exposes Military Operations, Shows What Damage That Can Be Done With 'Just Metadata'
from the aggregated-damage,-individual-harms dept
Last November, Strava Labs released its "global heatmap" -- a stockpile of data created by millions of health-conscious people worldwide. Strava Labs is the GPS brain many fitness trackers rely on, allowing devices to record billions of steps recorded by millions of users. The company pulls data from big players like FitBit and Jawbone, as well as having its own fitness-tracking app. Here's what Strava Labs handed over to the general public:
1 billion activities
3 trillion latitude/longitude points
13 trillion pixels rasterized
10 terabytes of raw input data
A total distance of 27 billion km (17 billion miles)
A total recorded activity duration of 200 thousand years
5% of all land on Earth covered by tiles
Here's what Strava's activity data looks like transposed on a map.
All this metadata -- anonymized GPS points -- builds up quite a record of human movement. On top of tracking favorite jogging routes, the data is detailed enough to indicate where frequent exercisers live and work. This has been a problem for a few years now.
Two years before this data was published, Strava announced a new feature which allowed users to turn solo workouts into ad hoc competitions.
The new Strava Flyby feature enables users to see who they passed on runs and rides. Although this raises data protection concerns, and users should be aware of the change, it serves to connect the wider running and biking communities in an innovative way.
Andy Robertson covered this for Forbes in May of 2015. The Flyby feature connects users by providing them links to public profile pages of other users they'd "passed" during a run. The feature may not give users each other's addresses, but users can assume their "competitors" work or live close by.
Strava does allow users to geofence "private" areas to prevent tracking in those areas. But it's not a default option. If you don't want to share every movement with Strava, you have to opt out. Most users don't. And most users are seemingly unaware of how much data they're leaving behind.
This "metadata" -- something our government refers to as harmless when gathered in bulk -- can result in real-world security issues. Conflict analyst Nathan Ruser was the first to point out how Strava's data was making it easy for people to pinpoint military bases and operations.
Strava released their global heatmap. 13 trillion GPS points from their users (turning off data sharing is an option). https://t.co/hA6jcxfBQI … It looks very pretty, but not amazing for Op-Sec. US Bases are clearly identifiable and mappable pic.twitter.com/rBgGnOzasq
— Nathan Ruser (@Nrg8000) January 27, 2018
Even though many of these bases can be viewed via Google Maps or other satellite imagery, those static images don't contain a wealth of information on people's movement in or near those bases. Movement info collected near foreign military bases, especially those located in war zones, creates even bigger problems. What may look like a jogging path to Strava's database might actually be patrol routes or reconnaissance missions.
You can see the Russian operating area in Khmeimim, but also the guard patrol to the NE. pic.twitter.com/iWiX5Kozc1
— Nathan Ruser (@Nrg8000) January 27, 2018
Some heavy jogging activity on the beach around what looks like the reported CIA annex at Mogadishu airport pic.twitter.com/1OLP8zWKGl
— Adam Rawnsley (@arawnsley) January 27, 2018
Strava's data even provides info on human movements in places redacted from published satellite imagery.
Area 51 aka Groom Lake. Clearly they've been letting the aliens get some outdoor exercise. pic.twitter.com/KhaYVoaGnV
— Adam Rawnsley (@arawnsley) January 27, 2018
This has prompted a response from US government agencies.
The U.S.-led coalition against the Islamic State said on Monday it is revising its guidelines on the use of all wireless and technological devices on military facilities as a result of the revelations.
[...]
“The rapid development of new and innovative information technologies enhances the quality of our lives but also poses potential challenges to operational security and force protection,” said the statement, which was issued in response to questions from the Washington Post.
“The Coalition is in the process of implementing refined guidance on privacy settings for wireless technologies and applications, and such technologies are forbidden at certain Coalition sites and during certain activities,” it added.
Somewhat ironically, the Pentagon handed out fitness trackers to military personnel as part of a program to fight obesity. One the plus side, they appear to be heavily-used. On the downside, they're turned on and generating records of movement in areas the Pentagon would prefer civilians knew nothing about.
This again illustrates the threat posed by massive metadata collections. Those supporting surveillance methods like these claim data in bulk doesn't violate anyone's privacy. But the Strava data reveals a lot about fitness tracker users, even without releasing personally-identifiable info. In addition, fitness trackers are generating billions of third-party records that provide far more detailed records of movements than cell tower pings can. Even if the Supreme Court decides access to historical cell site location info requires a warrant, this tracking -- which allows for opt-out -- will have to be litigated as its own issue. Fitness devices may not be as ubiquitous as cellphones, but they are far from just a curiosity possessed by early adopters.
The lesson here isn't the surprising amount of data fitness trackers generate. It's the surprising amount of data every person generates during their day-to-day lives -- all flowing to multiple companies and almost all of it no more than a subpoena away from ending up in the government's hands.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: fitness tracking, location data, metadata, military bases, national security
Companies: strava
Reader Comments
Subscribe: RSS
View by: Time | Thread
The government will still demand access to any 'metadata' they can get their grimy claws on, and may very well get enhanced powers of surveillance to open up even more of this kind of collection. If the FBI had its way, J Edgar would be a saint.
[ link to this | view in thread ]
Area 51 aka Groom Lake has pretty good satellite imagery - mapped onto 3D terrain - published via Google Earth.
What it doesn't have is the 3D buildings - created with LIDAR and aerial photography from four different directions - that you see in cities and popular tourist spots on Google Earth. And no StreetView.
[ link to this | view in thread ]
Re:
Well. Until someone uses the metadata to link the bases to nearby red light districts. THEN you'll see a knee-jerk reaction.
[ link to this | view in thread ]
Re: Re:
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
Re: Re: Re:
[ link to this | view in thread ]
[ link to this | view in thread ]
The U.S.-led coalition against the Islamic State said on Monday it is revising its guidelines on the use of all wireless and technological devices on military facilities as a result of the revelations.
Does that mean there wasn't a strict rule set on outside technology already? I've worked at burger joints with better security protocols than these military bases.
[ link to this | view in thread ]
Re:
Fitbit and others connect to your CELLPHONES, and then the data is sent from there..
A bit of thinking and you could Pick up any person you wanted..
Then there is the idea that DOES THIS DEVICE TURN OFF??
Track your car??
TO MUCH TECH!!
[ link to this | view in thread ]
Re: Re:
And the rest of the population is on a strict healthy diet, so they don't need it either.
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
Re:
:p
[ link to this | view in thread ]
Re: Re: Re:
[ link to this | view in thread ]
Re: J Edgar's canonization
[ link to this | view in thread ]
Re: Re:
[ link to this | view in thread ]
Re:
As a thought experiment, what if Strava hadn't released this data publically? They'd still have all of it, and the military wouldn't have revised those guidelines. If banks and Bitcoin exchanges can be hacked, there's no reason to think Strava would be the only one with the data (assuming they don't sell it outright).
[ link to this | view in thread ]
Perhaps they should focus on themselves before demanding the world conform to their dreams.
[ link to this | view in thread ]
Re: Re:
I hate to tell you this, but cellphones also track you. So fitbit and other devices aren't necessary for tracking.
What is more interesting are the places where the devices aren't tracking (as they are removed or forced off.)
[ link to this | view in thread ]
[ link to this | view in thread ]
Re: Re: Re: Re:
[ link to this | view in thread ]
Re:
[ link to this | view in thread ]
[ link to this | view in thread ]
[ link to this | view in thread ]
Geeze, can't you guys even make this stuff *hard*?
Between this and meltdown/spectre, it's clear we need some fundamental rethink about how to get computers to encapsulate information.
In particular, let's look at the secret installation problem....if i know X is a secret installation (as with Taiwan's mobile missile launcher site), and I track all the phones that visit that site, and chain to wherever else those phones go, or don't go....
[ link to this | view in thread ]
Re: Re: Re:
ECA sometimes brings up good points, but his ranting and random capitalisation undermines them almost as much as his insisting on going to illogical extremes every time. He's not a troll, but I tune him out for those reasons most of the time.
[ link to this | view in thread ]
Re: Re:
[ link to this | view in thread ]