21 ms·

Strava heatmap can be used to locate military bases

695 points by domoritz 9y ago

simooooo 9y ago
Very clever
- sctb 9y ago
  We already asked you to please start posting substantively, so we've banned the account. We're happy to unban accounts if you email us at hn@ycombinator.com and we believe you'll post civilly and substantively in the future. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
chatmasta 9y ago
It’s unbelievable that any military allows its soldiers to deploy carrying consumer technology equipped with GPS tracking.
- madez 9y ago
  By now we all should have realized that all but a tiny fraction of people is illiterate about computers, the internet and their possibilities and dangers.
  - madez 9y ago
    Let me piggyback on my own comment. Because there are only so few people who have factually so much power, I urge every hacker, everybody who understands the digital world, to act in the best faith of everybody. This technological revolution is too important to serve only a few. Luckily, many hackers do the right thing and don't do everything they could to maximize their immediate benefit. I sincerely hope for humanity, for the people of poor countries, for people suffering from corrupted governments, for people who weren't as fortunate as we were, that we provide them with the technology they need. But we must not maintain control over it to have control over them. Free and just software and hardware must prevail.
- knolan 9y ago
  There are troves of historically important photographs from various wars taken by soldiers with forbidden personal cameras. [0] In some ways this is similar however the immediacy of the data in an active conflict is more troubling. [0] https://www.amazon.com/Lens-Infantryman-Memoir-Photographs-Hidden/dp/0786428678 https://www.amazon.com/Lens-Infantryman-Memoir-Photographs-H...
- ribasushi 9y ago
  I have a close friend with the US military, who was deployed to Germany in 2017. Their brigade was moving various equipment from base to base. Their only means of communication with superiors was a bog-standard cell phone with a US-number SIM-card. Forget the tracking implications: orders were texted, often via SMS.
  - 3pt14159 9y ago
    Yeah people on HN and elsewhere really have this warped view about how secure things are. They don’t understand that militaries and intelligence agencies are run by normal people with normal beauracies and dumb rules and shortsights. Look at the Snowden leaks, these people are not magical space wizards.
    - pferde 9y ago
      No, we understand that. We're just continually surprised that world's largest and most expensive army keeps shooting itself in the foot like this.
      - TeMPOraL 9y ago
        It's a trade-off, I think. I doubt there's much actionable intel for an enemy to be found in logistics orders of a base in Germany.
        lostlogin 9y ago
        Maybe not now, but in a war there definitely is.
        mseebach 9y ago
        Use your imagination. Having a scrap of inside knowledge is a great asset for recruitment. You establish yourself as an insider and the target is more likely to spill some beans. “Yeah, getting all those Foo widgets to that secret storage place was a real pain, I know! It was bunker X9, I think.. that’s the worst, am I right?"
- JonnyNova 9y ago
  The US military is ass-backwards when it comes to dealing with technology. Want to transfer files between computers? Can't use a thumb drive! You need to burn a disk (for real).
  - toomanybeersies 9y ago
    That does't sound like terrible infosec. Flash drives are a huge security vulnerability. With more secure workstations you can't plug in any USB peripherals, because they're such big risk. Write only media is a lot safer, despite the waste it causes.
    - rocqua 9y ago
      I'm pretty sure SD cards have a lot less vulnerabilities than USB sticks. Especially because they cannot pretend to be a keyboard.
      - acdha 9y ago
        They can still pretend to have / not have files so it’s hard to say that you’ve verified nothing sensitive is leaving or that no malware is coming in.
      - lawl 9y ago
        There's WiFi enabled SD cards[0]. I had one of those and it was running Linux, you could SSH into it. Maybe the attack-surface to the host computer is smaller (I'm not sure about that either). But there's certainly enough bad stuff an SD card could do. [0] https://hackaday.com/2016/06/30/transcend-wifi-sd-card-is-a-tiny-linux-server/ https://hackaday.com/2016/06/30/transcend-wifi-sd-card-is-a-...
  - acdha 9y ago
    If you look deeper into the security issues of USB and it’s less surprising: beyond the risk of basic malware, the devices are usually hackable which makes really hard to be certain about anything. Cutting out whole classes of attack makes sense when you know you have highly-skilled, well-funded adversaries and the budget to simply write off the extra overhead. Remember that their threat model doesn’t end at “my dirty picture collection leaked” but “we lost a war” or “we have to ask Congress for 10e9+ dollars for repairs/replacements”. This got a lot of attention a couple years ago: https://www.blackhat.com/us-14/briefings.html#badusb-on-accessories-that-turn-evil https://www.blackhat.com/us-14/briefings.html#badusb-on-acce... This kind of problem is endemic to small cheap devices, too – for example: https://www.bunniestudios.com/blog/?p=3554 https://www.bunniestudios.com/blog/?p=3554
- sailfast 9y ago
  I respectfully disagree. For most troops, deploying with your personal device is a huge morale boost. Blocking GPS on these devices is not practical, and might actually help when it comes to innovation in the field (helicopter pilots using iPads to innovate routing, for example) - not to mention just basic morale (movies / music / what have you). These tools also go a long way toward operational readiness / fitness. They incentivize these things and are used for a reason. There are trade-offs with all these things, not to mention the practical issues of blocking them. I would expect, however, that identifying this as a huge security problem is relatively easy. "HEY DO NOT UPLOAD YOUR RUN WHILE DEPLOYED OR YOU MAY GET MORTARED" is likely a better option here, just below "MAKE SURE YOU WEAR YOUR NEON BELT" on every sign.
  - lostlogin 9y ago
    > basic morale (movies / music / what have you). Communication with family and friends would be my first thought. Many historical accounts put a lot of emphasise on the mail delivery and what the news from home was. It must be/have been a significant problem dealing with the mail when you had a lot of troops in the field.
    - sailfast 9y ago
      Totally Agree. I was not assuming broadband capability / cell service for my hypothetical (also traditional comms may be limited in remote / classified environments) but that's definitely another reason to have a personal device. Comms with family would be critical if they are possible.
  - jonahx 9y ago
    > "HEY DO NOT UPLOAD YOUR RUN WHILE DEPLOYED OR YOU MAY GET MORTARED" is likely a better option here, just below "MAKE SURE YOU WEAR YOUR NEON BELT" on every sign. I take the whole lesson here to be: information can leak in unexpected ways. So solving this particular issue does nothing to help the larger problem. I'd imagine there are countless similar side channel leaks that already exist... and then even more that don't exist yet but will retroactively exist with a future phone or app update. The fox is in henhouse.
- einarfd 9y ago
  I'm not surprised at all. If you look at GPS watches like Garmin tactix Bravo. It has a feature set, where some of the features, really only makes sense in a military/hunting setting. Although I wonder what kind of animal you are hunting if you start your hunting trip by doing a HALO parachute jump. Garmin is not the only one making those kind of GPS watches either. I believe that Suunto has similar watches as well. Obviously the soldiers should not be uploading their GPS tracks to Strava. But banning your non special forces soldiers from buying the same "civilian" watches that your special forces soldiers use. Sounds like a morale killer.
starpilot 9y ago
Are any of these locations actually secret?
- Rebelgecko 9y ago
  It's pretty easy to find Al-Udeid Air Base, which was secret until the mid 2000s. Some of the other details like patrols, convoy routes, and missile battery locations may not be classified, but are probably things the US military would rather not see online
  - samstave 9y ago
    Given the visibility of HN threads I expect this data to get scrubbed post-haste - so download it / archive it ASAP
- markmark 9y ago
  All I see are people looking at places they already know about and seeing that people have used Strava there. If these people already know the locations, so does anyone else who matters.
- RandomCSGeek 9y ago
  Not secret in the sense that the enemies of respective nations already knew them, but secret in the sense that only the militaries knew them, now the whole world does. I think the patrol routes are more important(fun) than locations.
  - vobios 9y ago
    But aren't the enemies the only ones that matter?
orliesaurus 9y ago
How did no one working at Strava think about the implications of releasing this data? Zero scrutiny? I am sure there are some very interesting locations on there... reading through the twitter thread it would seem so
- snowpanda 9y ago
  To be honest I'm more concerned personal devices were allowed at these locations. That and somebody posting it on Twitter instead of disclosing it responsibly to the parties involved. Sure it's not his fault, but he doesn't need to make it worse.
- benoliver999 9y ago
  They clearly have not thought about how easy it is to de-anonymise this data in areas with few trackers. Classic SV short sightedness.
- LeifCarrotson 9y ago
  You know what else is public , insecure information? Maps. Pictures. Roads. Physically going to a location and seeing a driveway. Yes, there is a bright line on Strava that leads from a spiderweb of trails in the park right to the door of my private, personal house! My neighbors don't run often, but I post on Strava 5 days a week, so my driveway stands out like a yellow arrow. You could learn, from the Strava dataset, that someone (me) lives in my house. Gasp! /s. Of course someone lives in my house. It is not news to anyone local. My address is on the map, and it's pretty obvious that someone lives here if you drive by and see it. What damage has Strava done by releasing this data? Humans that post on Strava are not hermits, trying to remain secret in their underground hideouts in the middle of nowhere. We live in houses, or on giant military bases...we're not exactly hidden.
  - lstroud 9y ago
    I wonder if you can deduce the times of the runs from the data.
    - 9y ago
natch 9y ago
In some cases where the data is sparse, you can find where individual people live, because the trails sometimes lead back to a starting point. Like this person who runs around the park regularly. Of course you could also just follow them IRL if you were there, so I'm not sure this is a big deal. https://labs.strava.com/heatmap/#14.20/100.20693/40.99133/hot/all https://labs.strava.com/heatmap/#14.20/100.20693/40.99133/ho...
- dalemyers 9y ago
  It means that you can reliably predict where someone is gong to be, and for many people, that's a huge safety concern.
  - maxerickson 9y ago
    So one of the reasons they publish the heat map is that it is a great tool for trail and route discovery. Look at an area where you haven't been before and activities pop right out. Many Strava users are using it this way. So the concerns of people that need privacy are being balanced against that. Are the 2 options of either not using the activity tracking app or activitating the privacy setting not sufficient for people with safety concerns regarding their location?
    - givinguflac 9y ago
      Strava could easily make this opt in, or they could filter spots where there are only a few people using it. There are a ton of in between options, this data is not a yes or no scenario.
      - acdha 9y ago
        That seems like the best option: multiple users whose activity patterns aren’t highly similar (i.e. couples who run together) and blur start / end points which aren’t used by many people at different times.
        9y ago
natch 9y ago
At Apple Park (AC 2), the spaceship footprint is still invisible as of the date of this data. Next year it should be clearly visible. (Sorry, off topic with respect to the "military base" in title, just having fun browsing the data). https://labs.strava.com/heatmap/#16.00/-122.01101/37.33445/hot/all https://labs.strava.com/heatmap/#16.00/-122.01101/37.33445/h...
- fbdjskajxb 9y ago
  Interesting, either that shit is locked down tight, or Apple got them to scrub it. The parking lot isn’t empty, though.
  - dbcurtis 9y ago
    City of Cupertino just issued the occupancy certificate for the spaceship this week, so I wouldn't expect a lot of joggers yet. No conspiracy, just planning department bureaucracy.
    - fbdjskajxb 9y ago
      Regardless of the occupancy certificate, a pretty large number of humans must have stepped foot there already.
- minimaxir 9y ago
  Granted, Apple employees may be more prone to use an Apple Watch instead of a Strava.
  - nlh 9y ago
    Strava has an Apple Watch app (source: I use it regularly).
natch 9y ago
Taos Ski Area: https://labs.strava.com/heatmap/#14.28/-105.45449/36.58046/hot/all https://labs.strava.com/heatmap/#14.28/-105.45449/36.58046/h... Heavy straight lines are lifts.
pella 9y ago
for finding other places: see OpenStreetMap key:military: https://wiki.openstreetmap.org/wiki/Key:military https://wiki.openstreetmap.org/wiki/Key:military https://taginfo.openstreetmap.org/keys/military#values https://taginfo.openstreetmap.org/keys/military#values
hex12648430 9y ago
Some other fun (but not so secret) things to look at: research stations in Antarctica, tourism in North Korea (as well as some officials traveling it seems; some tracks cross the DMZ), your own garden if you have one. There's even a track at the Area 51.
- jzwinck 9y ago
  Moving between North and South Korea is restricted but not completely eliminated. There are people who legiimately work in one and live in the other (not just officials).
  - samstave 9y ago
    What kinds of jobs do those people hold?
    - azernik 9y ago
      If they're including old data, up to two years ago there were quite a few South Korean managers and engineers working at the Kaesong Industrial Zone (https://en.wikipedia.org/wiki/Kaesong_Industrial_Region https://en.wikipedia.org/wiki/Kaesong_Industrial_Region)
- jpindar 9y ago
  Here's an analysis of the data from North Korea: https://www.northkoreatech.org/2018/01/29/strava-heat-map-north-korea/ https://www.northkoreatech.org/2018/01/29/strava-heat-map-no...
emilfihlman 9y ago
Anyone know how to download (a portion) of the dataset?
- exikyut 9y ago
  HERE IS HOW TO DOWNLOAD IT I just spent a few minutes figuring it out. First grab some coordinates, I picked a totally random spot in NY: https://labs.strava.com/heatmap/#16.11/-73.96162/40.73006/hot/all https://labs.strava.com/heatmap/#16.11/-73.96162/40.73006/ho... Now feed the GPS coords into the algorithm at https://wiki.openstreetmap.org/wiki/Slippy_map_tilenames https://wiki.openstreetmap.org/wiki/Slippy_map_tilenames I can use PHP faster than anything else, so I used the PHP example on that page. $zoom = 15; $lon = -73.96162; $lat = 40.73006; $xtile = floor((($lon + 180) / 360) * pow(2, $zoom)); $ytile = floor((1 - log(tan(deg2rad($lat)) + 1 / cos(deg2rad($lat))) / pi()) /2 * pow(2, $zoom)); print "x: $xtile\n"; print "y: $ytile\n"; This printed: x: 9651 y: 12318 If I go to https://heatmap-external-c.strava.com/tiles/all/hot/15/9651/12318 https://heatmap-external-c.strava.com/tiles/all/hot/15/9651/..., I can see a portion of the map that's on the screen. My email is in my profile, downloading this would be very fun. It would just need a tonne of bandwidth and even more diskspace, and I don't have much of either myself.
  - maxerickson 9y ago
    I think they mean the underlying data rather than the tiles. MOBAC is made for caching map tiles: http://mobac.sourceforge.net/ http://mobac.sourceforge.net/
    - emilfihlman 9y ago
      I mean the tiles because the actual dataset is not publicly available and I doubt it will ever be. One reverse a portion of the dataset from the tiles, though.
      - maxerickson 9y ago
        You could check the OSM gps layer to see if it has interesting data in the area; you can directly fetch the data there. https://www.openstreetmap.org/#map=18/38.03114/-78.52475&layers=G https://www.openstreetmap.org/#map=18/38.03114/-78.52475&lay... There's less traces than Strava has though.
lfcipriani 9y ago
Strava allow you to configure privacy zones and range around them. I believe/hope this map doesn't include them.
- hex12648430 9y ago
  These zones are excluded according to their blog post. https://medium.com/strava-engineering/the-global-heatmap-now-6x-hotter-23fc01d301de https://medium.com/strava-engineering/the-global-heatmap-now...
  - aluhut 9y ago
    They are. A few years ago I had the app installed for one trip. The track on my property is not visible on the heat map.
- taneq 9y ago
  Aggregate data about private zones would give the company these some interesting data, especially combined with other customer data. Knowing which people don't want you tracking their location, and where, and how these zones line up between different groups of people, would give you a lot of information about what areas each group considers sensitive. (e.g. Say you could cross-reference some of your customers with military ranks, and a bunch of people above rank X had a certain area blocked out. You could then infer that (a) there's something there that only people with that level of clearance would know about, and (b) then infer that anyone else who blocked it out had at least that level of clearance.)
  - deleted 9y ago
    [deleted]
tviling 9y ago
No activities in Area 51
arca_vorago 9y ago
Yet people think I'm paranoid for not wanting whatever the latest health tracking gadget is. I would love to have an FOSS fitbit equivalent that doesn't share my information with anyone but me, preferably a manual download or a manual bluetooth switch (so it can be off when out and about). It's like these companies valuations aren't off the product, but more off how much data they are getting off consumers. I bet they are selling this to advertisers.
- rorykoehler 9y ago
  I'd imagine they are mainly selling to governments and town planners.
  - zimpenfish 9y ago
    No need to imagine; they're quite up front about it. https://metro.strava.com/ https://metro.strava.com/ > Metro anonymizes and aggregates this data and then partners with departments of transportation and city planning groups to improve infrastructure for bicyclists and pedestrians.
aluhut 9y ago
I wish there would be some easy to do service where you can set up a "strava like" service on your webspace. I know people who use Strava or similar and are somehow aware of their privacy but "it's so easy and it works"....
- oceanic 9y ago
  Well, there is OwnTracks, it’s self hosted and has mobile apps… http://owntracks.org http://owntracks.org
  - aluhut 9y ago
    Doesn't look "easy" in the common sense but thanks, I might even have a free Pi somewhere. I'll give it a try.
throaj19s9a 9y ago
You can find out certain routes Pine Gap(NSA spy base) employees take. You can even pinpoint which buildings in their spy base have higher security clearances. You can even see them patroling and exploring their land, and someone randomly running in a circle.
YTGRK 9y ago
https://youtu.be/I2l8xkjTUh4 https://youtu.be/I2l8xkjTUh4
drtillberg 9y ago
Is there an explanation somewhere of how Strava got this fitness data and why they published it?
- nebulous1 9y ago
  Did you think to look up what Strava do?
mixologic 9y ago
Burning Man looks pretty cool: able to see year over year changes to the perimeter map: https://labs.strava.com/heatmap/#14.33/-119.21108/40.78291/hot/all https://labs.strava.com/heatmap/#14.33/-119.21108/40.78291/h...
- myth_buster 9y ago
  Lovely! That's going up as a poster on my wall.
  - jonalmeida 9y ago
    If you come up with a nice high res screen grab for your print, could you please share it here? Might want to use it for a wallpaper background.
    - ce4 9y ago
      Here's one, alas there's no higher res tiles than z15. https://drive.google.com/file/d/1M3x_IO0jpKd6qMfHO7cfjv0H2nvErV2w/view?usp=sharing https://drive.google.com/file/d/1M3x_IO0jpKd6qMfHO7cfjv0H2nv...
MrBuddyCasino 9y ago
I don‘t get why people loose their shit about something that every LEO spy satellite can see since 30 years. Its just a plain old Twitter outrage.
- caio1982 9y ago
  Where's the outrage?
- froindt 9y ago
  As others have noted, this goes beyond just "there's something here". For military bases, you can sometimes get a good idea of the patrol routes. For sparsely populated areas, you can get a good idea of what routes a particular home owner exercises on.
iser 9y ago
https://twitter.com/kevinkiklee/status/957629856518459392 https://twitter.com/kevinkiklee/status/957629856518459392 I just created an overlay of Google Maps and Strava Heatmap of the forward operating base I was at in Afghanistan. The heatmap clearly shows the layout of the base. That base has been in operation for at least 6-8 years, and it is well-developed. The up-to-date satellite imagery of the area is not available on Google Maps for a good reason, and Strava just released it. I imagine that this heatmap has been thoroughly scraped already. * I was deployed to Afghanistan from 2011-2012. edit: initially mis-typed '2011-2102' =D edit2: A well-established military base, even in a combat zone, has access to wifi and cellphone network. We are constantly training physically, and we like to keep track of ourselves. We were early adopters of fitness trackers, and I used a couple of them myself also.
- givinguflac 9y ago
  That’s one hell of a deployment duration! :)
  - iser 9y ago
    =D
- maxerickson 9y ago
  So what other internet services have deployed soldiers sent sensitive location data to? Does each internet service need to proactively hire someone with clearance and coordinate hiding of sensitive information with the US military?
  - iser 9y ago
    We were on a separate network from the secured military network, but we had complete and free access to the internet when I was there 6 years ago. Even in the most remote combat operating posts, we had access to wifi. Not sure if this can be solved from the civilian side. There is just too much information being transmitted out of a combat zone, and I think it has to be controlled from the source. Certain sites need to be just blocked in combat zones. Rather, we need to only have a list of allowed sites. I know how much it sucks in a combat zone, and I know how much that internet connection makes someone feel like they are still part of the civilization. However, some data just should not be transmitted out of it, and it needs to be heavily controlled.
sathackr 9y ago
Just about any satellite photo provider can be used to locate military bases also. The heatmap is neat but I don't see why it's specifically bad for military bases.
- xrisk 9y ago
  Patrol and supply route information I guess?
  - samstave 9y ago
    I can honestly see this as a DND scenario: “I roll to see what I can find out about their supply routes” 20 “Ok, you can see from their strava heat maps their supply routes go north to south along this particular road” “When do they happen” “Roll for perception” 20 (Fuck this guy) “Ok, you see that they result every Thursday at noon” “That’s when we’ll attack!”
  - vobios 9y ago
    Do you think the locals don't already have that info? The soldiers are not invisible.
- samstave 9y ago
  Honest questions: Who are the “any satellite photo providers”? How many are there? How do I find them?
  - sathackr 9y ago
    I'm not sure if you're being pedantic in that most 'satellite' photos are actually aerial or not. The more obvious sources would be Bing Maps and Google Maps/Google Earth, and they likely aggregate multiple sources. I know I've seen Digital Globe[2], USGS[4], and Pictometry[5] cited as sources. A quick Google search[1] brings up Digital Globe[2] and a list[3] as the first two non-sponsored results. [1] https://www.google.com/search?q=Satellite+photo+providers https://www.google.com/search?q=Satellite+photo+providers [2] https://www.digitalglobe.com https://www.digitalglobe.com [3] http://gisgeography.com/free-satellite-imagery-data-list/ http://gisgeography.com/free-satellite-imagery-data-list/ [4] http://earthexplorer.usgs.gov/ http://earthexplorer.usgs.gov/ [5] https://www.eagleview.com/product/pictometry-imagery/ https://www.eagleview.com/product/pictometry-imagery/
tree_of_item 9y ago
I guess I'm slow, why are these pictures obviously of military bases? What's going on here?
- iser 9y ago
  A well-established military base, even in a combat zone, has access to wifi and cellphone network. We are constantly training physically, and we like to keep track of ourselves. We were one of the first adopters of fitness trackers, and I used a couple of them myself also.
RandomCSGeek 9y ago
Just started, and already found a patrol route of Pakistan army, although it was quite obvious one, going parallel to a border river. Hope they don't take this down, it's going to entertain me for many days to come. On a more serious note though, this is an good example of how important it is to control our own data. It only makes me take even more efforts to secure my data and to try to make less of it available to others. We really need to convert Internet to what it was meant to be, a "decentralised system"
- kakarot 9y ago
  I don't think a heat map of your surrounding environment counts as "your data". Virtually every government seems to feel the same way, and in a rare moment I find myself in agreeance, even if this perspective currently manifests itself mostly in drug-related stings
  - RandomCSGeek 9y ago
    Not the heat map of surroundings, but the map of routes taken by people, especially when it's not anonymised due to getting overlapped by other data, can surely be considered as personal data. Like in this case, it's with soldiers patrolling remote areas. I guess the devs who made this heatmap forgot that one should remove data when there is not enough info to anonymise it by virtue of aggregation.(overlapping of multiple paths in this case). What I was suggesting is that people should care about who gets to see the data they generate and try to minimise the count. btw I didn't understand what you meant in the second sentence.
    - fjsolwmv 9y ago
      Parent was confusing a data "heat" map plot with sensors that detect actual infrared heat emitted by grow ops.
      - kakarot 9y ago
        I sure was. Misinterpreted my parent comment. My apologies!
maelito 9y ago
People don't run in the Père Lachaise cimetery in Paris, interesting !
kebman 9y ago
I found several border crossings between Russia, Finland and Norway that doesn't seem entirely legal. ;)
- jpindar 9y ago
  Same with North Korea.
  - IncRnd 9y ago
    For people's safety, you might want to delete that comment.
    - deleted 9y ago
      [deleted]
  - iaw 9y ago
    I found both activity at Pyongyang and what appears to be a smuggling route from China into NK.
    - dionidium 9y ago
      You think people are turning on Strava to track their smuggling activity?
      - Whitestrake 9y ago
        I would have assumed that people wouldn't turn on their Strava to track their military activity, either, but here we are.
        dionidium 9y ago
        They don't. There seems to be some confusion about how Strava works in this thread. People turn it on to track physical activity (i.e. exercise). Nobody is tracking their "military activity." They're turning Strava on when they go for a jog around the base. And then they stop it when their run is finished. If enough people on the base do this, then common routes will stand out on the aggregate map. Nobody on a smuggling operation would have Strava turned on. That makes no sense.
brohoolio 9y ago
The most interesting thing I stumbled across so far is Detroit, where people don't run in huge swaths of the neighborhoods. I'm familiar with the city so I expected dead zones, but nothing like this. https://labs.strava.com/heatmap/#9.47/-83.46871/42.45553/hot/run https://labs.strava.com/heatmap/#9.47/-83.46871/42.45553/hot...
- Strom 9y ago
  > where people don't run More accurately it's where people don't send their tracking data. Plausible to also say that it's where people don't own this tracking software/device at all. However it seems like a gigantic stretch to derive that there's no running going on.
  - deleted 9y ago
    [deleted]
  - frakkingcylons 9y ago
    That's true. Nevertheless, it's interesting (though unsurprising), to see the areas where Strava users don't run.
    - Balgair 9y ago
      https://statisticalatlas.com/place/Michigan/Detroit/Race-and-Ethnicity https://statisticalatlas.com/place/Michigan/Detroit/Race-and... Maps ok-ish to the African American population distribution
- llimllib 9y ago
  In the US, it's almost entirely rich, white people that upload data to strava. You can easily see racial/economic divisions in any major united states city. Baltimore is a great example[1]; white people live in the center but not on the east or west sides (Canton excepted). [1]: https://i.imgur.com/RXSfgz1.jpg https://i.imgur.com/RXSfgz1.jpg
  - 9y ago
sflicht 9y ago
surprisingly nonzero adoption of fitness trackers in Pyongyang
ithinkso 9y ago
Everest Base Camp is clearly visible - together with full south col route and a lot of teleports to the summit https://labs.strava.com/heatmap/#14.32/86.87956/27.98295/hot/all https://labs.strava.com/heatmap/#14.32/86.87956/27.98295/hot... https://www.google.pl/maps/@27.9786991,86.8796431,8552m/data=!3m1!1e3 https://www.google.pl/maps/@27.9786991,86.8796431,8552m/data...
- gruez 9y ago
  >and a lot of teleports to the summit can anyone explain what happened here?
  - diggernet 9y ago
    Phone off because it's not useful while climbing, but then gotta whip it out for that selfie at the top?
  - Bedon292 9y ago
    I imagine it has something to do with sparse tracking. The final ascent / decent is I think the better part of an entire day. You can't have full high accuracy GPS on for that long and have the battery last. So you may put the device away for a while, and get it back out when you finally summit to track that you were there. And lower on the mountain you might have extra ridges in the way, like in a city with lots of tall buildings, where you just can't get the best signal. And on Everest there is no WiFi or cell signal to cheat with. I would also think that personal device GPS may get a bit confused at that altitude. That is not really the expected working conditions.
  - hbosch 9y ago
    GPS spoofing? Device can't track on the way up? I'd like to know too.
  - dsharlet 9y ago
    In my experience, GPS doesn't work well when the device is in a pack or even a thick jacket. Also, batteries don't work well in the cold. Combine those two things, it's hard to get continuous GPS tracking in cold environments.
cdevs 9y ago
It would be scary if someone found a flaw in their API or data that exposed who went where from where everyday. It may not be stored that way but people who work at secure locations aren't allowed to bring in cell phones or workout watches but they still bring them to the parking lot showing who works where. If a flaw like this is discovered it would obviously be bad.
- samstave 9y ago
  We need to have a look at Strava data from LV to Area 51
- tgtweak 9y ago
  Would be good to read what steps Strava uses to anonymize this data prior or shortly following upload. I'm also hoping they put some logic to prevent a single device trace from showing up on the heatmap regardless of frequency, and that 2 devices would need to converge within a radius for there to be a trace, but that might be wishful thinking.
- _Wintermute 9y ago
  Strava doesn't track you constantly, you start recording when you start a run or bike ride and stop it when you finish.
StringyBob 9y ago
I wonder if the raw data can show any paths/areas missing from openstreetmap - would be interesting to align the datasets
- netcraft 9y ago
  I was able to find a few places where I knew there were newer roads that were not mapped yet but strava clearly showed.
  - StringyBob 9y ago
    Found it! https://strava.github.io/iD/#background=MAPNIK&map=2.00/0.0/0.0 https://strava.github.io/iD/#background=MAPNIK&map=2.00/0.0/... zoom in a lot to enable the strava heatmap, and you can edit openstreetmap if you know what you are doing.
- bagbagbag 9y ago
  I think that's what their Slide project is aiming for. https://labs.strava.com/slide/ https://labs.strava.com/slide/
  - StringyBob 9y ago
    And it would seem it is integrated into an online viewer/editor at https://strava.github.io/iD/#background=MAPNIK&map=2.00/0.0/0.0 https://strava.github.io/iD/#background=MAPNIK&map=2.00/0.0/...
SeoxyS 9y ago
Wow, I found quite a few very obvious ones in Syria. Are these locations supposed to be entirely secret?
shiado 9y ago
This reminds me of the selfie soldier story from a few years ago. https://www.youtube.com/watch?v=2zssIFN2mso https://www.youtube.com/watch?v=2zssIFN2mso Just how much useful military information can soldiers haemorrhage from their cellphones? Imagine somebody being convicted of war crimes in an international tribunal because some recruit forgot to turn off their automatic geo-locating Candy Crush notifications. This is quite the brave new world we are entering.
- deleted 9y ago
  [deleted]
azernik 9y ago
I've heard about similar issues in a somewhat older context; it took some training work to get 18-21-year-old Israeli draft soldiers to stop creating Facebook groups that reflected their unit structure, or at least to obfuscate the names. And there's been a lot of interesting work done by e.g. bellingcat.com to identify the exact Russian Army units and soldiers operating in Ukraine based on social media pictures taken out of theater. OSINT is a very big field in military intelligence; with the amount of information everyone pumps out about themselves, some leakage of militarily sensitive information is bound to happen. As an organization defending against this type of espionage, you just have to try to minimize the leakage.
- travmatt 9y ago
  I’ve been fascinated by OSINT recently, not least for the amazing journalism bellingcat produces. Their investigations into Russian attack on MH17 and the coup attempt in turkey have both been some of the best journalism I’ve read.
christophilus 9y ago
I'm surprised Svalbard is so lit up[0]. I wouldn't expect too many folks to be running around out there. [0] https://labs.strava.com/heatmap/#5.00/15.91558/77.77306/hot/all https://labs.strava.com/heatmap/#5.00/15.91558/77.77306/hot/...
adamtj 9y ago
Websites are like salespeople and the police: they can and will use your data against you. The first time I was told about Strava, I immediately dismissed it as useless. (After all, what service could they possibly provide when I'm unwilling to tell them precisely where I go to work out?) I almost gave a quizzical look to my conversation partner, but that would have given him more insight into my thoughts than I cared to share, so I surpressed the expression.
YeGoblynQueenne 9y ago
I guess that answers that age-old question in Juvenal: "Quis custodiet ipsos custodes?", typically translated as "who will watch the watchers?".
ziggyd 9y ago
Secret underwater base off the coast of Japan? https://labs.strava.com/heatmap/#11.26/142.44901/38.34858/hot/all https://labs.strava.com/heatmap/#11.26/142.44901/38.34858/ho...
rwhitman 9y ago
The most fascinating spots are located near the equator, in the middle of the ocean, or the desert of North Africa. There are many seemingly "uninhabited" places in these remote equatorial areas that light up with clear tracks or circles, in areas that are obscured by clouds, blurred or look like brown dirt.
sAbakumoff 9y ago
https://labs.strava.com/heatmap/#13.25/-119.22139/40.78444/blue/ride https://labs.strava.com/heatmap/#13.25/-119.22139/40.78444/b... does anyone know what's THIS?
- olemartinorg 9y ago
  Looks like burning man.
mf2hd 9y ago
"What's the big deal? It's just metadata."
billfruit 9y ago
Perhaps it can work both ways, revealingly insurgent activity as well.
fapjacks 9y ago
I have knowledge of a handful of tiny uhh "State Department" facilities that rely on their obscurity for security (a fairly common practice that works in the military for the most part, since fog of war on the ground is a very real thing). Those facilities are visible even from the global view with max zoom.
JohnStudio 9y ago
.. and you.

695 points by domoritz 9y ago

simooooo 9y ago

Very clever

sctb 9y ago
We already asked you to please start posting substantively, so we've banned the account. We're happy to unban accounts if you email us at hn@ycombinator.com and we believe you'll post civilly and substantively in the future. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

chatmasta 9y ago

It’s unbelievable that any military allows its soldiers to deploy carrying consumer technology equipped with GPS tracking.

madez 9y ago
By now we all should have realized that all but a tiny fraction of people is illiterate about computers, the internet and their possibilities and dangers.
- madez 9y ago
  Let me piggyback on my own comment. Because there are only so few people who have factually so much power, I urge every hacker, everybody who understands the digital world, to act in the best faith of everybody. This technological revolution is too important to serve only a few. Luckily, many hackers do the right thing and don't do everything they could to maximize their immediate benefit. I sincerely hope for humanity, for the people of poor countries, for people suffering from corrupted governments, for people who weren't as fortunate as we were, that we provide them with the technology they need. But we must not maintain control over it to have control over them. Free and just software and hardware must prevail.
knolan 9y ago
There are troves of historically important photographs from various wars taken by soldiers with forbidden personal cameras. [0] In some ways this is similar however the immediacy of the data in an active conflict is more troubling. [0] https://www.amazon.com/Lens-Infantryman-Memoir-Photographs-Hidden/dp/0786428678 https://www.amazon.com/Lens-Infantryman-Memoir-Photographs-H...
ribasushi 9y ago
I have a close friend with the US military, who was deployed to Germany in 2017. Their brigade was moving various equipment from base to base. Their only means of communication with superiors was a bog-standard cell phone with a US-number SIM-card. Forget the tracking implications: orders were texted, often via SMS.
- 3pt14159 9y ago
  Yeah people on HN and elsewhere really have this warped view about how secure things are. They don’t understand that militaries and intelligence agencies are run by normal people with normal beauracies and dumb rules and shortsights. Look at the Snowden leaks, these people are not magical space wizards.
  - pferde 9y ago
    No, we understand that. We're just continually surprised that world's largest and most expensive army keeps shooting itself in the foot like this.
    - TeMPOraL 9y ago
      It's a trade-off, I think. I doubt there's much actionable intel for an enemy to be found in logistics orders of a base in Germany.
      - lostlogin 9y ago
        Maybe not now, but in a war there definitely is.
      - mseebach 9y ago
        Use your imagination. Having a scrap of inside knowledge is a great asset for recruitment. You establish yourself as an insider and the target is more likely to spill some beans. “Yeah, getting all those Foo widgets to that secret storage place was a real pain, I know! It was bunker X9, I think.. that’s the worst, am I right?"
JonnyNova 9y ago
The US military is ass-backwards when it comes to dealing with technology. Want to transfer files between computers? Can't use a thumb drive! You need to burn a disk (for real).
- toomanybeersies 9y ago
  That does't sound like terrible infosec. Flash drives are a huge security vulnerability. With more secure workstations you can't plug in any USB peripherals, because they're such big risk. Write only media is a lot safer, despite the waste it causes.
  - rocqua 9y ago
    I'm pretty sure SD cards have a lot less vulnerabilities than USB sticks. Especially because they cannot pretend to be a keyboard.
    - acdha 9y ago
      They can still pretend to have / not have files so it’s hard to say that you’ve verified nothing sensitive is leaving or that no malware is coming in.
    - lawl 9y ago
      There's WiFi enabled SD cards[0]. I had one of those and it was running Linux, you could SSH into it. Maybe the attack-surface to the host computer is smaller (I'm not sure about that either). But there's certainly enough bad stuff an SD card could do. [0] https://hackaday.com/2016/06/30/transcend-wifi-sd-card-is-a-tiny-linux-server/ https://hackaday.com/2016/06/30/transcend-wifi-sd-card-is-a-...
- acdha 9y ago
  If you look deeper into the security issues of USB and it’s less surprising: beyond the risk of basic malware, the devices are usually hackable which makes really hard to be certain about anything. Cutting out whole classes of attack makes sense when you know you have highly-skilled, well-funded adversaries and the budget to simply write off the extra overhead. Remember that their threat model doesn’t end at “my dirty picture collection leaked” but “we lost a war” or “we have to ask Congress for 10e9+ dollars for repairs/replacements”. This got a lot of attention a couple years ago: https://www.blackhat.com/us-14/briefings.html#badusb-on-accessories-that-turn-evil https://www.blackhat.com/us-14/briefings.html#badusb-on-acce... This kind of problem is endemic to small cheap devices, too – for example: https://www.bunniestudios.com/blog/?p=3554 https://www.bunniestudios.com/blog/?p=3554
sailfast 9y ago
I respectfully disagree. For most troops, deploying with your personal device is a huge morale boost. Blocking GPS on these devices is not practical, and might actually help when it comes to innovation in the field (helicopter pilots using iPads to innovate routing, for example) - not to mention just basic morale (movies / music / what have you). These tools also go a long way toward operational readiness / fitness. They incentivize these things and are used for a reason. There are trade-offs with all these things, not to mention the practical issues of blocking them. I would expect, however, that identifying this as a huge security problem is relatively easy. "HEY DO NOT UPLOAD YOUR RUN WHILE DEPLOYED OR YOU MAY GET MORTARED" is likely a better option here, just below "MAKE SURE YOU WEAR YOUR NEON BELT" on every sign.
- lostlogin 9y ago
  > basic morale (movies / music / what have you). Communication with family and friends would be my first thought. Many historical accounts put a lot of emphasise on the mail delivery and what the news from home was. It must be/have been a significant problem dealing with the mail when you had a lot of troops in the field.
  - sailfast 9y ago
    Totally Agree. I was not assuming broadband capability / cell service for my hypothetical (also traditional comms may be limited in remote / classified environments) but that's definitely another reason to have a personal device. Comms with family would be critical if they are possible.
- jonahx 9y ago
  > "HEY DO NOT UPLOAD YOUR RUN WHILE DEPLOYED OR YOU MAY GET MORTARED" is likely a better option here, just below "MAKE SURE YOU WEAR YOUR NEON BELT" on every sign. I take the whole lesson here to be: information can leak in unexpected ways. So solving this particular issue does nothing to help the larger problem. I'd imagine there are countless similar side channel leaks that already exist... and then even more that don't exist yet but will retroactively exist with a future phone or app update. The fox is in henhouse.
einarfd 9y ago
I'm not surprised at all. If you look at GPS watches like Garmin tactix Bravo. It has a feature set, where some of the features, really only makes sense in a military/hunting setting. Although I wonder what kind of animal you are hunting if you start your hunting trip by doing a HALO parachute jump. Garmin is not the only one making those kind of GPS watches either. I believe that Suunto has similar watches as well. Obviously the soldiers should not be uploading their GPS tracks to Strava. But banning your non special forces soldiers from buying the same "civilian" watches that your special forces soldiers use. Sounds like a morale killer.

starpilot 9y ago

Are any of these locations actually secret?

Rebelgecko 9y ago
It's pretty easy to find Al-Udeid Air Base, which was secret until the mid 2000s. Some of the other details like patrols, convoy routes, and missile battery locations may not be classified, but are probably things the US military would rather not see online
- samstave 9y ago
  Given the visibility of HN threads I expect this data to get scrubbed post-haste - so download it / archive it ASAP
markmark 9y ago
All I see are people looking at places they already know about and seeing that people have used Strava there. If these people already know the locations, so does anyone else who matters.
RandomCSGeek 9y ago
Not secret in the sense that the enemies of respective nations already knew them, but secret in the sense that only the militaries knew them, now the whole world does. I think the patrol routes are more important(fun) than locations.
- vobios 9y ago
  But aren't the enemies the only ones that matter?

orliesaurus 9y ago

How did no one working at Strava think about the implications of releasing this data? Zero scrutiny? I am sure there are some very interesting locations on there... reading through the twitter thread it would seem so

snowpanda 9y ago
To be honest I'm more concerned personal devices were allowed at these locations. That and somebody posting it on Twitter instead of disclosing it responsibly to the parties involved. Sure it's not his fault, but he doesn't need to make it worse.
benoliver999 9y ago
They clearly have not thought about how easy it is to de-anonymise this data in areas with few trackers. Classic SV short sightedness.
LeifCarrotson 9y ago
You know what else is public , insecure information? Maps. Pictures. Roads. Physically going to a location and seeing a driveway. Yes, there is a bright line on Strava that leads from a spiderweb of trails in the park right to the door of my private, personal house! My neighbors don't run often, but I post on Strava 5 days a week, so my driveway stands out like a yellow arrow. You could learn, from the Strava dataset, that someone (me) lives in my house. Gasp! /s. Of course someone lives in my house. It is not news to anyone local. My address is on the map, and it's pretty obvious that someone lives here if you drive by and see it. What damage has Strava done by releasing this data? Humans that post on Strava are not hermits, trying to remain secret in their underground hideouts in the middle of nowhere. We live in houses, or on giant military bases...we're not exactly hidden.
- lstroud 9y ago
  I wonder if you can deduce the times of the runs from the data.
  - 9y ago

natch 9y ago

In some cases where the data is sparse, you can find where individual people live, because the trails sometimes lead back to a starting point. Like this person who runs around the park regularly. Of course you could also just follow them IRL if you were there, so I'm not sure this is a big deal. https://labs.strava.com/heatmap/#14.20/100.20693/40.99133/hot/all https://labs.strava.com/heatmap/#14.20/100.20693/40.99133/ho...

dalemyers 9y ago
It means that you can reliably predict where someone is gong to be, and for many people, that's a huge safety concern.
- maxerickson 9y ago
  So one of the reasons they publish the heat map is that it is a great tool for trail and route discovery. Look at an area where you haven't been before and activities pop right out. Many Strava users are using it this way. So the concerns of people that need privacy are being balanced against that. Are the 2 options of either not using the activity tracking app or activitating the privacy setting not sufficient for people with safety concerns regarding their location?
  - givinguflac 9y ago
    Strava could easily make this opt in, or they could filter spots where there are only a few people using it. There are a ton of in between options, this data is not a yes or no scenario.
    - acdha 9y ago
      That seems like the best option: multiple users whose activity patterns aren’t highly similar (i.e. couples who run together) and blur start / end points which aren’t used by many people at different times.
      - 9y ago

natch 9y ago

At Apple Park (AC 2), the spaceship footprint is still invisible as of the date of this data. Next year it should be clearly visible. (Sorry, off topic with respect to the "military base" in title, just having fun browsing the data). https://labs.strava.com/heatmap/#16.00/-122.01101/37.33445/hot/all https://labs.strava.com/heatmap/#16.00/-122.01101/37.33445/h...

fbdjskajxb 9y ago
Interesting, either that shit is locked down tight, or Apple got them to scrub it. The parking lot isn’t empty, though.
- dbcurtis 9y ago
  City of Cupertino just issued the occupancy certificate for the spaceship this week, so I wouldn't expect a lot of joggers yet. No conspiracy, just planning department bureaucracy.
  - fbdjskajxb 9y ago
    Regardless of the occupancy certificate, a pretty large number of humans must have stepped foot there already.
minimaxir 9y ago
Granted, Apple employees may be more prone to use an Apple Watch instead of a Strava.
- nlh 9y ago
  Strava has an Apple Watch app (source: I use it regularly).

natch 9y ago

Taos Ski Area: https://labs.strava.com/heatmap/#14.28/-105.45449/36.58046/hot/all https://labs.strava.com/heatmap/#14.28/-105.45449/36.58046/h... Heavy straight lines are lifts.

pella 9y ago

for finding other places: see OpenStreetMap key:military: https://wiki.openstreetmap.org/wiki/Key:military https://wiki.openstreetmap.org/wiki/Key:military https://taginfo.openstreetmap.org/keys/military#values https://taginfo.openstreetmap.org/keys/military#values

hex12648430 9y ago

Some other fun (but not so secret) things to look at: research stations in Antarctica, tourism in North Korea (as well as some officials traveling it seems; some tracks cross the DMZ), your own garden if you have one. There's even a track at the Area 51.

jzwinck 9y ago
Moving between North and South Korea is restricted but not completely eliminated. There are people who legiimately work in one and live in the other (not just officials).
- samstave 9y ago
  What kinds of jobs do those people hold?
  - azernik 9y ago
    If they're including old data, up to two years ago there were quite a few South Korean managers and engineers working at the Kaesong Industrial Zone (https://en.wikipedia.org/wiki/Kaesong_Industrial_Region https://en.wikipedia.org/wiki/Kaesong_Industrial_Region)
jpindar 9y ago
Here's an analysis of the data from North Korea: https://www.northkoreatech.org/2018/01/29/strava-heat-map-north-korea/ https://www.northkoreatech.org/2018/01/29/strava-heat-map-no...

emilfihlman 9y ago

Anyone know how to download (a portion) of the dataset?

exikyut 9y ago
HERE IS HOW TO DOWNLOAD IT I just spent a few minutes figuring it out. First grab some coordinates, I picked a totally random spot in NY: https://labs.strava.com/heatmap/#16.11/-73.96162/40.73006/hot/all https://labs.strava.com/heatmap/#16.11/-73.96162/40.73006/ho... Now feed the GPS coords into the algorithm at https://wiki.openstreetmap.org/wiki/Slippy_map_tilenames https://wiki.openstreetmap.org/wiki/Slippy_map_tilenames I can use PHP faster than anything else, so I used the PHP example on that page. $zoom = 15; $lon = -73.96162; $lat = 40.73006; $xtile = floor((($lon + 180) / 360) * pow(2, $zoom)); $ytile = floor((1 - log(tan(deg2rad($lat)) + 1 / cos(deg2rad($lat))) / pi()) /2 * pow(2, $zoom)); print "x: $xtile\n"; print "y: $ytile\n"; This printed: x: 9651 y: 12318 If I go to https://heatmap-external-c.strava.com/tiles/all/hot/15/9651/12318 https://heatmap-external-c.strava.com/tiles/all/hot/15/9651/..., I can see a portion of the map that's on the screen. My email is in my profile, downloading this would be very fun. It would just need a tonne of bandwidth and even more diskspace, and I don't have much of either myself.
- maxerickson 9y ago
  I think they mean the underlying data rather than the tiles. MOBAC is made for caching map tiles: http://mobac.sourceforge.net/ http://mobac.sourceforge.net/
  - emilfihlman 9y ago
    I mean the tiles because the actual dataset is not publicly available and I doubt it will ever be. One reverse a portion of the dataset from the tiles, though.
    - maxerickson 9y ago
      You could check the OSM gps layer to see if it has interesting data in the area; you can directly fetch the data there. https://www.openstreetmap.org/#map=18/38.03114/-78.52475&layers=G https://www.openstreetmap.org/#map=18/38.03114/-78.52475&lay... There's less traces than Strava has though.

lfcipriani 9y ago

Strava allow you to configure privacy zones and range around them. I believe/hope this map doesn't include them.

hex12648430 9y ago
These zones are excluded according to their blog post. https://medium.com/strava-engineering/the-global-heatmap-now-6x-hotter-23fc01d301de https://medium.com/strava-engineering/the-global-heatmap-now...
- aluhut 9y ago
  They are. A few years ago I had the app installed for one trip. The track on my property is not visible on the heat map.
taneq 9y ago
Aggregate data about private zones would give the company these some interesting data, especially combined with other customer data. Knowing which people don't want you tracking their location, and where, and how these zones line up between different groups of people, would give you a lot of information about what areas each group considers sensitive. (e.g. Say you could cross-reference some of your customers with military ranks, and a bunch of people above rank X had a certain area blocked out. You could then infer that (a) there's something there that only people with that level of clearance would know about, and (b) then infer that anyone else who blocked it out had at least that level of clearance.)
- deleted 9y ago
  [deleted]

tviling 9y ago

No activities in Area 51

arca_vorago 9y ago

Yet people think I'm paranoid for not wanting whatever the latest health tracking gadget is. I would love to have an FOSS fitbit equivalent that doesn't share my information with anyone but me, preferably a manual download or a manual bluetooth switch (so it can be off when out and about). It's like these companies valuations aren't off the product, but more off how much data they are getting off consumers. I bet they are selling this to advertisers.

rorykoehler 9y ago
I'd imagine they are mainly selling to governments and town planners.
- zimpenfish 9y ago
  No need to imagine; they're quite up front about it. https://metro.strava.com/ https://metro.strava.com/ > Metro anonymizes and aggregates this data and then partners with departments of transportation and city planning groups to improve infrastructure for bicyclists and pedestrians.

aluhut 9y ago

I wish there would be some easy to do service where you can set up a "strava like" service on your webspace. I know people who use Strava or similar and are somehow aware of their privacy but "it's so easy and it works"....

oceanic 9y ago
Well, there is OwnTracks, it’s self hosted and has mobile apps… http://owntracks.org http://owntracks.org
- aluhut 9y ago
  Doesn't look "easy" in the common sense but thanks, I might even have a free Pi somewhere. I'll give it a try.

throaj19s9a 9y ago

You can find out certain routes Pine Gap(NSA spy base) employees take. You can even pinpoint which buildings in their spy base have higher security clearances. You can even see them patroling and exploring their land, and someone randomly running in a circle.

YTGRK 9y ago

https://youtu.be/I2l8xkjTUh4 https://youtu.be/I2l8xkjTUh4

drtillberg 9y ago

Is there an explanation somewhere of how Strava got this fitness data and why they published it?

nebulous1 9y ago
Did you think to look up what Strava do?

mixologic 9y ago

Burning Man looks pretty cool: able to see year over year changes to the perimeter map: https://labs.strava.com/heatmap/#14.33/-119.21108/40.78291/hot/all https://labs.strava.com/heatmap/#14.33/-119.21108/40.78291/h...

myth_buster 9y ago
Lovely! That's going up as a poster on my wall.
- jonalmeida 9y ago
  If you come up with a nice high res screen grab for your print, could you please share it here? Might want to use it for a wallpaper background.
  - ce4 9y ago
    Here's one, alas there's no higher res tiles than z15. https://drive.google.com/file/d/1M3x_IO0jpKd6qMfHO7cfjv0H2nvErV2w/view?usp=sharing https://drive.google.com/file/d/1M3x_IO0jpKd6qMfHO7cfjv0H2nv...

MrBuddyCasino 9y ago

I don‘t get why people loose their shit about something that every LEO spy satellite can see since 30 years. Its just a plain old Twitter outrage.

caio1982 9y ago
Where's the outrage?
froindt 9y ago
As others have noted, this goes beyond just "there's something here". For military bases, you can sometimes get a good idea of the patrol routes. For sparsely populated areas, you can get a good idea of what routes a particular home owner exercises on.

iser 9y ago

https://twitter.com/kevinkiklee/status/957629856518459392 https://twitter.com/kevinkiklee/status/957629856518459392 I just created an overlay of Google Maps and Strava Heatmap of the forward operating base I was at in Afghanistan. The heatmap clearly shows the layout of the base. That base has been in operation for at least 6-8 years, and it is well-developed. The up-to-date satellite imagery of the area is not available on Google Maps for a good reason, and Strava just released it. I imagine that this heatmap has been thoroughly scraped already. * I was deployed to Afghanistan from 2011-2012. edit: initially mis-typed '2011-2102' =D edit2: A well-established military base, even in a combat zone, has access to wifi and cellphone network. We are constantly training physically, and we like to keep track of ourselves. We were early adopters of fitness trackers, and I used a couple of them myself also.

givinguflac 9y ago
That’s one hell of a deployment duration! :)
- iser 9y ago
  =D
maxerickson 9y ago
So what other internet services have deployed soldiers sent sensitive location data to? Does each internet service need to proactively hire someone with clearance and coordinate hiding of sensitive information with the US military?
- iser 9y ago
  We were on a separate network from the secured military network, but we had complete and free access to the internet when I was there 6 years ago. Even in the most remote combat operating posts, we had access to wifi. Not sure if this can be solved from the civilian side. There is just too much information being transmitted out of a combat zone, and I think it has to be controlled from the source. Certain sites need to be just blocked in combat zones. Rather, we need to only have a list of allowed sites. I know how much it sucks in a combat zone, and I know how much that internet connection makes someone feel like they are still part of the civilization. However, some data just should not be transmitted out of it, and it needs to be heavily controlled.

sathackr 9y ago

Just about any satellite photo provider can be used to locate military bases also. The heatmap is neat but I don't see why it's specifically bad for military bases.

xrisk 9y ago
Patrol and supply route information I guess?
- samstave 9y ago
  I can honestly see this as a DND scenario: “I roll to see what I can find out about their supply routes” 20 “Ok, you can see from their strava heat maps their supply routes go north to south along this particular road” “When do they happen” “Roll for perception” 20 (Fuck this guy) “Ok, you see that they result every Thursday at noon” “That’s when we’ll attack!”
- vobios 9y ago
  Do you think the locals don't already have that info? The soldiers are not invisible.
samstave 9y ago
Honest questions: Who are the “any satellite photo providers”? How many are there? How do I find them?
- sathackr 9y ago
  I'm not sure if you're being pedantic in that most 'satellite' photos are actually aerial or not. The more obvious sources would be Bing Maps and Google Maps/Google Earth, and they likely aggregate multiple sources. I know I've seen Digital Globe[2], USGS[4], and Pictometry[5] cited as sources. A quick Google search[1] brings up Digital Globe[2] and a list[3] as the first two non-sponsored results. [1] https://www.google.com/search?q=Satellite+photo+providers https://www.google.com/search?q=Satellite+photo+providers [2] https://www.digitalglobe.com https://www.digitalglobe.com [3] http://gisgeography.com/free-satellite-imagery-data-list/ http://gisgeography.com/free-satellite-imagery-data-list/ [4] http://earthexplorer.usgs.gov/ http://earthexplorer.usgs.gov/ [5] https://www.eagleview.com/product/pictometry-imagery/ https://www.eagleview.com/product/pictometry-imagery/

tree_of_item 9y ago

I guess I'm slow, why are these pictures obviously of military bases? What's going on here?

iser 9y ago
A well-established military base, even in a combat zone, has access to wifi and cellphone network. We are constantly training physically, and we like to keep track of ourselves. We were one of the first adopters of fitness trackers, and I used a couple of them myself also.

RandomCSGeek 9y ago

Just started, and already found a patrol route of Pakistan army, although it was quite obvious one, going parallel to a border river. Hope they don't take this down, it's going to entertain me for many days to come. On a more serious note though, this is an good example of how important it is to control our own data. It only makes me take even more efforts to secure my data and to try to make less of it available to others. We really need to convert Internet to what it was meant to be, a "decentralised system"

kakarot 9y ago
I don't think a heat map of your surrounding environment counts as "your data". Virtually every government seems to feel the same way, and in a rare moment I find myself in agreeance, even if this perspective currently manifests itself mostly in drug-related stings
- RandomCSGeek 9y ago
  Not the heat map of surroundings, but the map of routes taken by people, especially when it's not anonymised due to getting overlapped by other data, can surely be considered as personal data. Like in this case, it's with soldiers patrolling remote areas. I guess the devs who made this heatmap forgot that one should remove data when there is not enough info to anonymise it by virtue of aggregation.(overlapping of multiple paths in this case). What I was suggesting is that people should care about who gets to see the data they generate and try to minimise the count. btw I didn't understand what you meant in the second sentence.
  - fjsolwmv 9y ago
    Parent was confusing a data "heat" map plot with sensors that detect actual infrared heat emitted by grow ops.
    - kakarot 9y ago
      I sure was. Misinterpreted my parent comment. My apologies!

maelito 9y ago

People don't run in the Père Lachaise cimetery in Paris, interesting !

kebman 9y ago

I found several border crossings between Russia, Finland and Norway that doesn't seem entirely legal. ;)

jpindar 9y ago
Same with North Korea.
- IncRnd 9y ago
  For people's safety, you might want to delete that comment.
  - deleted 9y ago
    [deleted]
- iaw 9y ago
  I found both activity at Pyongyang and what appears to be a smuggling route from China into NK.
  - dionidium 9y ago
    You think people are turning on Strava to track their smuggling activity?
    - Whitestrake 9y ago
      I would have assumed that people wouldn't turn on their Strava to track their military activity, either, but here we are.
      - dionidium 9y ago
        They don't. There seems to be some confusion about how Strava works in this thread. People turn it on to track physical activity (i.e. exercise). Nobody is tracking their "military activity." They're turning Strava on when they go for a jog around the base. And then they stop it when their run is finished. If enough people on the base do this, then common routes will stand out on the aggregate map. Nobody on a smuggling operation would have Strava turned on. That makes no sense.

brohoolio 9y ago

The most interesting thing I stumbled across so far is Detroit, where people don't run in huge swaths of the neighborhoods. I'm familiar with the city so I expected dead zones, but nothing like this. https://labs.strava.com/heatmap/#9.47/-83.46871/42.45553/hot/run https://labs.strava.com/heatmap/#9.47/-83.46871/42.45553/hot...

Strom 9y ago
> where people don't run More accurately it's where people don't send their tracking data. Plausible to also say that it's where people don't own this tracking software/device at all. However it seems like a gigantic stretch to derive that there's no running going on.
- deleted 9y ago
  [deleted]
- frakkingcylons 9y ago
  That's true. Nevertheless, it's interesting (though unsurprising), to see the areas where Strava users don't run.
  - Balgair 9y ago
    https://statisticalatlas.com/place/Michigan/Detroit/Race-and-Ethnicity https://statisticalatlas.com/place/Michigan/Detroit/Race-and... Maps ok-ish to the African American population distribution
llimllib 9y ago
In the US, it's almost entirely rich, white people that upload data to strava. You can easily see racial/economic divisions in any major united states city. Baltimore is a great example[1]; white people live in the center but not on the east or west sides (Canton excepted). [1]: https://i.imgur.com/RXSfgz1.jpg https://i.imgur.com/RXSfgz1.jpg
- 9y ago

sflicht 9y ago

surprisingly nonzero adoption of fitness trackers in Pyongyang

ithinkso 9y ago

Everest Base Camp is clearly visible - together with full south col route and a lot of teleports to the summit https://labs.strava.com/heatmap/#14.32/86.87956/27.98295/hot/all https://labs.strava.com/heatmap/#14.32/86.87956/27.98295/hot... https://www.google.pl/maps/@27.9786991,86.8796431,8552m/data=!3m1!1e3 https://www.google.pl/maps/@27.9786991,86.8796431,8552m/data...

gruez 9y ago
>and a lot of teleports to the summit can anyone explain what happened here?
- diggernet 9y ago
  Phone off because it's not useful while climbing, but then gotta whip it out for that selfie at the top?
- Bedon292 9y ago
  I imagine it has something to do with sparse tracking. The final ascent / decent is I think the better part of an entire day. You can't have full high accuracy GPS on for that long and have the battery last. So you may put the device away for a while, and get it back out when you finally summit to track that you were there. And lower on the mountain you might have extra ridges in the way, like in a city with lots of tall buildings, where you just can't get the best signal. And on Everest there is no WiFi or cell signal to cheat with. I would also think that personal device GPS may get a bit confused at that altitude. That is not really the expected working conditions.
- hbosch 9y ago
  GPS spoofing? Device can't track on the way up? I'd like to know too.
- dsharlet 9y ago
  In my experience, GPS doesn't work well when the device is in a pack or even a thick jacket. Also, batteries don't work well in the cold. Combine those two things, it's hard to get continuous GPS tracking in cold environments.

cdevs 9y ago

It would be scary if someone found a flaw in their API or data that exposed who went where from where everyday. It may not be stored that way but people who work at secure locations aren't allowed to bring in cell phones or workout watches but they still bring them to the parking lot showing who works where. If a flaw like this is discovered it would obviously be bad.

samstave 9y ago
We need to have a look at Strava data from LV to Area 51
tgtweak 9y ago
Would be good to read what steps Strava uses to anonymize this data prior or shortly following upload. I'm also hoping they put some logic to prevent a single device trace from showing up on the heatmap regardless of frequency, and that 2 devices would need to converge within a radius for there to be a trace, but that might be wishful thinking.
_Wintermute 9y ago
Strava doesn't track you constantly, you start recording when you start a run or bike ride and stop it when you finish.

StringyBob 9y ago

I wonder if the raw data can show any paths/areas missing from openstreetmap - would be interesting to align the datasets

netcraft 9y ago
I was able to find a few places where I knew there were newer roads that were not mapped yet but strava clearly showed.
- StringyBob 9y ago
  Found it! https://strava.github.io/iD/#background=MAPNIK&map=2.00/0.0/0.0 https://strava.github.io/iD/#background=MAPNIK&map=2.00/0.0/... zoom in a lot to enable the strava heatmap, and you can edit openstreetmap if you know what you are doing.
bagbagbag 9y ago
I think that's what their Slide project is aiming for. https://labs.strava.com/slide/ https://labs.strava.com/slide/
- StringyBob 9y ago
  And it would seem it is integrated into an online viewer/editor at https://strava.github.io/iD/#background=MAPNIK&map=2.00/0.0/0.0 https://strava.github.io/iD/#background=MAPNIK&map=2.00/0.0/...

SeoxyS 9y ago

Wow, I found quite a few very obvious ones in Syria. Are these locations supposed to be entirely secret?

shiado 9y ago

This reminds me of the selfie soldier story from a few years ago. https://www.youtube.com/watch?v=2zssIFN2mso https://www.youtube.com/watch?v=2zssIFN2mso Just how much useful military information can soldiers haemorrhage from their cellphones? Imagine somebody being convicted of war crimes in an international tribunal because some recruit forgot to turn off their automatic geo-locating Candy Crush notifications. This is quite the brave new world we are entering.

deleted 9y ago
[deleted]

azernik 9y ago

I've heard about similar issues in a somewhat older context; it took some training work to get 18-21-year-old Israeli draft soldiers to stop creating Facebook groups that reflected their unit structure, or at least to obfuscate the names. And there's been a lot of interesting work done by e.g. bellingcat.com to identify the exact Russian Army units and soldiers operating in Ukraine based on social media pictures taken out of theater. OSINT is a very big field in military intelligence; with the amount of information everyone pumps out about themselves, some leakage of militarily sensitive information is bound to happen. As an organization defending against this type of espionage, you just have to try to minimize the leakage.

travmatt 9y ago
I’ve been fascinated by OSINT recently, not least for the amazing journalism bellingcat produces. Their investigations into Russian attack on MH17 and the coup attempt in turkey have both been some of the best journalism I’ve read.

christophilus 9y ago

I'm surprised Svalbard is so lit up[0]. I wouldn't expect too many folks to be running around out there. [0] https://labs.strava.com/heatmap/#5.00/15.91558/77.77306/hot/all https://labs.strava.com/heatmap/#5.00/15.91558/77.77306/hot/...

adamtj 9y ago

Websites are like salespeople and the police: they can and will use your data against you. The first time I was told about Strava, I immediately dismissed it as useless. (After all, what service could they possibly provide when I'm unwilling to tell them precisely where I go to work out?) I almost gave a quizzical look to my conversation partner, but that would have given him more insight into my thoughts than I cared to share, so I surpressed the expression.

YeGoblynQueenne 9y ago

I guess that answers that age-old question in Juvenal: "Quis custodiet ipsos custodes?", typically translated as "who will watch the watchers?".

ziggyd 9y ago

Secret underwater base off the coast of Japan? https://labs.strava.com/heatmap/#11.26/142.44901/38.34858/hot/all https://labs.strava.com/heatmap/#11.26/142.44901/38.34858/ho...

rwhitman 9y ago

The most fascinating spots are located near the equator, in the middle of the ocean, or the desert of North Africa. There are many seemingly "uninhabited" places in these remote equatorial areas that light up with clear tracks or circles, in areas that are obscured by clouds, blurred or look like brown dirt.

sAbakumoff 9y ago

https://labs.strava.com/heatmap/#13.25/-119.22139/40.78444/blue/ride https://labs.strava.com/heatmap/#13.25/-119.22139/40.78444/b... does anyone know what's THIS?

olemartinorg 9y ago
Looks like burning man.

mf2hd 9y ago

"What's the big deal? It's just metadata."

billfruit 9y ago

Perhaps it can work both ways, revealingly insurgent activity as well.

fapjacks 9y ago

I have knowledge of a handful of tiny uhh "State Department" facilities that rely on their obscurity for security (a fairly common practice that works in the military for the most part, since fog of war on the ground is a very real thing). Those facilities are visible even from the global view with max zoom.

JohnStudio 9y ago

.. and you.