6 ms·

Earlier this week when this broke I thought it was merely a curious funny coincidence. I was later walking the dogs with my wife when she told me her mother wa

by tjr225 9y ago

Earlier this week when this broke I thought it was merely a curious funny coincidence. I was later walking the dogs with my wife when she told me her mother was shocked that Strava was giving away the location of military bases. This was when I first became aware of Strava as a controversy. So crazy how uninformed a populace can be. How is it Stravas fault that people use their software? If I logged onto Facebook and posted th location of a secret military base would it be Facebooks fault that I posted it? Anyway, I have been an almost daily user of Strava for years- it's the best at what it does.

21 9y ago
> Strava was giving away the location of military bases I'm not sure how to evaluate the risk here. I'm sure the location of these bases are already known by other governments through various other means. But maybe they can gather some insight into the level of activity at a base, particularly if they monitor strava data over time. OTOH, this info might be interesting to low-level adversaries (terrorists, ...) to find "weaker bases" which might be easier to attack. Anybody informed can comment on the actual risks?
- TallGuyShort 9y ago
  I don't think the danger is in the presence or even size of the base, because as you say other governments are probably already aware of most of them, and you can get a sense of the activity level through simple direct surveillance anyway. The big threat I see here is the names. Want to infiltrate a base? Get the name of someone who has access to the areas you want, find them on Facebook, get pictures of their family and children, learn about their habits, and <creativity>use that information</creativity> and now you've infiltrated the base.
  - dogma1138 9y ago
    You’ll be surprised by how many bases are unknown, or that their current status is unknown as the activity level changes all the time and most armies have “temporary” and permanent bases and unless were talking about FOBs in a war zone the temporary part refers more to when and how well they are manned rather than the temporary nature of the base infrastructure. Units shift bases all the time for various reason from simple rotation to specific operational needs. This is a huge leak since it provides you a source for both collaborating intelligence you already have and gaining new intelligence. Names of individual people might not be nearly as important especially for other nation states but through this data not only that the location is revealed but also the level of activity and through the personal information what is more valuable as far as intelligence goes who is deployed and here we aren’t talking about individuals but rather units. This is huge, the level of activity in the base increases? Likely an influx of personnel which means that you’ve shifted your operational envelope to this area. 2 new support units and a SAR airwing we’re deployed to a base? Looks like some special operation is cooking. Looks like a lot of army nerds are being deployed to this base might be setting up a SIGINT operation.... Heck the activity level alone is invaluable since it provide you with a signal which allows you to direct other sources of intelligence collection to a base that might otherwise would not have been noticed. I can tell you that during specific operations when we would work out of hours or there would’ve be an increase in personnel an order would go out that would prohibit people from parking their car overnight and other controls would be set in place so no unusual activity that can be easily remotely picked up would be noticed. On a non state actor level this as things like on the level of AQAP for example then the routines that can be gathered from the activity are more important, you know when people get up when they run and hitting a large group of soldiers on their morning run might be a juicy target.
- gaius 9y ago
  Attempted kidnapping of a serviceman out for a run in 2016 (not Strava related): http://www.telegraph.co.uk/news/2016/07/21/raf-personnel-on-alert-after-knifepoint-kidnap-attempt-near-base/ http://www.telegraph.co.uk/news/2016/07/21/raf-personnel-on-... Fortunately as a member of the elite RAF Regiment he was able to escape. That’s what they learn on the Five Miles Of Death.
mattmanser 9y ago
How are you so comfortable that the idea that information should just be shared willy-nilly? That no human has to step in and check and maybe sometimes go, hmm, that's actually not a good idea to do that. Computers are super-stupid, literal automatons being allowed to do whatever because Silicon Valley makes more money if it doesn't have to curate anything. Normal humans expect computers to be a bit like humans. Have some common sense. Not have a god view. Forget stuff that happened 5 years ago, or at least be pretty hazy about it. Definitely not remember stuff from 20 years ago. Not, and this is totally crazy I know, record every voice search you've ever done in some creepy vault somewhere where it's used to sell you shit. Not be able to track you every movement from the time you leave your work, to when you go sleep with your bit-on-the-side, to where you go buy your drugs, to when you go back to your boyfriend. We know they're not. Normal people don't, or at least haven't really thought the consequences through. I find your view more disturbing and odd than your in-law's.
- jlg23 9y ago
  > How are you so comfortable that the idea that information should just be shared willy-nilly? It actually is a feature. The problem is that not every feature is for everyone. When you are working in a security sensitive environment (or just like to have your privacy), you should be aware of risks and act accordingly. > Normal humans expect computers to be a bit like humans. This is about product design, not computer or software architecture. The one lesson "normal humans" (whatever that means to you) should learn is that every bit of data can help to identify them.
  - killjoywashere 9y ago
    > When you are working in a security sensitive environment Transferring this burden to the individual could very well lead, quickly, to no one wanting to take sensitive positions. Which would be a societal catastrophe of epic proportions.
    - jlg23 9y ago
      I'll agree the moment we don't let the same people walk around with loaded guns.
NelsonMinar 9y ago
Zeynep Tufekci has an interesting take on this in the NYTimes: https://www.nytimes.com/2018/01/30/opinion/strava-privacy.html https://www.nytimes.com/2018/01/30/opinion/strava-privacy.ht... A key part of her argument is normal people can't be expected to understand what the privacy risk is of running something like Strava. Particularly if the risk isn't so much to individual privacy but rather in aggregate.
- lukasb 9y ago
  While the general point is true, she actually publicly changed her mind about Strava in particular (which is amazing, all respect to her, no one does this in heated public debate.) https://twitter.com/zeynep/status/958702722232012801 https://twitter.com/zeynep/status/958702722232012801
  - abalone 9y ago
    She did not change her mind about the need for informed consent.

by tjr225 9y ago

21 9y ago

> Strava was giving away the location of military bases I'm not sure how to evaluate the risk here. I'm sure the location of these bases are already known by other governments through various other means. But maybe they can gather some insight into the level of activity at a base, particularly if they monitor strava data over time. OTOH, this info might be interesting to low-level adversaries (terrorists, ...) to find "weaker bases" which might be easier to attack. Anybody informed can comment on the actual risks?

TallGuyShort 9y ago
I don't think the danger is in the presence or even size of the base, because as you say other governments are probably already aware of most of them, and you can get a sense of the activity level through simple direct surveillance anyway. The big threat I see here is the names. Want to infiltrate a base? Get the name of someone who has access to the areas you want, find them on Facebook, get pictures of their family and children, learn about their habits, and <creativity>use that information</creativity> and now you've infiltrated the base.
- dogma1138 9y ago
  You’ll be surprised by how many bases are unknown, or that their current status is unknown as the activity level changes all the time and most armies have “temporary” and permanent bases and unless were talking about FOBs in a war zone the temporary part refers more to when and how well they are manned rather than the temporary nature of the base infrastructure. Units shift bases all the time for various reason from simple rotation to specific operational needs. This is a huge leak since it provides you a source for both collaborating intelligence you already have and gaining new intelligence. Names of individual people might not be nearly as important especially for other nation states but through this data not only that the location is revealed but also the level of activity and through the personal information what is more valuable as far as intelligence goes who is deployed and here we aren’t talking about individuals but rather units. This is huge, the level of activity in the base increases? Likely an influx of personnel which means that you’ve shifted your operational envelope to this area. 2 new support units and a SAR airwing we’re deployed to a base? Looks like some special operation is cooking. Looks like a lot of army nerds are being deployed to this base might be setting up a SIGINT operation.... Heck the activity level alone is invaluable since it provide you with a signal which allows you to direct other sources of intelligence collection to a base that might otherwise would not have been noticed. I can tell you that during specific operations when we would work out of hours or there would’ve be an increase in personnel an order would go out that would prohibit people from parking their car overnight and other controls would be set in place so no unusual activity that can be easily remotely picked up would be noticed. On a non state actor level this as things like on the level of AQAP for example then the routines that can be gathered from the activity are more important, you know when people get up when they run and hitting a large group of soldiers on their morning run might be a juicy target.
gaius 9y ago
Attempted kidnapping of a serviceman out for a run in 2016 (not Strava related): http://www.telegraph.co.uk/news/2016/07/21/raf-personnel-on-alert-after-knifepoint-kidnap-attempt-near-base/ http://www.telegraph.co.uk/news/2016/07/21/raf-personnel-on-... Fortunately as a member of the elite RAF Regiment he was able to escape. That’s what they learn on the Five Miles Of Death.

mattmanser 9y ago

How are you so comfortable that the idea that information should just be shared willy-nilly? That no human has to step in and check and maybe sometimes go, hmm, that's actually not a good idea to do that. Computers are super-stupid, literal automatons being allowed to do whatever because Silicon Valley makes more money if it doesn't have to curate anything. Normal humans expect computers to be a bit like humans. Have some common sense. Not have a god view. Forget stuff that happened 5 years ago, or at least be pretty hazy about it. Definitely not remember stuff from 20 years ago. Not, and this is totally crazy I know, record every voice search you've ever done in some creepy vault somewhere where it's used to sell you shit. Not be able to track you every movement from the time you leave your work, to when you go sleep with your bit-on-the-side, to where you go buy your drugs, to when you go back to your boyfriend. We know they're not. Normal people don't, or at least haven't really thought the consequences through. I find your view more disturbing and odd than your in-law's.

jlg23 9y ago
> How are you so comfortable that the idea that information should just be shared willy-nilly? It actually is a feature. The problem is that not every feature is for everyone. When you are working in a security sensitive environment (or just like to have your privacy), you should be aware of risks and act accordingly. > Normal humans expect computers to be a bit like humans. This is about product design, not computer or software architecture. The one lesson "normal humans" (whatever that means to you) should learn is that every bit of data can help to identify them.
- killjoywashere 9y ago
  > When you are working in a security sensitive environment Transferring this burden to the individual could very well lead, quickly, to no one wanting to take sensitive positions. Which would be a societal catastrophe of epic proportions.
  - jlg23 9y ago
    I'll agree the moment we don't let the same people walk around with loaded guns.

NelsonMinar 9y ago

Zeynep Tufekci has an interesting take on this in the NYTimes: https://www.nytimes.com/2018/01/30/opinion/strava-privacy.html https://www.nytimes.com/2018/01/30/opinion/strava-privacy.ht... A key part of her argument is normal people can't be expected to understand what the privacy risk is of running something like Strava. Particularly if the risk isn't so much to individual privacy but rather in aggregate.

lukasb 9y ago
While the general point is true, she actually publicly changed her mind about Strava in particular (which is amazing, all respect to her, no one does this in heated public debate.) https://twitter.com/zeynep/status/958702722232012801 https://twitter.com/zeynep/status/958702722232012801
- abalone 9y ago
  She did not change her mind about the need for informed consent.