An in-depth investigation by a French newspaper has raised the alarm about potential security breaches and world leaders being put in danger... because their bodyguards use Strava and upload public activities to the workout-sharing platform.
Le Monde discovered the location and movements of US President Joe Biden, presidential candidates Donald Trump and Kamala Harris, French President Emmanuel Macron, Russian President Vladimir Putin, as well as Melania Trump and Jill Biden could be traced simply by following the activities uploaded to Strava by their bodyguards and security staff.
Macron's office and the US Secret Service yesterday downplayed the investigation's significance, but the French newspaper said it had found 26 US agents, 12 French GSPR (Groupe de sécurité de la présidence de la République) and six members of Russia's FSO (Federal Protection Service), all who had public Strava profiles and were uploading activities around their security work.
> Even if it's on Strava, it might not have happened — some cyclists are paying 'mules' to ride activities for them
The newspaper said one agent had enabled them to trace Macron's weekend at a Normandy seaside resort, a private trip that was not listed on his official agenda. A US Secret Service agent also uploaded an activity that showed the location of a hotel where Biden later stayed during important talks with Chinese President Xi Jinping last year. A run starting at the hotel and uploaded to the app by the bodyguard's public account was uploaded just hours before Biden's arrival.
In a statement, the US Secret Service said affected personnel have been "notified" and the investigation's information would be reviewed to "determine if any additional training or guidance is required".
Staff are not allowed to use personal electronic devices while on duty, but "we do not prohibit an employee's personal use of social media off-duty", the service added.
Taking a similar line to Macron's office, the US Secret Service also downplayed the risk that such Strava uploads may have caused, pointing out that locations "are regularly disclosed as part of public schedule releases" and "we do not assess that there were any impacts to protective operations or threats to any protectees".
> Strava no longer allows you to add links to uploads and deletes all old ones: frustrated users hit out at social fitness giant that claims "ongoing situation" of URL removal "necessary to protect the community"
The French President's office has now asked agents not to use Strava, even if "the risk is non-existent" as local authorities are aware of Macron's visits in sufficient time to secure locations. His office suggested the issues in the investigation are "very slight and in no way affect the security of the President of the Republic".
The Trump and Harris campaigns did not respond to Le Monde's investigation.
In 2021, it was reported that Biden may not be allowed to take his Peloton exercise bike into the White House due to security fears.
A director of a data analytics programme and professor at the University of Texas suggested unless the camera, microphone and networking equipment are removed it cannot be secure although, he added, then "you basically have a boring bike".
It was also reported that Michelle Obama has a modified Peloton, without a camera or microphone.
Add new comment
9 comments
I know he's not going to accept the result if he loses, but could we still refrain from suggesting Trump is a 'world leader' until after the election?
Apparently for many he still is...
The Russians seem to like him
He's a world leader at devisiveness, disinformation, dysfunction, denial and a lot of other words beginning with d and other letters. So let's give credit where it's due.
After the 'secret bases' Strava incident of a few years ago you'd have thought they'd have been aware of this.
Or maybe they are and just don't think it's a problem.
If I were in charge of security for a world leader, I wouldn't be so disturbed about the fact that agents were giving away the location of the leader's hotel etc, which the press and many others must know 99.9% of the time anyway, as I would be at the fact that apparently it's simple for the press to obtain the names of the Secret Service agents responsible for protecting them. Doesn't that open them up to blackmail and coercion, e.g. kidnapping family members to make them do what some malefactor wishes? Perhaps naïvely I always assumed that quite a large part of the Secret Service's job was to keep the names of those who work for them secret, the clue is kind of in the name isn't it?
The issue here is that security details might visit locations well in advance of annoucement to press, to assess them for security. The impending visit and location of stay is meant to stay secret as long as possible to reduce window for others to plant anything.
On your other point, it seems Strava itself could be a means to identify members of the security detail. You just look at Strava whereever $HEAD_OF_STATE goes and eventually you notice people on Strava who are very often at the same place. Hey presto, you have identified a good candidate for one of his entourage, if not a security agent.
I'm not sure this is as easy as you make it sound. AFAIK there's no way to search or browse activities from all users by location/date. Best bets would be to look at specific segments (which relies on identifying the exact segments the person is likely to have used), or creating a dummy activity and using the "flyby" feature (assuming the person has flybys turned on, and you are sufficiently rigorous with your dummy activity to be likely to encounter them). Either approach seems pretty fallible and resource intensive.
Don't tell everyone then !