The Strava problem: how the fitness app was used to locate the world’s most powerful people

Name: Strava

Age: Founded by former Harvard rowers Michael Horvath and Mark Gainey in 2009.

And it is what, exactly? A fitness app.

How does it work? It uses GPS data to track your activities and is popular among cyclists and runners, who record their activity and then share it with a community. Also useful to the Jackal …

As in ‘The Day of … ’? How so? An investigation by French newspaper Le Monde has used it to track the movements of Joe Biden, Donald Trump, Kamala Harris and other world leaders.

Trump doesn’t look like your typical Strava user … Well, not them specifically, but their bodyguards. Le Monde discovered that some US Secret Service agents use the app, even since the assassination attempts on Trump. They have also tracked movements of Jill Biden and Melania Trump using their bodyguards’ Strava profiles.

Presumably they’ll have noticed Melania nowhere near her husband? It’s not that kind of investigation. In another example, they identified a San Francisco hotel where Joe Biden was meeting Chinese President Xi Jinping, using an agent’s Strava-tracked jogging route.

Seems very lax, are agents even allowed to use their personal phones? Not while working, but the US Secret Service told Le Monde they didn’t prohibit personal use of social media off duty. However they also said “affected personnel have been notified” and “we will review this information to determine if any additional training or guidance is required”.

Sounds as if they’re worried. Is it just the Americans? Mais non. The paper also identified 12 members of French security group GSPR, and six members of the Russian FSO.

I’m sure Putin will just tell them to be more careful in future. No word from the Kremlin. Macron’s office said his security wasn’t affected, but has told agents not to use the app.

Is this the first time there have been security concerns about Strava? Funny you should ask. In 2018, a student found it had mapped US bases in Syria and Afghanistan as well as the Royal Navy’s Faslane base. Another security flaw in 2022 revealed the identities and movements of security personnel at military bases in Israel. Then things got really serious last July …

Ooh go on. In Singapore, rent-a-runners hit the news by offering a service whereby they logged on to other people’s IDs and did runs for them, and charged by the kilometre.

So people could pretend to have done exercise they hadn’t? Exactly. Strava jockeys, as they became known.

But that’s defeating the object of the whole thing! No kudos! Well, some people will do anything to get a better PB.

Do say: “Sträva is Swedish for strive, don’t you know.”

Don’t say: “Aha, so that’s the layout of Camp David … ”