Locations for Trump, Harris can be found with fitness app: French newspaper

A recent investigation by French newspaper Le Monde revealed that the fitness app Strava inadvertently exposed the locations of high-profile leaders such as former President Donald Trump and Vice President Kamala Harris.

What Did the Investigation Show?

The investigation, released in French and in English, revealed that some U.S. Secret Service agents use Strava, an app commonly used by runners and cyclists to track and share their routes, record their activities and share their workouts with a community. Their use of the app has unintentionally left a digital breadcrumb trail that could potentially endanger their protectees.

Strava users in presidential security units, including those protecting U.S. President Joe Biden, Harris, Trump, French President Emmanuel Macron and Russian President Vladimir Putin were identified in the investigation.

For instance, Le Monde traced the Strava movements of Macron’s bodyguards to determine that the French leader spent a weekend in the Normandy seaside resort of Honfleur in 2021. The trip, meant to be private, was not listed on the president’s official agenda.

In another example, Le Monde said Biden’s security team’s activity on the app preemptively revealed the hotel he’d be staying at in San Francisco for pivotal talks with Chinese President Xi Jinping in 2023. The newspaper found that a few hours before Biden’s arrival, the agent went jogging from the hotel while using Strava, which traced his route.

In addition, Le Monde said the whereabouts of former first lady Melania Trump and current first lady Jill Biden could also be pinpointed by tracking their bodyguards’ Strava profiles.

What Did the Secret Service Say?

In a statement to Le Monde, the U.S. Secret Service assured that their protocol restricts on-duty device usage. However, they added that off-duty usage is not prohibited, citing no significant breach in security.

Following the report, the agency committed to reviewing the issue and providing additional guidance to personnel.

“Affected personnel has been notified,” it said. “We will review this information to determine if any additional training or guidance is required.”

“We do not assess that there were any impacts to protective operations or threats to any protectees,” it added. Locations “are regularly disclosed as part of public schedule releases.”

How Many Agents Use the App?

Le Monde said they identified 26 U.S. agents, 12 members of the French GSPR, the Security Group of the Presidency of the Republic and six members of the Russian FSO, or Federal Protection Service, all of them in charge of presidential security, who had public accounts on Strava and were therefore communicating their movements online, including during professional trips.

However, Le Monde did not identify the bodyguards by name for security reasons.

The Impact of the Investigation

The investigation highlights potential security lapses stemming from trackable Strava data, especially when security agents, tasked with advance travel arrangements, inadvertently reveal sensitive locations like hotels where global leaders later convene for high-stakes meetings.

The report also pointed out that bodyguards using their full names on Strava could expose additional sensitive details, like personal addresses or family information, which could then be used for malicious purposes.

However, in response, Macron’s office said Monday that the consequences of the issues reported by Le Monde “are very slight and in no way affect the security of the President of the Republic,” adding that local authorities are aware of Macron’s movements ahead of time and the places where Macron is staying are always fully secure, “so the risk is non-existent.”

“A reminder was nevertheless issued to agents by the chief of staff asking them not to use this app,” Macron’s office added.

This incident highlights a growing need for more robust regulation around fitness apps and consumer data use, according to Louisiana State University cybersecurity professor Ibrahim Biggili. Biggili’s research warns of the potential for fitness data misuse, which could increase stalking, theft, or even more severe risks. Consumers, he noted, often unknowingly give companies permission to exploit their data.

“Companies love our data, and we love the product, so we give away the data for free,” he said to The Associated Press. “The government really needs to start cracking down on how data can be used and how long it can be retained.”

This article includes reporting from The Associated Press.