543
Fitness app Strava gives away location of Biden, Trump and other leaders, French newspaper says. (apnews.com)
submitted 2 years ago by to c/technology@lemmy.world
63 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 185 points 2 years ago* (26 children)

Why would they let bodyguards use tracking apps? Are we really that bad at opsec?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 26 child comments
    •
  • [–] 71 points 2 years ago (11 children)

    Trump is such an incompetent clown that he has a comedian thrash on US citizens in a US territory as a bigoted racist warm up act for his rallies. What do you think.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 66 points 2 years ago (7 children)

    Trump is not responsible for his security though, secret service is. Would think that those guys would know to not wear random trackers with them

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 27 points 2 years ago (3 children)

    Pretty sure the secret service is responsible for protecting Trump. The rest of his campaign security is the job of the campaign, which is famously cheap.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 2 years ago (2 children)

    And it's in the Secret Service's interest to have certain rules for any additional security operating an an event they're responsible for protecting. That's literally their job...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago (1 child)

    Yes but thr farther they get from the protected the less oversight.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 2 years ago

    I guess that depends on the reason they're further from the VIP. If it's because they're prepping for a visit, it should have just as much oversight as if they're with the individual. If they're merely doing mundane work (say, cleaning up after a visit), then sure, allow some leeway. But in general, if they're on the clock, they shouldn't have any trackers outside of ones issued for the purposes of their job.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 0 points 2 years ago (2 children)

    What does that have to do with the French newspaper Le Monde?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 48 points 2 years ago (2 children)

    The article noted that the agents can't use their personal devices while on duty but of course they can while they are off duty. It mentioned that one of the guards took a jog while off duty, but that jog was from the hotel the President was staying at.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 32 points 2 years ago (1 child)

    Still the agents mistake.

    They could set the start/finish area to be masked, they could set their run info as private, they could have just the run stats (but no GPS) shared, etc.

    This isn't a strava issue, just Secret Service Agents being bad about Secrets when doing their Service.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 26 points 2 years ago (8 children)

    Why would they let bodyguards use tracking apps? Are we really that bad at opsec?

    Wrong question LOL. Better ask:

    Are we really that bad at allowing tracking?

    Yes you are. And once the data is collected, people are going to do things with the data.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 3 points 2 years ago (7 children)

    It goes both ways. Companies are able to track way more data than they should be able to and users are bad at avoiding or even being aware of it, including many who should have security concerns at the top of their mind.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 2 points 2 years ago (6 children)

    It makes sense for an app like Strava to track location, because that's literally its purpose. It doesn't make sense for a bodyguard to be using an app like Strava.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 2 points 2 years ago (5 children)

    I'd prefer if that information was stored locally and wasn't usable by anyone at Strava to just look up where someone is and/or has been.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 2 points 2 years ago (4 children)

    Same, but Strava is literally a social media app where you're comparing your routes to other peoples' routes. I used to use it because I liked tracking personal progress, but ended up bailing after a few months because I really don't want any of the social nonsense.

    That said, Strava isn't the one that should be punished/regulated here, they're just offering a service people find value in. The real ones at fault are the bodyguards, who should absolutely know better and be much more careful about electronic equipment they and anyone involved carries.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 2 years ago (3 children)

    Ah, I haven't used it so didn't realize there was a social aspect to it, that makes sense, though I don't think the social nonsense is worth giving that kind of data to the parent company. Though I suppose the leaks in this case were just from people looking up the bodyguards on the service? Is there an option to set your profile to private?

    But yeah, I'd agree that anyone who doesn't want their location to be shared shouldn't be using that, especially when there's security concerns.

    Though just carrying a cell phone at all gives some people access to your full location information, if they care to track it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 2 years ago (2 children)

    From the article:

    Le Monde found that some U.S. Secret Service agents use the Strava fitness app.

    ...

    Le Monde also found Strava users among the security staff for French President Emmanuel Macron and Russian President Vladimir Putin. In one example, Le Monde traced the Strava movements of Macron’s bodyguards to determine that the French leader spent a weekend in the Normandy seaside resort of Honfleur in 2021. The trip was meant to be private and wasn’t listed on the president’s official agenda.

    So yes, they basically did a bit of journalism to figure out who the bodyguards were, and looked them up on the app.

    Is there an option to set your profile to private?

    Yes, but I'm not sure what workarounds exist to view private data. Here's a forum post about it:

    Profile set to “Followers”

    • You must approve or deny Strava community members before they can follow you. You can find out more about managing your follow requests in our previous tip: How to approve or deny Strava follower requests.
    • Non-Followers who are logged in to Strava will be unable to see your full profile.
    • A logged out version of your profile won’t be available on the internet.

    I'm not sure what "full profile" vs "partial profile" means in this case, but there is a setting for it. I set mine to private when I used it some years ago, but I bailed because I honestly didn't find much value in it. I mostly used it for route planning, but eventually found a better app for it when they changed what features are part of the free vs paid tiers (and that impacted route planning IIRC).

    Regardless, a bodyguard to an important individual like a head of state/government shouldn't be using anything that tracks location, regardless of what the policies of the app are. Keep that on personal devices, and leave those behind when doing a job w/ an important person.

    Though just carrying a cell phone at all gives some people access to your full location information, if they care to track it.

    Sure, network operators certainly have access, and there's a good argument that only short-range radios should be used by security professionals when on an assignment. If they must carry a phone, it should probably have the radios disabled, or they should have some tech in place to change where they appear to be located (e.g. repeaters).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 years ago (1 child)

    Thanks for the detail!

    And I agree that maybe they should be using something else. Though one risk with using something that few others are using is that it can also be used for targeting and tracking. Like if someone knows the bodyguards use shortwave communicators and that there's an event at some location, they could have drones set up to just target those frequencies when they see them.

    It'll always be an arms race, at least if the players realize they are in an arms race and don't just willingly carry tracking devices.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 2 years ago

    They'd probably just use whatever bands the local police use, and those communications are encrypted as well. So to an outside observer, they could see that someone is chatting on the police bands, but they wouldn't know if it's the local police or something more interesting.

    And these types of events typically establish a no-fly zone large enough that an attacker wouldn't know where they're coming from, even if they knew the exact location of the event (i.e. a campaign rally). It's still possible, but there's a lot that the Secret Service can and does do to mitigate tracking risks.

  • permalink
  • fedilink
  • source
  • parent