How Strava Data Leaked Locations of Trump, Putin, Macron, and More

Even the security staff of the world’s most high-profile figures subscribe to the ethos that “if it’s not on Strava, it didn’t happen.”

A deep-dive investigation by Le Monde revealed Strava data could be used to track the movements of U.S. leaders Donald Trump, Joe Biden, and Kamala Harris.

Le Monde identified 26 U.S. security agents who had been clocking kilometers and getting Kudos on the activity tracker while attending official work trips.

Twelve members of France’s Presidential Security Group and six members of Russia’s Federal Protection Service were also identified by the paper as regular users of Strava. Their uploads were used to suggest locations of Russian president Vladimir Putin and French leader Emmanuel Macron.

The French outlet dug so deep in its “Strava Leaks” series that it was even able to pinpoint where Macron went on holiday in 2021.

Le Monde’s investigation also suggested the locations of current and incoming first ladies Jill Biden and Melania Trump could be identified via the Strava profiles of their security teams.

The U.S. Security Service told Le Monde staff were prohibited from using personal electronic devices while on duty. What they do during off-duty hours is their own business however.

“Affected personnel have been notified,” the Service told Le Monde. “We will review this information to determine if any additional training or guidance is required. We do not assess that there were any impacts to protective operations or threats to any protectees.”

Hiding from the heat map

This isn’t the first time location security has thrust Strava into the headlines.

In 2017, the platform published global “heat maps” which highlighted all its users’ favored routes. Among those were the “heat traces” left by staffers training out of military bases in Afghanistan, Djibouti, and Syria.

Similar occurred in 2022 when Strava sleuths identified and tracked security personnel working from bases in Israel.

Users are, of course, able to set their activities to “private” and so remove their workouts from the public feed.

However, “private” activities are still aggregated by Strava into its “community-powered features” – including its global heat maps.

Users are required to opt out of this auto-enrollment through their profile’s privacy control settings.

“Strava Metro, the Global Heatmap, Points of Interest, and Start/End Points are examples of community-powered features. They improve the Strava experience. These features source the collective knowledge and route usage of athletes to help the Strava community find places to run, ride, and walk. All data is aggregated and de-identified,” reads an explainer in Strava’s “privacy controls” page.

Strava claims 120 million athletes across 190 countries are using its platform. Its 2023 year-end review reported more than 10 billion activities had been uploaded in the past 12 months.

The wildly popular exercise app recently launched a new feature designed to promote users’ awareness of their personal security.

A recent App update now prompts users to edit their activities – and potentially make them private – via the “Quick Edit” pop-up screen. Hiding data from global heat maps requires one more click however.