Slashdot Mirror
Pentagon Reviews GPS Policies After Fitness Trackers Reveal Locations (npr.org)
An anonymous reader quotes a report from NPR: Locations and activity of U.S. military bases; jogging and patrol routes of American soldiers -- experts say those details are among the GPS data shared by the exercise tracking company Strava, whose Heat Map reflects more than a billion exercise activities globally. The Pentagon says it's looking at adding new training and policies to address security concerns. "Recent data releases emphasize the need for situational awareness when members of the military share personal information," Pentagon spokesman Major Adrian J.T. Rankine-Galloway of the U.S. Marine Corps said in a statement about the implications of the Strava data that has made international headlines. Strava -- which includes an option for keeping users' workout data private -- published the updated Heat Map late last year. The California-based company calls itself "the social network for athletes," saying that its mobile apps and website connect millions of people every day. Using data from fitness trackers such as the Fitbit, Strava's map shows millions of users' runs, walks, and bike trips from 2015 to September of 2017 -- and in some countries, the activities of military and aid personnel are seen in stark contrast, as their outposts shine brightly among the comparative darkness of their surroundings.
If you wear a tracking GPS...it might track where you are. Film at 11.
Just tell our soldiers and sailors that their comrade/shipmate's activities may conjure some inbound and the "new guy with the pretty watch" problem should take care of itself.
Even the external "secure" provision of cloud services itself allows predictive location of military and intel assets. Just the traffic flow itself allows you to pinpoint this, even if it's time-delay GPS data from "I turned my cell/smartphone/fitbit/watch off, sergeant!" health data.
We can back extrapolate locations and pinpoint internal corridors and access points - for example, knowing people stop at a door for x minutes/seconds tells us what the security protocol is for the access point, and knowing the elevation information from other ping services drops except at stairwells tells us what is and what is not secure within the installation.
-- Tigger warning: This post may contain tiggers! --
... is the lack of foresight on the part of American military.
We used to be better than this.
It little behooves the best of us to comment on the rest of us.
All military personnel must enable the "Privacy" mode on all portable electronic devices when out of CONUS. Because those privacy modes are disabled by default.
No personal devices, done. 20 years ago they wouldn't have had cell phones, now they all do. If they are deployed, depending on where and what the mission is, they either get no contact with home or the internet, or they only get access to home and the internet via a shared workstation setup centrally located on the base. Anyone caught deploying with any sort of electronic device besides possibly an approved MP3 or DVD player should be subject to "other than honorable discharge". There is no reason for them to have them when deployed. You want to keep a secret you don't let people talk. Allowing people access to the internet will leak information 100% of the time.
Governments are keen to tell us that metadata doesn't need protecting etc.
Cake and eat it?
You forgot: Claim of liberal media of the Russian hackers in many social media is spread of total lies.
...Strava -- which includes an option for keeping users' workout data private...
The data are still on Strava's servers. Do those servers pass the military security requirements for protecting troop locations? What else does Strava do with the data?
Yes, it's user error, but .. WHAT. THE. FUCK. The diagnosis is so wrong that .. that .. I can't think of a stupid metaphor, and I'm usually pretty good at stupid metaphors.
Uploading sensitive information to a completely untrusted third party and then remembering to "mark it private" is like [oh good, I've still "got it" as long as a simile will suffice] sending plaintext email and being surprised that someone intercepted the plaintext because they weren't supposed to do that, shame on those naughty spies.
Strava owes jack shit to the military, and therefore, the military has no reason to trust Strava (either their intent, nor the security of their database even if Strava's intent is good.)
The correct thing to do is not send the data to third parties. It doesn't matter how you mark it, because even if you mark it private, you have still disclosed the sensitive information.
This shouldn't be a surprise to anyone, anyway. The most common sense way for these devices to work is to transmit the data to the user's own computer. But so much of today's IoT is made to lock people in services for recurring revenue, that they're made to send data to company servers (a.k.a. "the cloud") instead. Users are supposed to Just Say No with their wallets but discouragingly, people are still buying this type of obvious garbage that they know is garbage before the sale.
So yeah, I'd say user error. They shouldn't have bought the device, but they did. Then they allowed it to transmit their locations to third parties, which was a major major fuckup. Then ok, cherry on top, they didn't mark it private. But it was already a shocking display of stupidity long before that point.
I really dislike this idea that the user is supposed to use some privacy setting to tell Strava "this is military data, so I humbly request that you please not share it with the enemy." So fucking wrong. Don't give the data to Strava in the first place.
Oh and by the way -- don't Russians run?
n/t
Re "There is suspicion that US Navy ships have been running into civilian ships because their navigation is different than the other ships."
Thats due to not having the crew up to standard 24/7 while on duty. Just put more effort into finding people with the skills to learn who are not distracted.
Technology has got better. Take time to educate and test the crew before letting them do "navigation".
Domestic spying is now "Benign Information Gathering"
Re "I don't know if these limits exist in more current devices as people simply stopped talking about them."
Fake mobile phone masts spy on your calls
http://www.telegraph.co.uk/new...
Lots of digital news is around AC. Lots of data to collect from different consumer devices wondering around.
Domestic spying is now "Benign Information Gathering"
Create a law were companies can not share data --- fixed
GPS does work in an airplane, I've used it on a commercial airliner. Speed, location, and direction were correct but I didn't check altitude.
And here I GENUINELY thought when soldiers were sent to "off the map" places they had to leave all that stuff at the main base in the US where they left from. I thought it was something like prison. It makes no logical sense to use a mobile device at these bases that are supposed to be hidden. If I check my phones location history it will tell me exactly where I was, how long I was there and what other places I might visit next time in the area once it gets a data connection. Hell even logging on to something like facebook or google will geo-track you.
I thought they were only allowed to use the computers on base because they encrypted the internet data or something to prevent geo-tracking. It is the military, they are capable of at least that aren't they?
My understanding was you sign up for a free ride with the military (paid school, salary, housing, etc.) in exchange for giving your dedication AKA you are going to an "open prison" its just run by the military because they aren't giving free handouts.
I used my cell phone with the CoPilot GPS app.
If I understand correctly, there's nothing wrong. It's IOT devices that send everything to a remote that isn't under the user's control.