When Open Source Info On Fitbit, Twitter Jeopardize US Security

The U.S. military, formerly an unabashed advocate of Fitbit Inc FIT devices, is reviewing its policy on the use of fitness trackers at operational sites after a workout app inadvertently exposed the whereabouts of secret army bases.

Since November, Strava, “the social network for athletes,” has published the static locations, routes and movements of public accounts in a global, interactive “heatmap.”

Experts say the public data makes connected military personnel in conflict zones literal moving targets and, in some cases, betrays the coordinates of their confidential bases.

This is where I politely remind @Strava that it is sitting on a ton of data that most intelligence entities would literally kill to acquire. https://t.co/tKcf1nnov1

— Jeffrey Lewis (@ArmsControlWonk) January 28, 2018

Strava is "committed" to working with military and government officials to address sensitive data; reviewing features that could be compromised; increasing awareness of privacy and safety tools; and simplifying those tools, CEO James Quarles said in a Monday statement. 

"Please know that we are taking this matter seriously and understand our responsibility related to the data you share with us," he said. 

Where Fitbit Fits

The Pentagon has encouraged Fitbit use among military personnel and actually equipped 2,500 with the wearable via an anti-obesity program. As it reevaluates policies around potentially stealth-compromising technology, Fitbit is distancing itself from the issue.

“It is important to note that Fitbit has not revealed overseas military locations and this is not an issue with Fitbit or its app — the heat map is a product of Strava, not Fitbit,” a spokesperson told Benzinga. “Also, Strava’s data is not specific to trackers, but also cell phones, so singling out Fitbit is not accurate.”

The company also confirmed that it shares no unauthorized personal information outside of circumstances listed in its privacy policy.

“Fitbit is committed to protecting consumer privacy and keeping data safe and we give our users control over their information by providing them with account settings and tools to access and manage the personal information associated with their accounts,” Fitbit said in a statement. “Only users that have signed up for Strava and have given consent to synchronize their Strava and Fitbit accounts are included in the Strava heat map — Fitbit devices do not automatically connect to the map.”

An Open-Source Weapon

As security experts discuss the merits and flaws of fitness trackers, other tech companies are being ensnared in a larger data privacy discussion. Twitter Inc TWTR in particular was identified in the aggregation and exchange of sensitive, open-source intelligence.

"Twitter’s being used to piece it together like a jigsaw,“ Danielle Cave, a senior analyst at the Australian Strategic Policy Institute, told the New York Times. “Usually I see them on top of a cyber-related issue hours, if not days, before it ends up on the media.”

Related Links: 

Twitter Stock Unruffled After NYT Report On Fake Followers 

4 M&A Deals Blocked By US Presidents For The Sake Of National Security 

Photo courtesy of Fitbit.