French newspaper Le Monde has exposed the locations of approximately 18,000 French military personnel by analyzing publicly available data from the fitness tracking app Strava, revealing an operational security failure that persists eight years after similar breaches exposed US military installations worldwide.
The investigation, published Monday, demonstrates how data from soldiers' exercise routines can reveal the locations of sensitive military facilities, patrol routes, and even the layouts of classified bases in conflict zones. The findings come as France maintains deployments across Africa, the Middle East, and Eastern Europe amid multiple security crises.
"What's most alarming is that this problem was supposed to have been fixed," said Jean-Dominique Merchet, Le Monde's defense correspondent. "After the 2018 'Stravaleaks' exposed US bases, military leadership around the world promised reforms. Clearly, those reforms were never implemented—or soldiers simply ignored them."
The 2018 incident revealed the locations of secret US military bases in Afghanistan, Syria, and elsewhere when American soldiers' jogging routes appeared on Strava's public heat map. The revelation prompted the Pentagon to issue new guidelines restricting use of fitness trackers and other connected devices in operational areas.
French military leadership promised similar reforms. They failed to implement them effectively, and now that failure could have lethal consequences during active deployments.
The Le Monde investigation used open-source intelligence techniques to cross-reference Strava data with known French military installations. In some cases, reporters could identify not just the location of bases but also which buildings housed specific units, the timing and routes of perimeter patrols, and the exercise habits of individual personnel.
The security implications are severe. In Mali, where French forces are engaged in counterterrorism operations, Strava data reveals patterns that hostile forces could exploit to time attacks. In Eastern Europe, where France contributes to NATO's enhanced forward presence, the data could provide Russian intelligence with valuable information about force disposition and routine.
To understand today's headlines, we must look at yesterday's decisions. Modern militaries have struggled to balance operational security with the reality that soldiers are digital natives who use consumer technology habitually. Banning devices entirely is impractical and harms morale. But allowing their use without adequate safeguards creates precisely the vulnerabilities Le Monde has now exposed.
The French Ministry of Defense issued a statement Monday acknowledging the breach and announcing immediate measures. Personnel in operational theaters will be required to disable location services on all personal devices, and the use of fitness tracking apps will be prohibited in designated security zones.
But experts question whether these measures will be enforced more successfully than previous guidelines. The problem is not lack of policy—it's lack of compliance and inadequate technical controls.
"You can't rely on 18,000 soldiers individually remembering to turn off their fitness apps," said Baptiste Robert, a French cybersecurity researcher. "You need network-level controls that prevent these apps from transmitting location data from sensitive areas. That requires investment and technical sophistication that many militaries haven't prioritized."
The breach also raises questions about whether adversaries have been exploiting this data without public disclosure. While Le Monde used only openly available information, intelligence services presumably have more sophisticated methods for harvesting and analyzing fitness app data.
Russia, China, and other nations with advanced cyber capabilities may have been tracking French military movements for years through this vector. The Le Monde revelation merely makes public what foreign intelligence services likely already knew.
For France, the timing is particularly embarrassing given Monday's announcement of AI deployment across military operations. The juxtaposition of cutting-edge artificial intelligence integration with failures on basic operational security highlights the uneven nature of military modernization.
French Defense Minister Sébastien Lecornu called the breach "unacceptable" and ordered an investigation into why 2018 reforms were not effectively implemented. But the incident reflects a broader challenge facing all modern militaries: how to maintain security in an era when nearly every device can become a tracking beacon.
