OSINT Investigations  ★    Contact us  ★   
Flyby bekijken

Strava and Open Source Intelligence

In recent years we have seen multiple blogs describing how the fitness app Strava (Strava.com) can be used within OSINT studies. For example, in January 2018 Nathan Ruser wrote that Strava has put millions of GPS points of users online through so-called “heatmaps” with which sensitive locations could be mapped. The international research collective Bellingcat published an article about this in July 2018 in which they describe how the work and private locations of military personnel can be mapped via Strava and Polar. In The Netherlands this led to political discussions.

Strava heatmap Amsterdam

Fortunately, users can now protect their location data via their privacy settings. This means that activities marked as “private” by athletes will not be shown. But many athletes appear to be still active in sharing their location. Via https://www.strava.com/settings/privacy users can modify their privacy settings regarding their profile, activities, group activities and “flyby’s”. They can also change the privacy settings of so-called “local legends”, they can create privacy zones and they can adjust the visibility of their previous activities. Tip: set “flyby’s” to public, you will need these in a moment.

Strava privacy beheer

While Strava constitutes a breach of privacy and operational security (OPSEC) for one person, Strava is a source of information for another. For example, in 2018 Sebastian Schramm wrote an article on Keyfindings.blog  that explains how Strava can be used to identify witnesses to an incident. Via  “segments” (shared routes) you can map out which people have been active on a segment. And in addition: you can also see when that was. In this article, we’ll take a closer look at mapping witnesses through Strava by creating your own fake running route and uploading it to Strava.
Strava segmenten

Creating a route

To map witnesses to an incident, for example, we need two things. The first is the location of the incident and the second is the time when the incident occurred. In our example below, we pretend that an incident took place on May 25, 2021 around 12:30 pm in the Vondelpark in Amsterdam, The Netherlands. We can find this location in the desktop version of Google Earth Pro.

Amsterdam vondelpark

Then we click on “Add path” at the top, we give a name to the created path and we select the route on the map with our mouse.

Amsterdam segment vondelpark

Now find the route you just created in the left side under the “Places” tab and save it as a .kml-file. The letters “kml” are an abbreviation of “Keyhole Markup Language”. This is a markup language that is often used for geographical data such as we are using right now.

Amsterdam segment vondelpark opslaan

Since only routes of the file types “.tcx”, “.fit” and “.gpx” can be uploaded on Strava, you must first convert the .kml-file to a .gpx-file. You can do this by using the website https://kml2gpx.com/. Upload the .kml-file and click “Convert” to convert it to a .gpx-file. Then save the file.

kml2gpx

You have now created a .gpx file that you can upload to Strava. However, the file you have created only contains a route. It is therefore important that you add “timestamps” to the route. In other words: you have to indicate where exactly you walked at what moment in time. For example, adding timestamps can be done via the website https://gotoes.org/strava/Add_Timestamps_To_GPX.php. Upload your .gpx-file, enter the date and time of the incident you are investigating, taking the time zone into account. Finally, also enter the speed at which you ran and click on “Upload”. Save the new .gpx-file.

timestamp toevoegen

Uploading the route

Now that you’ve created a route and added a time point, you can upload the .gpx-file to Strava. Log in with your (fake) account and select the plus icon and click on “Upload activity” and “File”.

activiteit uploaden

Enter a title and fill in some other information as well. Then make sure that the route is visible to everyone. All set? Save the route.

Activiteit bewerken

Mapping witnesses through Strava

Now that you’ve created and uploaded a route, it’s time to see if you can find potential witnesses. In our case, we are looking for people who have been in or around the Vondelpark in Amsterdam around 12:30 on May 25, 2021. To map these people, we click on “View Flyby’s”. Is this button not there? Then make sure that your flyby’s are shared publicly (set this via the privacy settings).

Flyby

Have a look at the results. As you can see in the example below, a total of two other runners have been active on the same route and at the same time. You can play the route by clicking the play button. This allows you to see which person was at which location at a particular time. The third person in our example is not immediately visible at first. This is because it is only active a little later on the route. You can click on the person concerned to go to his or her profile to find out who that person is.

Flyby bekijken

Note: Users flyby’s are no longer publicly shared by default. This means that users on Strava themselves have to actively share their route in order to make it visible for others. Although we will probably see fewer people as a result, this technique can still be useful in identifying witnesses to an incident. Sometimes a bit of luck is also needed.

Want to know more?

In this blog post, we explained how you can use Strava to identify witnesses to an incident. Do you have questions about this article? Or do you have any additions? Let us know! Would you like to learn more about research on Strava or other social media platforms? Then view our OSINT training courses or contact us.