Strava Data Exposes Belgian Troops at Sensitive Sites

Hundreds of Belgian military personnel can be identified at some of the country’s most sensitive installations through the fitness-tracking app Strava, according to an investigation published on 24 September by the Flemish daily De Morgen. The newspaper found that data publicly shared through the US sports app exposed the names, routines and, in many cases, the home locations of service members stationed at key national and NATO sites.

The findings have renewed questions about digital-footprint discipline in the Belgian armed forces, coming just two weeks after a separate geolocation scandal prompted Defence to reiterate restrictions on location-sharing apps.

What the Investigation Found

The investigation, led by De Morgen defence and energy specialist Jeroen Van Horenbeek, identified the names of no fewer than 4,000 military personnel who had recorded sporting activity on the grounds of sensitive sites since 2014. The six locations involved are the Defence headquarters in Brussels, the air bases of Kleine-Brogel and Florennes, the naval base at Zeebrugge, NATO headquarters in Brussels, and the NATO command centre (SHAPE) in Mons.

According to RTBF, two-thirds of the personnel detected at these six sites maintained a public profile on Strava. Those profiles expose at minimum first and last names, profile photographs and biographies. Frequently they also reveal places of residence, nationalities and follower counts.

The US app records and geolocates sports training. It features route “segments” — short stretches of a run or ride that users race over — which rank participants on leaderboards. Critically, such segments exist on the secured grounds of the Belgian army and NATO, meaning that even users with tighter privacy settings can appear in public rankings.

“A harmless habit, a very real risk,” RTBF wrote, framing the issue in terms of the involuntary exposure of sensitive information “at a time when personal data has become a raw material for intelligence.”

De Morgen’s own headline for the investigation asked pointedly: “A jog around the F-35s?” Kleine-Brogel hosts Belgium’s nuclear-sharing mission and is transitioning to F-35 fighter aircraft.

A Recurring Problem, Not an Isolated One

The Belgian case is the latest chapter in a long-running debate over service members’ use of consumer fitness trackers — a debate that began with the same app nearly a decade ago.

In January 2018, Strava’s Global Heat Map, which aggregates and brightens frequently used routes, inadvertently revealed the locations and layouts of military bases worldwide, including remote outposts in Afghanistan and Syria that were not identifiable on public maps. As The Guardian reported at the time, militaries around the world began weighing bans on fitness trackers, and Strava advised military users to opt out of the map, arguing the information had been made public by users themselves. Belgian Defence reinforced its rules on the use of personal smartphones by military personnel in the wake of that affair.

Four years later, in June 2022, The Guardian reported that Israeli military personnel had been tracked on secret bases through the app. Unidentified operatives had created fake running “segments” inside the bases, allowing them to monitor individuals who exercised there even when those users had applied the strongest available privacy settings. The surveillance was uncovered by the Israeli open-source intelligence outfit FakeReporter, which alerted the authorities and Strava.

The 2022 case is directly relevant to the Belgian findings, because it demonstrated that Strava cannot verify whether a user was physically present at a given location — and that “segments” can be exploited to identify people inside installations that ought to be invisible to the outside world.

The Immediate Backdrop: The Polarsteps Incident

The Strava revelations landed barely two weeks after a separate geolocation controversy. On 8 September, the Dutch investigative outlet Follow the Money reported that it had gained access to the photos, videos and GPS data of 23 million users of the travel app Polarsteps — including 904,000 Belgians — and recovered data on Dutch, French and Belgian military personnel.

In response, Jan Van Camp, spokesman for Defence Minister Theo Francken, said geolocation apps such as Polarsteps are prohibited for military personnel within and near military quarters, according to La DH/Les Sports+. The Netherlands immediately blacklisted the app; Belgium said the general ban already applied. Offenders, Defence said, are “sensitised to the risks.”

Defence has also said that recruits receive instruction on operational security, social media and safe digital behaviour during basic training, with ongoing awareness delivered through training, communication campaigns, information documents and internal channels. Location-sharing risks are covered in the annual Joint Individual Common Core Skills (JICCS) training and test, and the department says it conducts checks during security verifications and after security incidents.

Why the Stakes Are High

The sites named in the investigation are among Belgium’s most strategically important. Kleine-Brogel, home to the nuclear-sharing mission, and Florennes are the country’s two principal air bases; SHAPE in Mons is NATO’s supreme headquarters; NATO headquarters in Brussels is the alliance’s political centre; and Zeebrugge hosts the naval base.

The exposure comes during a tense security period. Belgium’s terror-threat level remains at level 3, and 2026 has seen drone incursions over the Kleine-Brogel and Florennes air bases as well as attacks linked to an “Iranian call,” according to RTL Info. Against that backdrop, any data that maps which individuals work where — and when they exercise — carries potential intelligence value.

The report has been carried by every major Belgian outlet, all attributing the finding to De Morgen via the Belga wire agency, amplifying pressure on Defence to respond. As of the morning of publication, no direct public comment from Minister Francken or from Strava specific to the Belgian findings had been reported.

What to Watch

Several questions remain open. Whether Defence will tighten the 2018 smartphone rules further, and whether it will treat the Strava findings as a systemic failure rather than an individual lapse, is not yet clear. Nor is whether NATO will review its own personnel’s fitness-app usage at SHAPE and its Brussels headquarters.

The broader challenge is structural. Fitness apps are designed to be social, and their privacy defaults favour visibility over secrecy. As long as service members use them, the location data they generate will create a persistent — if inadvertent — security risk, one that awareness campaigns have so far struggled to eliminate.

For Belgium, the immediate test is whether the repeated warnings of 2018, 2022 and 2026 finally translate into enforceable practice — or whether the next investigation will simply add another date to the list.