This article explains how U.S. service members in the Middle East continued posting workout data on Strava years after Pentagon warnings, how that public data mapped movements between bases and temporary sites, and why the issue remains a national security concern even as leadership tries to deter adversaries.

Strava Still Reveals U.S. Troop Locations in the Middle East Years After Warnings

Service members and contractors deployed across the Middle East have been sharing fitness activity that includes precise routes, timestamps, and sometimes photos from inside military facilities. Those public traces have recorded movements between bases and to temporary housing, offering a clear picture of routines and relocations. The data is not hypothetical — analysts found hundreds of workouts tied to specific installations, posted under real names in many cases.

One striking instance involved a major air base in Jordan where personnel posted hundreds of activities prior to hostilities. Activity paused once fighting began and then picked up again during a ceasefire, but the pattern of routes shifted. Seventy-six percent of the new workouts started or ended near eastern barracks, effectively showing where people had moved inside the base.

A workout posted on July 16 from that base was publicly visible one day before Iran launched missiles that hit the barracks, killing three American soldiers the next day. There is no direct proof the attackers used the fitness posts to pick their target, but the timing and specificity of the publicly available information are alarming. Publicly traceable movements create risk whether or not they are ultimately exploited.

A Navy contractor assigned to a Fifth Fleet headquarters in Bahrain shows the other side of the pattern: routine runs from the naval base that stopped as tensions rose, then resumed as runs around the courtyard of a nearby hotel used for temporary housing. Days later, the hotel was struck and Pentagon employees were wounded. Again, no direct link has been proven between the posted activities and the attack, but the accessible trail tied the base to relocation sites before the strike.

Across multiple countries, users repeatedly uploaded routes that began or ended at known military facilities, sometimes with photos showing people in Army physical fitness clothing or military-style gear. One activity included a geotagged photo taken inside a base fitness area. These are not isolated anomalies; investigators cataloged more than a thousand users and thousands of workouts connected to U.S. military installations.

The Pentagon has long been aware that commercial location data can be weaponized. After a 2018 global heat map incident exposed activity around bases, senior Defense officials banned geolocation features on government devices and on personal devices in operational areas. That policy acknowledged the danger: public location data “can expose personal information, locations, routines, and numbers of DoD personnel, and potentially create unintended security consequences and increased risk to the joint force and mission