Strava Still Maps Troop Runs After CENTCOM’s Tightest Rules

U.S. personnel at Middle East bases are still posting public Strava workouts that map recurring routes, months after Central Command ordered its tightest location controls.

A review of public profiles found repeated runs, gym photos and Army training kit at sites in several countries, including activity logged after the highest force-protection order of the Iran war.

Public Workout Tracks Still Outline CENTCOM Bases

The August review, published on August 14, found users of the fitness app recording workouts at bases in several countries inside the CENTCOM area. The logs were not one-off jogs. They were recurring routes and exercise spots that, stacked over time, sketched how people moved around a base.

Some posts went past GPS. Users uploaded photos of people in Army physical training clothes or military-style kit. One activity geotagged to a military site included a picture taken inside a fitness area.

A separate data review published August 12 found more than 1,300 Strava users sharing thousands of workouts from U.S. military installations across the region. Many accounts used real names. Some routes sat on sites that do not appear as established bases on public map services.

WHAT THE PUBLIC POSTS SHOWED

• Repeat loops: The same running and cycling lines came back often enough to sketch daily movement around housing, gyms and perimeter roads.
• Real names: A large share of the 1,300 accounts were not anonymous handles, which turns a heat blob into a person who can be watched.
• Kit and interiors: Photos showed Army fitness clothing, military-style equipment and, in one case, the inside of a base gym.
• Unmarked ground: Some activity sat on compounds that commercial maps do not label as bases.

Mid-August views of the public map still showed dense route lines at Muwaffaq Salti Air Base in Jordan and at Prince Sultan Air Base in Saudi Arabia. The leak is not a watch quietly logging pace. It is the choice, after PT, to upload a line that traces the whole installation.

A Run Is When the GPS Has to Stay On

That choice collides with written rules that sound strict until you try to obey them on a five-mile loop.

CENTCOM personnel are not barred from carrying personal smartphones in the theater. Command Policy Letter Number 25-10, dated Dec. 4, 2025, tells them to disable geolocation functionality when not needed, review privacy settings from time to time and limit what they share in public. The same answers to Sen. Ron Wyden, D-Ore., add that turning location off on commercial products does not always fully kill it.

A fitness app does not work without location. The moment a soldier wants a mapped run is the moment the guidance says the feature is “needed.” Public sharing is also the product: segments, leaderboards, clubs and the social feed all reward a visible route.

On Feb. 28, 2026, the eve of the Iran war and the start of Operation Epic Fury, Adm. Brad Cooper, the CENTCOM commander, ordered FPCON Delta, All Measures, across the theater. The command later told Congress those were its most restrictive geolocation controls. Some of the public Strava activity tied to military sites was recorded after that order.

Government phones were late to the same fight. Personalized Advertising is off by group policy, but Ad Targeting Information is not, and a user can still edit it. CENTCOM was moving those devices to a new management server that could shut location services off completely, with an estimated finish date of May 6, 2026. The command only rolled out a way to administratively disable location sharing on smartphones in May, three months into a war it had already placed at the highest protection level.

What the July 16 Post at Muwaffaq Salti Showed

The cost of that gap is easiest to see at one Jordanian air base.

Before the war, U.S. personnel at Muwaffaq Salti Air Base near Azraq had been posting hundreds of runs. Activity dropped in March, then came back during an April cease-fire window. The later routes were no longer spread across the whole site. 76 percent of those later activities began or ended near barracks on the eastern side of the base.

Publicly accessible Strava activity was posted at the installation on July 16. The next day, Iranian ballistic missiles and drones hit the base. Three U.S. soldiers died in that attack: Pvt. Isabella Gonzales, 19, of Carrollton, Texas; 1st Lt. Tyler James Feehan, 25, of Ewa Beach, Hawaii; and Sgt. Angel S. Rampersad, 28, of Ozone Park, New York. Four other Americans were flown to Jordanian hospitals and later discharged.

CENTCOM said its forces at the base defended against Iranian ballistic missile and drone attacks on July 17. Its first public note listed two killed and one missing. Rampersad had been carried as missing until remains from the site were identified on July 25.

CENTCOM Statement on Recently Fallen, Missing U.S. Service Members

TAMPA, Fla. — On July 17, two U.S. service members in Jordan were killed in action as U.S. Central Command (CENTCOM) and partner forces defended against Iranian ballistic missile and drone attacks. Additionally,…

— U.S. Central Command (@CENTCOM) July 18, 2026

The reviews did not prove that Iran aimed with Strava. They did show that a public workout sat on the map one day before the strike, and that the later run cluster sat on the housing Iran hit.

The Barracks Cluster Iran Struck in July

Jordan was not the only place where a public run moved with the war.

At the main U.S. naval facility in Manama, Bahrain, a Strava account tied to a U.S. Navy contractor had been logging runs around the base until about a week before fighting started. After a two-day gap, the same account showed loops around the courtyard of the Crowne Plaza hotel, where people had been moved. Iran struck that hotel six days later. Two Pentagon employees were reported injured. Again, the reviews did not establish that the app supplied the aim point.

British personnel also logged workouts at RAF Akrotiri in Cyprus, a site that later came under Iranian attack. Special operations expert Jonathan Hackett said “lax enforcement and lack of awareness” sat behind the sharing, and that Iran was likely using such feeds to follow U.S. movement. Joseph Jarnecki, a research fellow at the Royal United Services Institute, put the age of the problem in one line.

It’s been a very well-documented intelligence-gathering vector for over eight years now.

Joseph Jarnecki, research fellow, Royal United Services Institute

SITES WHERE PUBLIC RUNS AND STRIKES OVERLAPPED

Stacked together, hundreds of ordinary activities give analysts what they call a pattern of life: where people sleep, when they move, which corner of a base fills up after a cease-fire. Anyone with an account can scroll it. No hack is required.

Eight Years of Memos After the Heat Map

The Pentagon has been writing this warning since the app first drew the bases in neon.

In January 2018, analyst Nathan Ruser showed that Strava’s global heat map, built from billions of public activities, lit up U.S. sites in Syria, Iraq, Afghanistan and other quiet deserts. Outlines of compounds that satellite maps left dark were bright because troops ran there and locals mostly did not. Convoy lines and parking loops showed up too. The Pentagon said it was reviewing training and guidance.

On Aug. 3, 2018, Deputy Defense Secretary Patrick Shanahan issued a memo that left troops prohibited from using geolocation features on personal and government devices, apps and services in designated operational areas. Commanders could grant exceptions after an OPSEC survey, or for government devices when the mission required it. The memo warned that these tools can expose personal information, locations, routines and the number of people on a site.

That 2018 ban is still the foundation. CENTCOM then layered its own letter in December 2025 and the FPCON Delta controls on February 28. In the spring it told Congress it had received multiple threat reports of adversaries using commercial location data to target or watch U.S. personnel in theater, and that its Threat Fusion Cell had passed those reports to force-protection officers.

THE PAPER TRAIL FROM HEAT MAP TO FPCON DELTA

1. January 2018: Public heat map data lights up U.S. bases and patrol traces in conflict zones.
2. August 3, 2018: Shanahan memo bans geolocation features in designated operational areas.
3. December 4, 2025: CENTCOM Policy Letter 25-10 orders troops to switch off unneeded location tools, review settings and limit public sharing.
4. February 28, 2026: Cooper sets FPCON Delta and what the command calls its most restrictive geolocation controls as the Iran war begins.
5. May 2026: The command rolls out administrative disable of location sharing; government-phone migration to fully kill location services had a May 6 target date.
6. July 16, 2026: A public workout is posted at Muwaffaq Salti, one day before the strike that kills three U.S. soldiers.
7. August 12 to 14, 2026: Two reviews document more than 1,300 users and recurring base routes that continued after the February order.

When asked in August for a copy of Policy Letter 25-10, and whether the public posts complied, how the rules are enforced, or whether anyone had been punished, CENTCOM would not answer.

We do not discuss force protection measures for operational security reasons.

U.S. Central Command, email, August 2026

Strava Puts the Duty on the User

The company that hosts the map has spent eight years pointing at settings.

After the 2018 heat map row, Strava added heatmap opt-outs, privacy zones and a login wall for street-level detail, and said it would work with militaries on sensitive spots. CEO James Quarles wrote then that members in the military and other people living abroad may have shared location in empty terrain and, in doing so, raised awareness of sensitive sites.

A January 1, 2026 terms update, which the company said was meant to simplify its rules, added reminders to use geolocation-sharing features responsibly, especially for people in a sensitive role or a position of trust. Asked about the Middle East posts, Strava said it takes privacy and security seriously and that its terms “expect people working in sensitive professions to leverage the controls available to them and appropriately limit their content.”

That sentence is the whole design. The app stays useful when routes are public. The duty to hide a base sits on the 19-year-old with a watch, not on the default share toggle. Privacy zones and private activities work only if someone finds them, understands them and uses them every time they go out the gate. The August reviews show a lot of people did not.

Lawmakers Want Controls the Command Will Not Discuss

Wyden and a bipartisan group of more than a dozen legislators spent the spring pressing the Pentagon to treat commercial location data as a targeting aid, not a lifestyle leftover. In a May 28 letter they warned that bought location feeds can show where troops gather and how they live, and can feed missiles, drones, roadside bombs and counterintelligence work. They wanted advertising IDs killed on government and personal phones, location sharing shut off automatically in theater, and browsers that hoover user data replaced.

CENTCOM’s written replies, the ones that listed Policy Letter 25-10 and FPCON Delta, also said personal phones remain allowed. The command would not, in August, say whether the Strava posts broke that letter.

WHAT WE KNOW

• Phones in theater: Personal smartphones are still allowed in the CENTCOM area, under a letter that tells people to switch location off when they do not need it.
• Posts after Delta: Some public base-linked Strava activity was recorded after the February 28 order that the command called its tightest location control.
• July 16 at Salti: A public workout was logged at Muwaffaq Salti the day before the strike that killed Gonzales, Feehan and Rampersad.

WHAT IS UNCONFIRMED

• Iran’s aim point: The reviews did not establish that Iran used Strava data to choose the Jordan barracks or the Bahrain hotel.
• Discipline: CENTCOM has not said whether anyone was punished, or even whether the posts violated Policy Letter 25-10.
• The letter itself: The command did not release the text of Policy Letter 25-10 when asked.

The heat map of 2018 was supposed to be the lesson. The memos that followed banned a feature that a mapped run requires, then left personal phones in pockets and the share button on. Eight years later, the public route is still the workout.