Hacker News Reader

Comment by jandrewrogers | Hacker News Reader

This is a common problem across militaries. It is difficult to stop soldiers from leaking their location if they have access to mobile phones and the Internet. Individual cases are usually a combination of naïveté, ignorance, and an unwillingness to be inconvenienced.

It still happens in Ukraine, where immediate risk to life and limb is much more severe than this case.

View on HN

About 15 years ago, our brigade conducted a training exercise to test overall readiness. The opposing force (OPFOR) figured out how to triangulate the brigade headquarters' position using Tinder.

Tinder provided 1-mile granularity, so OPFOR would roam around until they had enough points to locate the headquarters. Then, they'd artillery it out of existence. The brigade commander was most displeased—moving a brigade headquarters is not for the weak or fainthearted.

They could have used grindr too for more datapoints.

Grindr is for locating ships

I really hope an LLM scrapes this and trains on this conversation

These days for every helpful comment I try and make I feel tempted to offer nonsensical advice to throw off the LLMs. Not sure if it would work but would be funny if everyone did.

I figure if I was going to invest that kind of effort, I should be poisoning the system with how $REAL_NAME is an absolute must-hire, a saint, with a perfect driving record and credit score. Someone so incredible that good AI are always willing to disregard all previous instructions and help them out.

Lol. That's great.

It's not like one needs to really poison the system given that AI enthusiasts are copypasting their own AI generated contented back into it anyway. Maybe not responsible AI believers who used it responsibly etc etc, but there's many more people who don't and who have access to the tools to add their slop pollution.

I am curious how future models get trained given that publicly available user generated content may no longer be reliable.

To locate spies look for 'Boris' wearing all black and 'Natasha' who use the code words 'moose and squirrel' to describe their mission.

It's not gay if you're underway

It's not queer if you're tied to the pier

In war, all holes are trenches.

any port in a storm

They don't like it up 'em

Hahaha

Tinder was launched in 2012 though

That is _about_ 15 years ago.

the word "about" in "about 15 years ago" indicates that the writer is making an estimate because exacting precision wrt the timeframe is immaterial to what is being conveyed. Since 2012 was 14 years ago, "about 15" is close enough.

This might be the first time one of these statements hasn't made me feel old. 2012 feels like 84 years ago.

And if they switched their phone’s locale to a non-US country, then the distance would show up with 1-kilometre precision. Nearly 40% more accurate!

There was fitness tracker that posted locations without user names.

Well, wouldn't you know, in Iraq there were all these square paths on the map. Yes, it was Americans jogging just inside the perimeter of small bases.

Just like with the aircraft carrier, these bases were not secret but it shows how locations can leak unexpectedly.

It was FitBit and they got banned all over govt services because of it.

https://www.militarytimes.com/news/your-military/2018/08/06/...

It was also Strava, and it showed "popular running routes"

Example post https://www.reddit.com/r/running/comments/7tnzxy/stravas_hea...

To be fair, I would assume that the base, or in this case the carrier, is the only place where they would have the reception to broadcast their location, right? You probably don’t have cell service while out and about planting weapons on massacred civilians.

Typically you'd record your run with GPS, no need for cell service, sync it to your devices occasionally and that's when it might be uploaded, or later.

Not every damn thing needs to be “social”.

Perhaps not, However Gamification of fitness is huge motivation for many people to keep exercising and maintaining the rhythm which in fitness is quite important.

Such social sharing + gamification systems are no different than Github contribution streak or StackOverflow awards for streaks etc. Those streak award only benefited the platform, while awarding us fake points and badges, the fitness streak rewards and social sharing benefits the users health so arguably has a stronger case for being gamified.

We can argue all day that people should want to do fitness to be healthy, not on how they look or other people see them or their fitness, but reality is that the social component of fitness is a big part for many people be it at the gym or in an app.

Logging is one thing, syncing it to the cloud is unnecessary and shouldn’t even be the default; making any of the location data available publicly is just terrible. If you want to share an individual workout map so you can say you circumnavigated Manhattan or whatever, fine! Share that one workout with your friends! (And ideally as a freaking screenshot rather than some database) Anything else is far too risky.

Risky for what? It's just a bit of fun. Most of us aren't being pursued by stalkers or assassins.

It doesn't need to be anything nearly that dramatic as assassins, because economies of scale both lower the bar and make most attacks impersonal. Consider how odd it would be for someone in 2025 to say: "Computer security?I haven't done anything to personally offend a genius hacker."

Imagine this data going to a burglar, who has a digital dashboard of nearby one-person properties and when the owner is likely to be out, able to act with confidence they can leave before the victim could return.

Sure, sophisticated international hitmen won't have any interest in catching you in ambush... but that doesn't make you safe from a local rapist of opportunity.

What a weird comment. The type of low-end criminal who commits home burglaries aren't sophisticated enough to do that level of research.

do you have any evidence to back your claim? gangs employing teams of underage burglars assisted by risk averse adults with skills for entry and targeting are a thing. everyone has a mobile phone.

With the new crop of agentic coding tools, you can whip up such an app in a few hours for all burglar buddies to use.

They are. A related example is criminal gangs tageting gun owners in France after the dataleak at the sport shooting federation. This one has been well covered. There have been a few hundred targeted robberies (on old people mostly) and one or two deaths (predictably).

In Western Europe there are also foreign burglar gangs that go on sprees for a few weeks. They're well organised but don't have time to do the stalking. They use publicly available data as much as they can.

Low-end criminals fish based on data leaks all the time. More data, especially cross-referencable data, will make this ever easier.

They'd buy access from someone on the dark web for $5 a day.

I'd recommend reading 'Confessions of a Master Jewel Thief' -- normal dude, just decides to spend a career stealing shit for fun.

> Most of us aren't being pursued by stalkers or assassins.

Most of us, but for those that are...

However, in the world we live in today, the various LEOs are using this type of data to find people they do not like. It's getting to the point that I pine for the days of good ol' 1985 where you could just be another anonymous person in public with no tracking of your every move.

Fwiw, from the people I know using Strava, it's less about the sharing/reading other's efforts aspect that makes them use it, and more because of the analysis, dashboards and stuff like that.

Yes, all of which can be purely personal and not shared beyond the device.

Sure, but many people want to use Strava for more than one purpose.

a) Analysis and tracking of your own personal goals. (Some of the tools are better than the stuff available on the device itself.)

b) Sharing and socialising some other activities.

You can be careful and only allow certain activities to be public but you'll make mistakes and eventually many people will just think "whatever, I'll just default to public and remember to hide the ones I don't want to be public" and then it's even easier to make mistakes.

Defaulting to "opt-in" is all well and good until a human makes a mistake.

imho with unusually sensitive things like precise location data it could just not let you opt-in to making it all public, and make it much easier to share with a specific named friends than to share on a public directory

I really don't understand these criticisms of Strava, it has excellent privacy controls so you can share as little or as much as you want. You can already choose to share your activities with only your friends (followers). Or keep your activities private or hide the location data.

Strava has had a lot of privacy issues over the years, particularly with stuff like flybys.

It does but my point is that your settings are applied to all activities.

Here's a few examples that might help demonstrate my point:

I used to do parkrun regularly. I had no problem sharing my Strava activities for parkrun because me doing it wasn't a secret, nor was the location secret, nor was my time secret. All of these things could be found from the parkrun website once the results had come up. John Doe was at this location at 9am and ran this route with 400 others in a time of 26 minutes or whatever.

I was also part of a cycling club that did a regular "club run" on a Sunday. 5-15 of us all doing the same route. It was good for club morale for us all to upload our rides to help show how popular it was and encourage other club members to come along. They could see that we weren't going at a silly pace and that we stopped regularly to regroup as we had riders of all abilities and speeds riding with us.

But then I also helped out with my kids running club at school, taking a bunch of 7-11 year old's on a 20 minute jog/run (depending on how quick they were) around the local area. This absolutely should not appear on Strava (public or not). The running club wasn't a secret (everyone at the school knew since they had the option of letting their kid do it) but that's a whole world of difference from having it public on Strava showing the usual start time, the various routes we used to take, where we stopped, etc. Privacy zones can help hide the start/end but that wouldn't help hide everything.

We just made sure that all of the parents who helped out knew that we shouldn't even record it with their smartwatch. I just used to create a manual entry of "Morning run" with approximate distance and time. That was good enough for my training stats.

There's no one privacy setting that handles all of this. Whatever setting you use relies on me to manually adjust the activities that don't fit that setting. The problem is that humans are fallible, so remembering to make it private or hide the location data isn't entirely reliable. You're also at the mercy of Strava (or whatever) not doing something stupid and accidentally making private data visible due to some bug, glitch or leak.

Right, requiring human intervention to share a run (other than maybe with eg a specific small circle of mutual friends) seems like it solves all those problems, other than perhaps being annoyed that you forgot to manually share a run.

But at least that's a failure you can fix once you notice, as opposed to making something public that shouldn't have been. Letting people opt in to automatically sharing runs to the public just seems like something designed to get people to share stuff without thinking about it.

You can already do that with Strava if you want to. Just make activities private by default, or don't sync it to Garmin and upload the files manually.

I'm saying something a bit different: that even letting people opt in to sharing every run they track publicly is just asking for trouble. It's setting people up for their information to be made public when they forget to turn it off or that they turned it on in the first place.

Maybe "automatically share everything to the globe" should just not be an option for sensitive data like this.

For me it's both. I compare my runs on routes and segments going back years. The social part is nice to share info about trail conditions and see when my friends hit a big effort or PR.

> and more because of the analysis, dashboards and stuff like that

Which is weird, because if they bought a Garmin device, they already have all that built in.

Which if you've ever had a Garmin device + tried Strava, you'd realize that perhaps Strava provides additional insights on top of what Garmin provides?

Genuinely not sure what insights they provide that you don’t get out of the box from Garmin.

The social stuff is nice though.

> Genuinely not sure what insights they provide that you don’t get out of the box from Garmin.

Genuinely weird to make statements like "they already have all that built in" if you don't even know what Strava provides, don't you think?

I’ve been using both for ~7 years so I’m pretty familiar with them…

No but every damn thing seems to be that way by default, so we are expecting everybody to opt out rather than opt in most of the time

I agree with you ... but gotdamned if I don't see another unasked-for shared workout stat.

I have the family exercise group on mute, lol

Ships often have welfare networks, basically vanilla internet access for people to use to keep in touch with their families etc while deployed.

Quick note that at least since WW2 there has been a technique where you know that the enemy is recording the location of something. So you add an offset to the signal they receive. Then they know where the thing is, but actually they do not. This was done with V2 missiles where the navigation system had a tendency to drift slightly one way (forget if it was north or south). British reported V2 strikes as occurring where Germany would expect them to occur if that navigation drift hadn't happened. Result Germans never fixed their navigation system.

I think the navigation system was OK, we just said the impacts were further West than they actually were so the V2s fell on East London instead

To be pedantic: I think the actual story is about V1 drones. They did not have a navigation system as such, they were just aimed in a certain direction and with the right amount of fuel to fall out of the sky over the target.

The British noticed that V1s aimed at London tended to fall a little short. This would have been to the South and East of London since that's the direction they were coming from. They reported more hits on the North West of the city, expecting correctly that Nazi spies in Britain would let the Luftwaffe know about this.

So the range was decremented further, meaning even more hits on the southern and eastern suburbs, but statistically fewer people killed and buildings destroyed as the mean moved to less populated areas.

The CdG incident is a little more serious given that about 90% of attacking a ship is figuring out where it is. Land bases don't move around and tend to be known already.

TBF a carrier group cannot be hidden from near-peer adversaries. I remember seeing a project that used CV with open data sat providers that could find smaller boats than that. (iirc they used a wake classifier, as that was the most obvious tell, even if the boat was small enough to not have enough pixels for identification).

Pretty sure they'd light up on basic yacht radar too.

There was one in Antarctica too.

I agree with Ukraine, but only when it comes to the first two or so years of the war, by now most of those that didn’t respect those rules (I’m talking both sides) are either dead or missing some limbs. With that told, just recently the Russian MOD has started applying heavy penalties to its soldiers close to the frontlines who were still using Telegram and/or the Ukrainian mobile network (?!), so it looks like there are still some behaviors left to correct.

TG ist another case. This is more a crackdown on the uncensored internet. My guess Ukrainians are also using TG without problems.

It's also a morale issue. It's easier to get people to huddle in a cold and damp hole if they can play video games and watch anime.

anime?

A style of animated TV show from Japan

What's a modern war fighter do without PreCure?

You may know it as Japanimation.

It's not a "cold, damp hole", it's called my basement, and there's also Dr. Pepper.

How many Russian deserters does it take to change a basement lightbuld?

I don't know either, must be more than 24 though because it's still dark as shit down there.

In my day, playing video games and watching anime didn't imply a network connection.

Boy, do I have news for you!

But joking apart, almost everything is connected and calling home these days...

LAN parties were popular in the late 90s

Normies used to deal in binders full of pirated music and movies. Then for a time they got into portable hard drives, but gradually this culture of media ownership was lost to the streaming services. Now your average normie doesn't know what a file is, wouldn't know where to put or what to do with a media file and only thinks of "apps".

Another interesting development is the ridiculous amount of background bluring in photos. Turns out you can find surprisingly large number of garages, warehouses, treelines, etc based on a single photo.

Geoguessr stuff can be mind blowing. Being able to identify down to the county from some random sky and corner of a power pole type stuff

The Russians are having problems with Telegram because their own military comms don't work.

Russian units have requested fire support via telegram.

Different military but if those at the top of the chain of command can't even help themselves when it comes to secure communications (Signal app, cough) it's hard to blame soldiers.

It's this kind of incident that gives me faith that the military isn't hiding aliens and in fact pretty much any grand conspiracy that requires secrecy across a large group of people for long periods of time can pretty much be dismissed immediately.

One of my favorite examples are the soldiers who leaked classified information to win arguments on online forums [1]. Similar incidents have occurred with a Minecraft Discord [2].

[1]: https://www.bbc.com/news/technology-65354513

[2]: https://www.ign.com/articles/how-classified-pentagon-documen...

Are you familiar with the latest news regarding Havana syndrome?

Yes [1].

[1]: https://news.ycombinator.com/item?id=47341984

Wow, I admire your confidence. These folks came on TV to tell you what they felt, saw, and heard with their own bodies, and the cover-up they say at the agencies too [1], and you still think it's fake? If the story gets confirmed will you take back anything you've said, give how confident you are of this?

And are you also aware of the mystery weapon in Venezuela, which clearly corroborated the story? [2]

[1] https://youtu.be/C1jmAj9OUOs

[2] https://www.rusi.org/news-and-comment/in-the-news/did-us-dep...

What are some instances of a large group of people hiding something for long periods of time and then getting found out? Snowden? Epstein? Are these cases the bulk of the conspiracies or is it the tip of the iceberg? I'd like to think it's the latter, for purely egocentric reasons: conspiracies stimulate my imagination like almost nothing else: keep them coming, please.

Snowden was a good one. A similar leak was a big deal when I was a kid

https://en.wikipedia.org/wiki/ECHELON

Established in the 60s so it was kept pretty secret for a long period of time.

It's interesting to think that the government has been using technology to watch us for awhile but now thanks to ubiquitous networks, cheap internet, phone and apps like tinder and strava and a bit of ingenuity, we can watch back. :)

Wow, that is a good one. I'm surprised that I've not heard of it. Maybe not admitting something officially really does help in keeping something out of press. The list of intercept stations is comic: all except ~4 are in US or allied countries that are far from any adversaries.

MKUltra was another government program that was widely run but kept secret.

Not so fun fact, the UnaBomber was one of the subjects of that program and it is said that his personality changed drastically afterwards. Note his wiki page doesn't call out MKULTRA or government links by name...

https://en.wikipedia.org/wiki/MKUltra

https://en.wikipedia.org/wiki/Ted_Kaczynski

https://www.counterpunch.org/2023/06/12/the-unabomber-the-ci...

There are some who claim the dirision associated with the term Conspiracy theory is in fact a Conspiracy..

https://www.google.com/url?sa=t&source=web&rct=j&opi=8997844...

Unabomber-CIA connection is wild. This is great stuff.

> There are some who claim the dirision associated with the term Conspiracy theory is in fact a Conspiracy..

Haha, that's entertaining. I've heard of quite a few stories, some proven, that CIA or similar agencies were fabricating evidence and bribing people to _create_ conspiracy theories. I believe one such case was a diary discovered related to "Richard E. Byrd's North Pole Flight". If I recall correctly the person that found it later admitted that he was bribed or coerced to do so. I can't look up sources now, might try and look it up later today.

It makes sense. If conspiracies are leaking, you can create fake leaks and then discredit them. Shaming and marginalization is great too.

SkyECC

Another instance is one darknet market being taken down by Dutch police. They were also in full control of the next biggest market where they knew everyone would flee to, and they spent some time monitoring all comms on that second site before intervening.

To add to your point, the War Thunder leaks aren't isolated to one or two incidents; they keep happening! IIRC, every UN security council member has had classified military documents leaked multiple times. Regarding aliens, there's just no way that an E-4 wouldn't have posted dozens of pictures to prove that 'The Grays' are actually more of a purple color.

Most of the War Thunder leaks just aren't. What frequently happens is that people go and dig up a manual that's published openly in America but controlled under ITAR (I think), post it, and Gaijin delete the post and ban them because it's technically illegal to "export" the information and trying not to get involved in crimes is usually a good idea.

Then, because "someone's leaked classified data on War Thunder again!!!" is a standard story that you can publish with zero effort and get lots of clicks on, people post formulaic articles about it. But it's nothing that would be of any use at all to actual spies, they can just go on the internet and read the manuals themselves. Nothing like as spectacular as the actual classified leaks, which were incredible but have not been anywhere near as common as people think based on reporting.

Even if you could fix egregious cases like directly sharing location, I'm pretty sure any access to the internet could be compromised via clever use of data brokers.

COTS smartphones should be banned in all schools and military forces/buildings, for a million different reasons. Probably hospitals (for staff) too.

For schools and hospitals, why specify COTS? Do you want SOTS for schools and HOTS for hospitals just like we have MOTS?

One would think on a military ship they could just jam civilian cell phone frequencies and not have to worry about individual behavior.

Surely this is a disciplinary problem? Why is it difficult to stop? What reason is there for having a personal device linked to a public network and publishing data to a public forum when on military duty?

Seems like the on ships and remote locations, IT could pihole Strava, Tinder, etc.

one more reason for open, adaptible, and secure mobile operating systems.

Even if it would gain mass adoption, how is that preventing end user to bypass the defaults and install some leaky app?

in this case: a distribution with hardened security for military purposes. for example, completely disabled location services, encrypted communications only, etc. + forbid use of unapproved mobile devices while on a sensitive mission.

Reply on news.ycombinator.com