Security experts cited in the investigation said Iran may have combined the location data with other intelligence to track movements of U.S. forces. Changes in activity may also have provided indications that American personnel were leaving some locations ahead of U.S. and Israeli military action in February 2026.
The potential security risk became more apparent after Iran began retaliatory attacks against U.S. bases in the Middle East on March 1. One case examined by Sky News involved the main U.S. naval base in Manama, Bahrain, where much of the personnel had been evacuated and some workers relocated to residential buildings and hotels.
A Strava account linked to a U.S. Navy contractor had regularly recorded runs around the base until about a week before the conflict, according to the investigation. After two days without activity, the account appeared again with runs around the courtyard of the Crowne Plaza hotel, which was attacked by Iran six days later.
Sky News reported similar patterns around Muwuffak al-Salti Air Base in Jordan, where U.S. personnel had previously recorded regular jogging routes. After a pause in March, activity resumed in April around barracks in the western part of the base, which was attacked on July 17 in a strike that killed three U.S. soldiers, according to official figures cited in the report.
The risks associated with fitness-tracking applications have been known for years. In 2018, the Pentagon warned that geolocation data could threaten U.S. military security after Strava activity exposed a previously undisclosed American base in Niger and revealed other U.S. positions in the Middle East.
The U.S. Defense Department subsequently restricted the use of geolocation functions on government-issued and personal devices in operational areas. The Sky News investigation found, however, that U.S. and British military personnel continued to publish activity that could reveal sensitive locations and movement patterns.
The investigation also detected Strava activity inside Israel’s Dimona nuclear research facility, including runs attributed to at least three soldiers. Iran has repeatedly attempted to strike the site, according to the report.
Similar concerns have emerged around British military facilities and nuclear forces. In 2022, personnel serving aboard nuclear-armed submarines at Faslane exposed names, addresses and periods spent aboard vessels after failing to apply privacy settings to fitness-tracking devices.
Sky News also identified about 12,000 workouts recorded inside RAF Akrotiri in Cyprus since January 2026. In France, at least 450 people with access to the sensitive nuclear submarine base on the Île Longue peninsula were identified as Strava subscribers in 2025, with gaps in their exercise activity potentially revealing submarine patrol schedules.
