A 7-KILOMETER RUN ON A FLIGHT DECK EXPOSED FRANCE'S SOLE AIRCRAFT CARRIER TO THE WORLD
Le Monde Journalists Cross-Referenced Public Strava Data with ESA Satellite Imagery to Track the Charles de Gaulle Strike Group in Real Time — Northwest of Cyprus, 100 Kilometers from the Turkish Coast
Nathan Ruser spots U.S. bases on Strava heatmap in Syrian desert
Pentagon bans fitness trackers in designated operational areas
Fake Strava segments planted inside 6 secret Israeli bases
Russian sub commander assassinated after route tracked via Strava
Le Monde traces bodyguards of Macron, Biden, Putin via Strava profiles
Nuclear submarine patrol schedules deduced from fitness data gaps at Ile Longue
Aircraft carrier Charles de Gaulle located in real time
On March 13, 2026, at 10:35 AM, a French Navy officer identified by Le Monde as "Arthur" strapped on his Garmin Forerunner 955 and went for a run. He completed seven kilometers in thirty-six minutes — a pace of roughly 4:58 per kilometer — running tight, repetitive loops with no surrounding roads or landmarks visible on the GPS trace. The pattern was unmistakable: someone running laps on the flight deck of a warship at sea. His Strava profile was set to public — the platform's default — and the GPS coordinates embedded in his activity were visible to anyone with an internet connection.
"There's a big difference between using nation-state resources like spy satellites, and using a public API exposed by a fitness app. Not everyone can use spy satellites. But anyone can use Strava."— HN commenter, March 21, 2026
Le Monde's investigative team, led by open-source intelligence reporters Sebastien Bourdon and Antoine Schirer, cross-referenced the GPS coordinates from the activity against European Space Agency satellite imagery taken approximately one hour later. The satellite image showed the distinctive outline of the 261.5-meter carrier roughly six kilometers from where the run was geolocated — consistent with the ship's movement during that interval at her cruising speed of 27 knots.
The carrier was positioned northwest of Cyprus, approximately 100 kilometers from the Turkish coast. But the exposure didn't stop at a single data point. By examining earlier activities on the same sailor's account — runs logged off France's Cotentin Peninsula and in Copenhagen — the journalists reconstructed the entire transit path of the Charles de Gaulle strike group from the Baltic Sea to the Eastern Mediterranean.
The strike group exposed includes not just France's sole carrier but its full escort: two air defense frigates, one FREMM multi-mission frigate, the replenishment ship Jacques Chevallier, and allied contributions from Italy, Spain, and the Netherlands. The carrier's air wing — 20 Rafale Marine fighters, 2 Hawkeye E-2C early warning aircraft, and 3 helicopters — was operationally compromised by a single public fitness profile.
A critical technical subtlety makes this vulnerability insidious: GPS watches do not require cellular service. They need only line-of-sight to GPS satellites, which is always available at sea. The recording happens silently on the wrist. The upload to Strava occurs later, whenever the watch syncs to a phone with connectivity — likely via the ship's satellite internet, provided for crew welfare. The data pipeline is: satellite → watch → phone → Strava → the world. No firewall on the ship's network can intercept a GPS trace that was recorded passively and uploaded as a standard HTTPS request.
The French Armed Forces General Staff described the incident as a "breach of operational security rules" and stated that personnel are "repeatedly reminded of digital hygiene, especially before deployment." But the same base where nuclear submarines are housed — Ile Longue — was first flagged for Strava exposure in 2018 by Le Telegramme, and again in January 2025. Eight years of "reminders" have not solved the problem.