ARI SHAPIRO, HOST:

The U.S. works hard to keep the locations of sensitive military outposts secret. And over the weekend, military analysts noticed that maps created with data from a fitness tracking app outlined these bases in precise detail. The company Strava posted what it called a global heat map of where its users exercise all over the world. And in a place like Syria or Djibouti, the people who count their steps every day tend to be Westerners.

Paul Scharre is with the Center for a New American Security, and he's also worked at the Defense Department and served in Iraq and Afghanistan. Welcome.

PAUL SCHARRE: Thanks for having me.

SHAPIRO: Since we're on the radio, can you just start by describing what one of these maps looks like?

SCHARRE: Well, from a distance, you might - if you looked over, for example, Syria, you might just see darkness. And as you begin to zoom in, you can start to see little pinpricks of light. As you go in closer and closer, you'll see a colorful loop, red and orange kind of colors mapping out patterns of where people have been jogging. And people have, you know, looked at those and been able to piece together, wow, this looks like maybe this could be a military base.

And in some cases, people have then been able to use these pinpricks of light to zoom into these parts of maps and actually identify, using photos from Google Earth or some other means, actual military installations and hardware.

SHAPIRO: And it's not just running routes. If somebody is tracking their steps all day long, it shows how they get to and from work, where they go after work, all that.

SCHARRE: Yeah, so even more troubling from the military standpoint, you know, the locations of bases are probably known to others in the area. It's hard to hide a military base. But these maps also capture things like in some cases, patrol routes or patterns of activity of people inside bases, which could be much more sensitive information.

SHAPIRO: I could imagine people listening saying, who would be stupid enough to let a tracker follow them on their patrol route if it's supposed to be sensitive information?

SCHARRE: Yeah, probably no one intentionally. I mean, I think we've all had these experiences of working with technology and you find out that your data's being used in some way or you're sharing via your phone some information that you didn't realize you were. It's tracking your location. I mean, I would imagine that most of us would be shocked by how many apps are tracking your location and sharing that information somewhere.

SHAPIRO: If you were, for example, an aid worker in South Sudan and you saw your whole daily routine mapped out over the weekend, how worried would you be?

SCHARRE: Certainly if I was someone like an aid worker in a hostile place, I'd be very concerned because those are groups that are, you know, potentially subject to kidnapping by terrorist groups or criminals who might want to ransom them and don't have the same kind of protections that military service members would have.

SHAPIRO: So what would you do if you found yourself in that situation?

SCHARRE: I mean, the biggest problem is right now it doesn't appear that there's a way to go back in time. So you could disable the sharing on your app, but that doesn't change the fact that the data is already out there. Now...

SHAPIRO: You can't move every U.S. military base 50 miles in one direction or another.

SCHARRE: Yeah. So it would be great if this company would work with users to allow a retroactive deletion of data. It's not clear how technically, you know, difficult that would be. But that would be something that they might be able to do if they were serious about protecting user privacy. But also, you know, for a lot of groups in military and otherwise, they're going to have to think about ways to, you know, change their routes, change their patterns of activity and maybe even change their locations.

SHAPIRO: I understand today the U.S. military said they're planning on doing something about this. What can they actually do?

SCHARRE: I mean, in the near term, you can put in rules that say, OK, listen everybody, you've got to disable these kind of features. More broadly, the military will take a harder look at geolocation data in general and how it's shared. But this is, I think, a broader problem of transparency that's more than simply one-off kinds of issues.

SHAPIRO: So if I run the Clandestine Service of the CIA and I have who knows how many agents out in the field, I mean, has a vast number of them all just suddenly been compromised?

SCHARRE: I would imagine that's something that they're looking into right now.

SHAPIRO: And how scared should they be about that?

SCHARRE: I think it's too early to tell. It's not clear how - what the consequences are. The locations of the bases themselves may not be as serious as certainly things that might identify individuals.

SHAPIRO: Paul Scharre directs the Technology and National Security program at the Center for a New American Security. Thanks a lot.

SCHARRE: Thanks. Transcript provided by NPR, Copyright NPR.