Mon Jan 1, 0001

Strava Heat Map, Fitness Trackers, and Health Data Privacy

Strava Heat Map (January 2018)

Strava published global heat map (November 2017) showing 3 trillion GPS data points from users. Went viral January 2018 when Nathan Ruser (20-year-old Australian National University student) posted analysis showing the map revealed:

  • Locations and layouts of military bases in Afghanistan, Syria, Djibouti, Niger
  • Patrol routes and exercise patterns at forward operating bases
  • Locations believed to include CIA black sites and classified facilities

Personnel movements visible because soldiers/agents used Strava while exercising. Pentagon issued guidance early 2018 directing deployed personnel to review privacy settings. DoD later implemented stricter policies on geolocation devices in operational areas.

Fitbit / Google

Google acquired Fitbit for $2.1 billion (completed January 2021). Fitbit collects: heart rate, sleep patterns, step counts, GPS exercise routes, menstrual cycle data, weight, SpO2 levels. Fitbit is NOT a HIPAA-covered entity.

  • 2015 (Lancaster, PA): personal injury case — plaintiff’s Fitbit activity data used to challenge claims about physical limitations
  • 2016 (San Jose, CA): Fitbit data used in connection with sexual assault investigation involving reported activity levels

Apple Watch in Criminal Cases

Richard Dabate murder trial (Ellington, Connecticut, 2018/2022): prosecutors used wife Connie Dabate’s Apple Watch data (heart rate, movement) to contradict husband’s account of home invasion. Data inconsistent with his timeline. Convicted 2022.

Period Tracking Apps Post-Dobbs

Pre-Dobbs

Flo Health: WSJ (February 2019) reported sharing intimate health data with Facebook’s analytics tools. FTC settled with Flo (June 2021).

Post-Dobbs (June 24, 2022)

Concerns about law enforcement subpoenaing menstrual data to prosecute abortions.

  • Flo announced “Anonymous Mode” (2022)
  • Clue (Berlin, GDPR-protected) and Natural Cycles issued data protection statements
  • Stardust saw download surge but privacy policy scrutinized

Actual Prosecutions Using Digital Evidence

No confirmed case of law enforcement subpoenaing period app data specifically to prosecute an abortion (as of mid-2023). However: Nebraska case (2022) used Facebook messages (not app data) as evidence in abortion prosecution.

Sources

  • Nathan Ruser Twitter analysis (January 2018)
  • Pentagon guidance (early 2018)
  • Google/Fitbit acquisition (January 2021)
  • WSJ on Flo Health (February 2019)
  • FTC v. Flo Health (June 2021)
  • State v. Dabate (Connecticut, conviction 2022)