Keeping your secrets is not an option

We need to stop being naive and accept there are few secrets we can keep from becoming public.

We are all in denial over what parts of our lives are open for the world to see.

In the age of data, we all leave footprints. Sometimes that’s a metaphor. Sometimes not so much.

For the past couple of months literal footprints have made the perimeters and internal paths of almost every Western military base wholly public. Nobody meant for this to happen. It’s not even anyone’s fault. Yet there they are, in Yemen, Somalia, Afghanistan, Syria, and almost everywhere else, lit up in red.

The mechanics of this cock-up are fairly simple. Strava is a social network for amateur athletes; a way of keeping track of your exercise. You connect a Fitbit, or a smartwatch, or a smartphone, and boom, you’re off. If you’re serving on any military base you probably know better than to allow it to upload the route of your daily run to your Facebook page, in much the same way that if you’re hiding in a hole behind Islamic State lines in Syria you aren’t going to Instagram your lunch.

Perhaps, though, it never occurred to you to turn off the feature that uploads data to the company’s server about where people are running. Perhaps you don’t even know it is there.

For Strava, this is useful information, even when anonymised, because it shows how many people run and where.

It was Nathan Ruser, a 20-year-old Australian student, who hit on the idea of scouring Strava’s public data for military bases after his father wryly observed that the maps showed “where rich white people are”.

In places like Djibouti, it turns out, there’s a strong chance you’ll find the rich white people jogging around fenced-off compounds that don’t appear on maps. Chances are they’re not all training for the Tadjoura half-marathon.

Not all footprints are so literal. Consider Donald Trump and his habit of tweeting in bed, as discussed during his interminable interview with Piers Morgan last week. It was already fairly obvious that he did this (the six-hour silence after his “covfefe” blurt was the clincher) and one upshot is that the whole world can now see more or less exactly what his sleeping hours are.

A friend of mine once likened it wearily to having a giant, horrible baby: you can only relax when you know he’s definitely gone down, but even then you’re already dreading whatever vandalous abomination he’ll set about committing the instant he wakes up.

It sounds trivial but imagine how hard it would have been for the KGB to have mapped the slumber of Richard Nixon. They would probably have had to bug a bedside lamp.

A drip here, a drip there, and privacy disappears. Last summer, when a friend was being harassed by another anonymous voice on the internet, I spent an idle 20 minutes trying to see if I could track down who he was. I could, and it was easy, because he had adopted the same username on a YouTube account where he posted cat videos for a nephew who called him “Uncle Andy”. Two minutes more googling and we had a full name and an address on the electoral roll, whereupon she told him she knew who he was, and he left her alone.

This — the breaking of internet anonymity — is called “doxxing” and is normally done with more malign intent.

Earlier this week we read about a bitcoin trader being robbed at gunpoint in an Oxfordshire village. He too had been doxxed, probably via customers using his real name in their approving feedback and his entry at Companies House.

The popular understanding of all of this is that someone, somewhere, is being a mug. Soldiers are mugs for wearing their fitness trackers, Trump is a mug for tweeting in bed, the troll and the bitcoin trader are mugs for slipping up. If we all just wised up, the thinking goes, and took control of our data properly, everything would be OK.

That’s rubbish, because we can’t. There’s just too much of it sploshing around. I had a mild shock the other day, checking the in-built history of something so innocuous as the speaker system we use to play music. Half my life was there, from the differing times I get up on weekdays and weekends, to the fact that I probably have kids (it gets fired up after school). If you could track the volume setting, you would probably even make a decent stab at guessing when my wife is home. Cross-reference all of that with my internet history, my Kindle reading history and the GPS location on my phone — let alone my messages and social media history — and I’m not sure there would be an awful lot of me left.

Reading about the Strava story, it’s the easiest thing in the world to condemn military folk, or whatever they are, for allowing this to happen. In truth, my hunch is that any security service could already have harvested the same sort of data 100 times over.

We’re all in denial about what we have become. We still kick up an almighty fuss when the health system, banks or the police want our personal information. Yet the rest of the time, via everything from websites to credit cards to apps to chips in our cars, we wander around blithely spraying the stuff everywhere.

Perhaps it’s the fact this is a relatively recent phenomenon that makes us assume instinctively there must be some way back. I’m not sure there is. We should probably just get used to it.

THE TIMES