The Method of the Investigation
The playbook is of a piece with the Strava incident that exposed US military bases a few years back: when crew members exercised aboard ship and in port, the fitness app recorded and published their tracks and check-ins, and reporters pieced this public data together to reveal the carrier's movements, port calls, and personnel patterns at a glance. No hacking, no insider, all from data users uploaded themselves that the platform makes public by default. Military confidentiality rules can control documents, but not the sports watch on a sailor's wrist.
The Lethality of Data Aggregation
This story's relationship to AI is closer than it appears: a single running record is harmless, but aggregated it's intelligence, and "aggregating sensitive conclusions from vast amounts of harmless data" is exactly what AI is best at. In the past such analysis required an intelligence agency's manpower; now one reporter plus a script is enough, and soon one model plus a prompt will do. The reminder for organizations is to bring "employees' consumer apps" into the threat model; for individuals, at least check the public scope of your exercise tracks once. Privacy rarely falls in one big leak—it usually falls in ten thousand "what does this matter."
via: Hacker News