Advertisement

Cyclists warned to beware sharing data on ride-tracking apps

Police and cybersecurity firms are warning cyclists to be careful with the data they share on ride-tracking apps because they could be helping bike thieves.

Peter Murtagh, from Dublin, is a keen triathlete - but recently had his top of the range racing and road bikes stolen in a daring, daylight raid on his house.

"I came downstairs and noticed one of my bikes, it was gone. That was in the front of the house," Mr Murtagh told Sky News.

"Little did I know, the thieves were still in the house, they'd got in with a crowbar, they broke three windows and they stole my second bike too."

Mr Murtagh cannot prove it, but thinks he might know why the thieves knew exactly where to look.

He had been using an app that logs cycling data, called Strava, to track his cycling speeds and compete against other users - but her did not realise his settings were the default ones - which are "public".

The setting meant that the start and end of his rides could easily be seen online. He had also recorded the make and model of his top of the range time-trial bikes.

"I've been using Strava for four years," he says. "I had… the two bikes listed. So anybody could log on to Strava, search my name, and they'd be able to find my exact location.

"I suspect Strava played a role in targeting me, as my bike's always locked in my house. So it seems the criminals were just after the bikes, that's all they stole."

Mr Murtagh has now changed his privacy settings - and says social media is not all bad - he managed to get his bikes back after posting about his loss on Facebook and Twitter.

:: US military to review security amid Strava fitness app fears

But his experience is not uncommon. Adam Lang is a police officer in Gwent - he says the force noticed a spike in bicycle thefts in January and February.

"The common denominator was high-end bikes," Mr Lang tells Sky News.

"We needed to contact the victims and see if we could find if there was any connection between them. And through those enquiries we came up with the fact these mapping apps were being used, not by all, but there were quite a lot of them.

"Due to the fact they were all high-end bikes and they were clearly targeted, we feel these mapping apps could be used to target these high-end bikes. Because looking at the maps, you could clearly see where these people had started their rides and where they'd finished them."

Mr Lang says cyclists need to be more aware of the problem when using any kind of tracker app.

"I think social media, that's been well advertised that you should have your accounts locked down and regularly check your privacy settings," he says.

"I don't think a lot of people were aware that these mapping apps can basically give a huge amount of information to a would-be thief. So we need to have people checking their privacy."

But experts warn that even with privacy settings on cyclists should be careful since apps can still be hacked.

Joel Windels, vice president of marketing at cybersecurity firm Wandera, showed us how thieves could use a feature - intended to help users by keeping home locations secret - to their advantage.

When Strava's "privacy zone" is activated, it masks where you start and end your cycle ride or jog, so the line on the map vanishes.

But Mr Windels says: "The problem is that by taking the points at which your run disappears, you can actually triangulate your location.

"If you look at three different runs that someone has done using the Strava app, you'll actually be able to draw circles round them, and if you enlarge those circles, where they meet is where that person is trying to keep secret."

So what should cyclists do?

Mr Windels says: "My suggestion would be to randomise your own privacy zone. So when you leave the house for your next cycle, perhaps turn it on 100 metres away from your home."

When Sky contacted Strava, it told us it had not seen any verified cases of bicycle theft related to its platform.

And it is reviewing its app to make sure some features cannot be used by those with bad intentions.

Meanwhile, though, bike campaign groups say it is up to cyclists themselves to check their settings on any ride-tracking apps they use, and be careful about what they post online in general.

Louise Gold, head of Behaviour Change at SusTrans, says: "Like with any social media, you need to be careful about where your information is going. So don't publish pictures of your flashy new bike to Facebook or Instagram.

"If you really, really must, then ensure your settings are private."