When he finishes his working day Alexandre – not his real name – climbs onto the saddle of his beloved black carbon fibre-framed racing bike to head for home. Once past the gates of his workplace in the centre of Bayonne in south-west France, he turns right down Rue Maubec, hurtles past the railway station and a nearby floral roundabout and cafes, before hanging a left over Saint-Esprit bridge which straddles the River Adour. From there he cycles for just under an hour to cover the twenty kilometres to his home in a quiet village in Basque country. Alexandre has one son who is too young to cycle himself, but whom he sometimes takes for little walks in the surrounding countryside.
Alexandre is a soldier in France's special forces. The workplace to which he travels by bike is the Citadelle de Bayonne where the 1st Marine Infantry Parachute Regiment (1st RPIMa) is headquartered. Given his sensitive work, information relating to his private life as well as the operations he is involved in should not be widely accessible to people – especially not to potential terrorists who might choose to target him.
Yet by using the fitness app Strava, which charts his cycling sessions, Mediapart was able to find out more than just Alexandre's profile and his movements in France. In November 2019 the soldier was also geolocated at a football match at Erbil in the Kurdish region of northern Iraq. Indeed, his Garmin Fenix 3 watch recorded all his journeys. In August 2018 he was located by Strava cycling at a French special forces base north of Ouagadougou in Burkina Faso. Two months later he was putting in some exercise sessions close to the airport at Timbuktu in Mali.
These three countries are among the most sensitive areas in which French soldiers currently operate. The jihadist groups who operate there regard them as particular targets. Just last month, on November 30th, three French military bases in Mali were attacked by a local offshoot of Al Qaeda.
The French military is aware of these risks and has banned soldiers deployed on operations abroad and especially members of its special forces – the elite units taking part on the front line against jihadist groups in the Sahel region of North Africa – from leaving personal or sensitive information online. Yet within just a few hours and using only public data, Mediapart was able to compile an impressive number of details about special forces soldier 'Alexandre'. These include his home address, the cycle and walking trips he makes and the places where he has been sent on operation in the last two years, plus his name, his partner's name and that of his son, as well as three photos of the three of them.
Five years imprisonment
What makes the discovery of this information more surprising is that the anonymity of elite troops is protected under French criminal law. Law 2016-483, dated April 20th 2016, provides for a maximum sentence of five years imprisonment and a 75,000 euro fine for “revealing or divulging, by any means, any information that could lead, directly or indirectly, to the identification of a person as a member of special forces units”. In passing this law the French Parliament did not perhaps foresee that this sensitive information would be widely shared by the soldiers themselves.
For 'Alexandre' is no isolated exception. In total, Mediapart found more than a thousand Strava profiles that probably belong to French soldiers. Out of these thousand profiles close to 200 belong in all likelihood to members of the special forces. To find these elite troops we listed the profiles of people taking part in sports exercises who are geolocated inside two bases of French special forces regiments: the 1st RPIMa in Bayonne and the 13th Parachute Dragoon Regiment (13th RDP). Their sports activities in France were regularly followed by a transfer to operations abroad, particularly the Sahel.
The more than 800 remaining profiles are those of soldiers who have been deployed in overseas operations, geolocated inside French military bases in Mali, Niger, Burkina Faso, Syria and Kuwait, without it being clear whether they are special forces or part of regular military units. Apart from their geolocation, the majority of these soldiers have – like Alexandre – left a certain amount of sensitive information on social media; names, photos, information about people close to them and even their home addresses.
The list of Strava accounts identified by Mediapart was sent to the Ministry of the Armed Forces two weeks before the publication of this article, to give the soldiers concerned time to delete personal or sensitive data.
Contrary to all orders and recommendations
These practices go against the orders and recommendations of the Ministry of the Armed Forces on the issue. The 'Guide to the correct use of social media' that the ministry in theory gives to all its employees is unambiguous. “Any broadcast of content (text, photos or videos) relating to your professional activity and/or to that of the Institution on social networks can be a threat to the security of defence personnel, of operations and of their success,” it warns.
As a result the ministry gives a list of recommendations. “Don't mention your status as military personnel,” it says, pointing to the posting of photos in uniform as an example. “Don't give private information (postal address, telephone etc)”, “don't use geolocalisation or identification on published photos” and “don't talk about your missions … or your timetable, even partially”.
Enlargement : Illustration 2
Soldiers on operation, says the document, must “deactivate the geolocalisation on their smartphone” and they are reminded that “any publishing of photos and videos giving information about the camp (entrance, exit, layout etc) and missions (maps, equipment, screens, planning etc) is forbidden.” It appears that these instructions are not always heeded.
In searches on Instagram, Mediapart was able to find more than 1,500 photos and videos taken by soldiers involved in Operation Barkhane – which targets armed jihadist groups in the Sahel – that were posted between 2017 and 2020. They sometimes reveal details of the equipment being used by French forces, the layout of the inside of their camps and where they are based.
This was the case with 'Miguel', not his real name. At first glance his Instagram account is mainly a long succession of selfies in fatigues or civilian clothes. But put together and examined closely his hundreds of photos enabled Mediapart to discover his surname, his regiment (the 2nd Foreign Infantry Regiment of the French Foreign Legion), his company, his rank, his precise position, the place and dates of just about all his holidays since 2017, as well as photos of his partner and of the family of some of his military colleagues.
Enlargement : Illustration 3
Even more sensitive was his posting of a detailed video of the interior of a plane transporting troops and equipment and of a Mirage fighter aircraft stationed at the French military based at Niamey in Niger, plus photos which show the guard and protection measures deployed around the French military camp at Gao in Mali. While he is sometimes careful to switch off his geolocalisation, details in his photos can sometimes betray his presence in particularly sensitive areas. That is the case with one image posted on May 19th 2020:
Enlargement : Illustration 4
The shop sign above the soldier shows that he is in the community of Tin-Akoff in the north of Burkina Faso. It was in this same community on November 11th 2020 that Islamic State claimed responsibility for the killing of 14 Burkina soldiers – who have been working with the French against jihadist groups – in an ambush.
'Orders were given to ban the use of certain connected devices'
Indeed, in the Sahel region of North Africa French soldiers, along with their allies from Mauritania, Burkina Faso, Mali, Niger and Chad, are seen as particular targets. As mentioned earlier, on November 30th 2020 three French military bases at Gao, Kidal and Menaka in the north and east of Mali were targeted by rocket fire, though there were no casualties. Responsibility for the attacks was claimed by a Sahel offshoot of Al Qaeda.
“The French and in particular French soldiers are permanent targets for the jihadist movements, who make regular calls to arms against the French presence and set out theological justification for the violence against them,” said Yvan Guichaoua, a lecturer in international conflict analysis at the Brussels School of International Studies, part of the University of Kent, and a specialist in armed movements in the Sahel. While it is rare that they launch head-on confrontation against the better-equipped French forces, they use “techniques of intimidation (like the rockets recently launched at Gao, Kidal and Menaka), put improvised explosive devices (IEDs) under passing convoys and adopt tactics that allow them to strike without exposing themselves too much.”
Given this context, could these groups make use of information put online by French soldiers? “Most of the information that they collect, in order to target patrols for example, comes from informers on the ground. They already know where the French bases are,” notes Dr Guichaoua. “But what is perfectly conceivable is that the put online the identities of the soldiers they have found online and say to their supporters 'We've identified these people here as being involved in operations in Mali, go and take care of it',” he says.
Nor is there any real technical obstacle to such groups finding this kind of personal information on a large scale. “The ability and expertise is probably there,” says Dr Guichaoua. “And even if it isn't there in the hard core of the group that's going to carry out the attacks, we know that they have sometimes contacted intermediaries further away (for example the Middle East) to ask for help or to subcontract the work of analysing the data.”
In October 2014 the Islamic State in West Africa (ISWA) asked Islamic State for advice on how to use some equipment stolen from the Cameroonian army (see analyst Vincent Foucher's report on this here). In particular IS provided a video tutorial on how to assemble and use a captured drone.
Enlargement : Illustration 5
Several warnings
The apparent inability of the French Ministry of the Armed Forces to deal with the problem of online personal data is even harder to understand given that it has already received several warnings over the issue. In 2018, after an initial series of revelations concerning the use of the Strava app by French and American soldiers, the general staff had assured the media that “internal reminders” had been issued over the “need to respect the basic security rules for information systems” and in particular to “deactivate geolocalisation and GPS functions”.
Two years later these “internal reminders” do not seem to have been particularly effective and the general staff remains evasive over the measures that have taken to stem the problem. The general staff declined to tell us if they had been aware of the existence of the profiles found by Mediapart, as well as the Instagram posts by soldiers involved in Operation Barkhane. But they insisted that the military was “committed to making the soldiers aware before every deployment” through their social media guide and “tutorials”.
On top of this “raising of awareness”, stricter orders have also been issued to soldiers, said the general staff. “Orders have been given banning the use of certain connected devices, whether they are inside military enclosures or outside,” the general staff told Mediapart in an email on December 3rd. “At the same time these same orders prohibit the publication of any digital material (photographs, exercise routes in particular and all metadata in general) linked with the forces deployed.” The ministry did not respond to Mediapart's questions about what punishment soldiers who do not respect the orders have received or will receive, and how it can explain why the orders have clearly not always been respected.
The delicate issue of recruitment
The problems that the French military's general staff have faced in keeping their troops in line perhaps stem from a simple reason: the high number of people they employ (268,000 employed by the Ministry of the Armed Forces in 2020) coupled with the high turnover of personnel. “The armed forces have for some years taken on board the need [for military personnel] to have digital hygiene. But you mustn't forget that the military in France has several hundred thousand people,” said the Member of Parliament Thomas Gassilloud, who is the co-author of a 2018 report on the challenges of digitalisation for the armed forces. “The educational effort has to be permanent because there are new recruits every year.”
“Some soldiers just don't give a damn, they say it only happens to others and think they're invincible,” said one French soldier who has taken part in Operation Barkhane and to whom Mediapart spoke.
In reality the issue is not just about the armed forces permanently training its new recruits. It is also about not putting off those who have just joined as well as potential applicants. The soldiers' commanding officers know that taking drastic measures – restricting access to the internet for example – would be running the risk of losing some soldiers along the way. At a time when the French military has to recruit massively - 16,000 new recruits for the army alone in 2020 – and in particular among the young, the prospect of long months without a mobile phone is not a very strong selling point.
In an interview with defence journalists in 2017, the minister for the armed forces Florence Parly appeared to concede this, when she noted that the presence of wi-fi in military accommodation was necessary in order to maintain the “attractiveness” of the military as a career. A year later internet access was one of the main features of the ministry's 'family plan', under which a sum of 500 million euros was earmarked to help improve soldiers' lives. The two commitments on the internet were: to supply free wi-fi in all garrisons and to improve internet access for soldiers deployed in overseas operations. In June 2018, in its first assessment of the plan, the French government congratulated itself on the fact that it was paying for packages of 2G of data a month for soldiers deployed abroad.
The public Facebook account of the defence minister's deputy chief of staff
The problems posed by careless use of the internet are not, however, the sole preserve of young recruits who grew up with Snapchat, TikTok and Instagram. Using Strava, Mediapart has also found around a hundred profiles that very likely belong to employees at the Ministry of the Armed Forces in Paris, having been geolocalized at the ministry's headquarters at the Hexagone Balard in the south-west of the capital. By cross-referencing this list with data from Le Journal Officiel – the state journal which publishes the appointments and promotions of some officers – Mediapart has been able to identify twenty-three officers present on social media under their real names. This list includes two colonels, three lieutenant-colonels and seven majors. Like the other military personnel they, too, have left a certain amount of sensitive data on Strava. It was therefore possible for Mediapart to find the personal addresses of the two colonels.
We also found the public Facebook page of the deputy chief of staff to armed forces minister Florence Parly, which included family photos. Yet the 'Guide to the correct use of social media' recommends the use of a pseudonym on social media, and to avoid posting in 'public' mode. Questioned about this, the minister's office told Mediapart that even though the ministry encouraged its staff to use “a form of digital discretion”, members of the minister's office are “authorised like other public officials to have private accounts on social networks”. A few days after Mediapart sent questions on this, the photographs - as well as other personal information - were deleted from the profile in question.
-------------------------
If you have information of public interest you would like to pass on to Mediapart for investigation you can contact us at this email address: enquete@mediapart.fr. If you wish to send us documents for our scrutiny via our highly secure platform please go to https://www.frenchleaks.fr/ which is presented in both English and French.
-------------------------
The original French version of this article can be found here.
English version by Michael Streeter