Virginia Police Caught an Assault Suspect Using His Strava Record

A cyclist speeds along a trail.
Your fitness-tracking app can tattle on you now.

On a Sunday afternoon in April, a Virginia man riding his bike on a popular trail outside of D.C. was seriously injured when a fellow cyclist reached out and hit him in the head.

The victim was taken to an area hospital; the perpetrator, who was said to be riding a bike with “aero bars” and sporting a racing helmet, vanished down the trail.

But the aggressor had left a clue: He was one of a handful of riders using the fitness app Strava to track his progress that day, a fact suggested by his outfit and racing bike.

On Thursday, the Loudoun County* sheriff’s office arrested a suspect, Edward Shortnacy, and charged him with “malicious wounding.” To find him, the police used public Strava data to identify a group of suspects, and eyewitness accounts to confirm Shortnacy’s identity.

“We had basically the exact time and exact location,” a sheriff’s office spokesman explained. “There were a limited number of people using the Strava app at that time.”

It’s the latest in a long run of incidents in which the popular app, which runners and cyclists use to track their exercise and commutes, has displayed more than its users bargained for. In November, the company released a global heat map that revealed, along with popular urban hiking trails, the locations of military bases in North Africa and the Middle East, based on soldiers’ jogging routes.

The Loudoun County sheriff’s office did not ask the company for help, but many riders publicize their Strava data. And Strava’s Flyby function allows users to see whom they might have passed on the road, which can be helpful in a race, or if you think you might have seen a friend whiz by on Dockweiler Beach.

Or if you need to find a middle-aged man in Lycra who hit you in the head on a popular greenway.

It’s a high-tech, high-precision update on the cellphone-tower data that police have been using for decades to finger suspects or validate alibis. And a reminder that a number of tech companies, in particular Google, are sitting on a trove of location data of drivers and more, should law enforcement find a way to access that information. How many hit-and-runs might have a lead lurking in the records of navigation apps? Police and prosecutors are already using in-car computers as a source of evidence, and in some cases, issuing search warrants to obtain Google location data for anyone who might have been in the area when a crime was committed.

Correction, May 18, 2018: This piece originally misspelled the name of Loudoun County, Virginia.