Travel App Outs NATO Homes

Smartphone with map app surrounded by red location pins — Photo: Andrey_Popov / Shutterstock

Reporters say a cheerful travel app let strangers follow NATO troops right to their homes and missions.

Story Snapshot

Journalists tracked soldiers from several NATO countries through Polarsteps to homes and bases.
Reports describe access to precise GPS points, photos, and trip media at huge scale.
Dutch defense officials blacklisted the app from military devices after questions were raised.
The company denies a “breach,” saying reporters used public trip data, then tightened controls.

What investigators say they could see, and why it matters

Investigators with the Follow the Money platform said they could identify and track dozens of service members through Polarsteps. They traced movements to home addresses, barracks, and NATO missions. Dutch public broadcaster NOS reported that the tracking involved soldiers from the Netherlands, the United States, the United Kingdom, France, and Belgium. Cybernews described access to photos, videos, and exact locations from nearly two million trips, with up to one billion GPS points available. That scope turns a cute vacation diary into an intelligence feed.

The method matters. Reports say the data sat behind the app’s interface and its programming gateway, not inside a stolen password dump. Telegraaf said the team accessed data through the Polarsteps application programming interface and that old links to trips still worked even after a user switched visibility to “Only followers”. That design choice, if accurate, makes a privacy toggle feel like a dummy switch. It also shows how “public once” can become “public forever” when links never die.

Military response and risk calculus

The Dutch Ministry of Defence blacklisted Polarsteps after the questions came in. Officials removed it from service devices and placed it on a prohibited-app list. That move speaks louder than a press quote. Defense leaders do not ban tools for sport. They weigh risk to people on the ground. If trip breadcrumbs point back to a base gate or a young family’s door, that is not “online privacy.” That is force protection. Belgium-focused reports echoed concern about exposed personnel.

The operational cost is simple. Location patterns reveal routines. Routines reveal targets. Combine a name, a face, a follower graph, and a street number, and you have a hostile actor’s starter kit. Cybernews reported the data included home addresses. Nieuwsblad described “more than a billion GPS positions” and data affecting millions of users. Whether a soldier posted a sunset photo in Rhodes or a hike near Mons, the trail back home can be the real exposure.

Polarsteps’ defense, and what that argument misses

Polarsteps says this was not a breach. The company states that Follow the Money only accessed public trip data. It says no account logins were bypassed and that trips set to private were not exposed. Outlets that quoted the company also say Polarsteps tightened controls after the report, including steps to limit large-scale scraping and to fix access to trips that had been public in the past. Those are welcome changes, but they also concede the original posture was too open.

The “it was public” line skips the point that design sets the blast radius. If a public profile and a sticky link let anyone harvest precise travel trails at scale, the harm is real even without a hacked password. That is common sense and national security 101. The Dutch ban and multi-country reporting show where officials landed on that question. They treated the exposure as a risk to people, not a debate over labels. Future fixes must honor that reality.

What should change now

Militaries should enforce default-off rules for any app that shares live or recent location. That includes vacation logs, fitness trackers, and social platforms with maps. Commanders should brief troops and families on link persistence and delayed posting. Companies should expire public links when a user switches to private, gate bulk access by design, and cut historical reach unless a user opts in with clear warnings. These steps are cheap. The cost of getting it wrong is not.