Bellingcat finds maps exposed US bases

TLDR

• Bellingcat says Google Maps listings, reviews and photos detailed facilities at four US bases, including some Iranian strikes destroyed.¹
• Two Camp Arifjan sites blurred on Google Maps were clear on Bing Maps at the same coordinates, Bellingcat found.¹
• Experts told Bellingcat such data could have informed Iranian targeting, but cautioned Iran also had other intelligence sources.¹

Bellingcat reported on 5 November that public Google Maps entries, user reviews and photographs revealed how facilities were laid out and used at four US bases hit by Iranian missiles and drones: Camp Buehring and Camp Arifjan in Kuwait, Muwaffaq Salti Air Base in Jordan and Al Udeid Air Base in Qatar.¹ The report does not say it found evidence that Iran used Google Maps data to select targets.¹

Why it matters: the report is a worked example of mapping-platform data being used as an open source, and of its limits. Place markers, reviews and visitor photos could be matched to damage imagery that Iranian and Western outlets had already published. Blurring one provider's imagery did not hide a site that another provider showed clearly.¹

Driving the news:

• Camp Buehring: Google Maps labels a main headquarters building, a gym and a self-help centre, all among sites Bellingcat says were destroyed. It confirmed the headquarters by matching flagpoles and layout in a US military photo to the Google satellite image, and matched a CBS News photo of a damaged structure to the gym. The comparison imagery was published by Iran's Tasnim news agency.¹
• Camp Arifjan: Bellingcat compared a Planet image published by The Washington Post with mapping data and identified two damaged sites, a lodging building and a 24-hour fuel point. Google's satellite imagery of the base is blurred, but both sites appear unblurred in Bing Maps when the Google Maps coordinates are pasted in.¹
• Microsoft: a spokesperson told Bellingcat that when an entity requests removal from visibility on Bing Maps, the company works through its process and acts accordingly.¹
• Muwaffaq Salti: Bellingcat says Iranian strikes on 17 July killed three US service members, and Iranian-released imagery shows at least 20 structures destroyed in a northern barracks. A volunteer-run thrift shop and a dining facility are pinned on Google Maps less than 40 and less than 100 metres from the damage, and a visitor's photo helped match the shop to satellite imagery.¹
• Al Udeid: the base appears unblurred on Google Maps, with entries for lodging, and Russia's Yandex Maps lists two cinemas, a bar and a school. Bellingcat says the areas struck there do not appear among the facilities listed on Google.¹

The big picture: a visual forensics consultant told Bellingcat the data could reveal the layout of a camp, the split between secure and non-secure areas, likely accommodation, and periods of low and high activity. The Royal United Services Institute's (RUSI) director of military sciences called the data a "pattern of life" and said Western militaries lack consistent policies on what can be posted about sensitive sites. A former US Air Force targeting specialist said the problem reflected an assumption that allied-country bases were safe.¹

Bellingcat also cites Sky News reporting that 80 per cent of the runs shared publicly on Strava at Muwaffaq Salti during the April ceasefire started or finished in that northern barracks.¹ Stars and Stripes reported in August that Strava users were still sharing workouts from bases across the region months after US Central Command imposed geolocation restrictions, and that Sky News had identified more than 1,300 such users. It added that Sky News did not establish that Iran used Strava data to select targets, and that Central Command declined to say how the restrictions are enforced.²

The other side: the experts quoted by Bellingcat cautioned that Iran would also have had other intelligence, and Bellingcat notes that the bases it examined are not secret and have operated for years.¹ Bellingcat contacted the US Department of Defense, which directed it to Central Command, and also contacted Google. It received no response from either before publication.¹

Single-source note: the Google Maps, Bing Maps and Yandex Maps findings rest on Bellingcat's own checks, and no listing or satellite image was reviewed here. Stars and Stripes supports only the Strava background. Other sites that carry the Bellingcat text, including InView, are reposts and not independent.