How a French Sailor’s Strava Run Revealed the Charles de Gaulle’s Location — What the Incident Means for Military OPSEC and Fitness Apps

Table of Contents

1. Key Highlights
2. Introduction
3. How a Strava run led journalists to an aircraft carrier
4. Why consumer fitness apps can expose deployed forces
5. Open-source intelligence: how public data is stitched into military secrets
6. Tactical and strategic consequences of location leaks
7. Human factors: why service members still post
8. Policy and disciplinary responses: what militaries can do
9. Technical fixes and what app developers should do
10. Practical guidance for service members, commanders, and civilians
11. Balancing transparency, accountability, and force protection
12. The evolving threat landscape: AI, sensors, and mass data
13. Looking ahead: practical policy proposals
14. FAQ

Key Highlights

• A French officer’s public Strava activity on March 13 exposed the position of the carrier group centered on the aircraft carrier Charles de Gaulle between Turkey and Cyprus; Le Monde corroborated the data with satellite imagery.
• The French Armed Forces General Staff called the posts “does not comply with current regulations” and said “appropriate measures will be taken by the command.” The episode highlights longstanding OPSEC vulnerabilities created by consumer fitness apps and personal devices.
• Preventing future leaks requires immediate steps for individuals (privacy settings, no posting while deployed), organizational controls (mobile device management, clear bans), and technical fixes from app makers (default privacy, anonymization, detection of sensitive patterns).

Introduction

A single four-mile jog, tracked on a popular fitness app, exposed the location of one of France’s most important naval assets. The officer — described by Le Monde under the pseudonym “Arthur” — logged his run while deployed aboard a vessel within the carrier strike group centered on the nuclear-powered aircraft carrier Charles de Gaulle. Journalists cross-referenced his public activity with commercial satellite imagery and located the carrier between Turkey and Cyprus on March 13.

The leak is more than an embarrassing breach of discipline. It demonstrates how everyday consumer technology and well-intentioned sharing habits can create tactical vulnerabilities. At a moment when France has dispatched forces to the eastern Mediterranean amid rising tensions with Iran — and after a NATO base in Iraq was struck by a drone that killed a French soldier, the first European casualty in that escalation — the stakes could not be higher. This incident exposes the intersection of personal behavior, app design, open-source intelligence methods, and military doctrine, and it forces a reassessment of how modern armed forces manage the devices and habits of their personnel.

The Charles de Gaulle episode joins a string of cases where fitness trackers, social media, and innocuous metadata have revealed sensitive movements and locations. That pattern points to a broader problem: operational security (OPSEC) is only as strong as its weakest human practice and its weakest technological control. This article unpacks the facts of the case, explains the mechanisms that made the leak possible, examines the potential operational consequences, and proposes concrete steps for militaries, app developers, and individual service members.

How a Strava run led journalists to an aircraft carrier

A French officer on deployment recorded a run on the fitness platform Strava and left the activity visible to the public. The logged route covered roughly four miles across the deck of a ship in the Mediterranean. Le Monde used that geo-tracked activity as a starting point, then compared the coordinates and timing with satellite images. The two datasets matched: the carrier group identified by the media sat where the run placed it.

France had publicly announced it was sending a task group — the Charles de Gaulle accompanied by a supply vessel and several frigates — toward the eastern Mediterranean after attacks involving Iran. That announcement established the general presence of French naval assets in the region but did not and would not list precise coordinates. Naval doctrine typically treats the specific location of carriers and escort ships as sensitive for operational and force-protection reasons. Yet the soldier’s public activity produced a real-time, fine-grained location report with a resolution that satellite imagery could corroborate.

The French Armed Forces General Staff described the posts as violating regulation: the behavior “does not comply with current regulations,” the spokesperson said, and added that “appropriate measures will be taken by the command.” Le Monde also reported that other members of the deployed group had made similar sharing mistakes, signaling a wider pattern of inconsistent adherence to OPSEC rules aboard the task group.

This is not an isolated class of incident. In 2018 a public heatmap from Strava aggregated billions of anonymized fitness activities and unintentionally highlighted security-sensitive areas such as military bases and patrol routes around the world. That concentrated attention led to a well-documented controversy after analysts and journalists used the heatmap to identify the locations of previously unreported bases and infrastructure. The current French case illustrates how easily that prior problem can repeat on the scale of an individual’s account and activity.

Why consumer fitness apps can expose deployed forces

GPS-enabled fitness apps are designed to create a lasting, shareable record of an individual’s geographic movement. They do so by collecting precise latitude and longitude timestamps, mapping them into routes, and often overlaying speed and elevation data. Those raw capabilities are legitimate and valuable for civilian users; they become problematic when the data intersect with military operations.

Key technical features that make fitness apps risky for deployed personnel:

• Precise GPS traces. Modern phones and wearables capture location data with meter-level accuracy. A run logged on the deck of a ship produces coordinates that closely match the platform’s true position.
• Persistent activity history. Apps save complete histories unless users manually remove activities. Old posts surface trends and movement patterns.
• Social sharing and public defaults. Many users seek recognition and community engagement. Apps frequently set sharing defaults that reveal activity to followers or the public.
• Aggregation and heatmaps. Publicly exposed data can be aggregated into maps that show patterns of activity across time. In 2018 Strava’s global heatmap provided a clear example of how aggregated fitness data can reveal routes and stationary signatures near bases and installations.
• Metadata and timestamps. Even if route geometry is obfuscated, timestamps and contextual details (e.g., a workout labeled “deck run”) can give away location, especially when combined with other public information.

The combination of those features makes it possible for a motivated actor — a journalist or an adversary — to locate and track assets that are supposed to remain discreet. When a user posts from a deployed ship or near a forward operating base, the geo-coordinates tied to the activity become a standing beacon, accessible without specialized access.

The French case shows how a single public activity supplied a precise coordinate that a news organization could use to verify the carrier’s position with satellite images. A more malicious actor could do the same with intent to surveil, map patrol patterns, or plan an attack.

Open-source intelligence: how public data is stitched into military secrets

Modern OSINT (open-source intelligence) practitioners and investigative journalists routinely combine multiple publicly available datasets to reconstruct events and movements. The techniques that made the Charles de Gaulle’s position discoverable are not sophisticated in isolation; their power comes from fusion: linking low-cost sources until the picture becomes clear.

Common OSINT components that map to this incident:

• Fitness app tracks. Geo-tagged routes and timestamps provide immediate, localizable coordinates.
• Commercial satellite imagery. Providers like Maxar, Planet, and others offer near-real-time imagery accessible to journalists and commercial customers. Once a coordinate is known, satellite images can confirm the presence of a ship or facility.
• AIS (Automatic Identification System). While many naval vessels turn off AIS to avoid detection, commercial and auxiliary ships broadcast their AIS, which can indicate nearby activity. Aggregate AIS tracks sometimes reveal patterns around naval movements.
• Social media posts and photos. Crew members or civilians might post images or captions that contain place names, visible landmarks, or metadata (Exif) that include GPS coordinates.
• Public statements and press releases. Official announcements narrow temporal windows and approximate locations, making it easier to focus OSINT efforts.
• Historical data archives. Repeated patterns appear in historical activity logs and can reveal regular patrol routes or logistic chains.

Putting these elements together, a researcher or analyst needs only a small piece of explicit geographic information — an activity logged by a sailor — to triangulate a much richer set of intelligence. That capability is aggressively cheap and increasingly automated: machine learning systems can sift millions of social posts and activity traces to flag potential matches with satellite imagery.

That fusion transforms innocuous user behavior into an operational risk. The French officer’s run provided the initial lead; the rest was standard OSINT technique. That chain raises questions about how militaries and app platforms should respond to the predictable exploitation of public data.

Tactical and strategic consequences of location leaks

Revealing the position of a carrier strike group has several implications across tactical, operational, and strategic dimensions.

Tactical risks:

• Targeting and surveillance. Knowledge of precise coordinates allows adversaries to surveil movements and, in conflict conditions, plan attacks using long-range missiles, drones, or covert assets. Carriers are high-value targets; locating them reduces the time and effort required for an adversary to fix a firing solution or plan interdiction.
• Force protection. Leakers increase the risk to personnel aboard. When identities can be linked to a deployment through a public account, individual crew members may also be exposed to harassment, tracking, or targeted intrusion.
• Compromise of escort patterns. Carrier groups rely on escort ships and certain formations for layered defense. Persistent public location traces can reveal tactics, timing, and patrol cycles that degrade those defenses.

Operational risks:

• Loss of unpredictability. Naval strategy often relies on positioning uncertainty to exercise deterrence. When movements become discoverable, the element of surprise diminishes.
• Compromised missions. Covert operations, special forces insertions, or discreet resupply missions depend on secrecy. Public leaks can force mission alterations or cancellations.
• Intelligence collection. Adversaries can combine multiple small leaks to build a bigger picture of logistics and command relationships, affecting theater-level assessments.

Strategic and political risks:

• Escalation dynamics. In a volatile theater, revealing force positions can stoke friction. If one side responds to perceived threats or vulnerabilities, unintended escalation could follow. The French deployment to the eastern Mediterranean — already sensitive after the attack that killed a French soldier — is an example where visibility may intensify strategic risk.
• Domestic political fallout. The public exposure of a leak can undermine civilian trust in military readiness and discipline, prompting political scrutiny and parliamentary inquiries.
• International information campaigns. Adversaries can exploit leaked positions to craft narratives, embarrass allies, or demonstrate reach and capability.

These consequences vary by context. In peacetime or low-tension environments, a public workout might be an annoyance. In contested regions or during active operations, a similar leak can have lethal implications.

Human factors: why service members still post

The technical capabilities that enable location exposure collide with ordinary human motivations. Understanding those motivations is essential to designing policies and interventions that stick.

Social reward and community norms:

• Fitness apps are social platforms. They feed on likes, kudos, and encouragement from peers. Service members, like civilians, derive satisfaction from personal achievements and community validation. That incentive structure encourages sharing.
• Habit formation. Users develop routines around tracking and sharing workouts. A deployed sailor who tracks daily runs may not appreciate the change in context and risks. Habits persist even when circumstances make them risky.

Cognitive blind spots:

• Underestimation of risk. Individuals often misjudge the probability or impact of a leak, assuming their audience is small or well-meaning. They may not grasp how quickly data can be aggregated and used.
• Normalization. If peers are sharing, the behavior becomes normalized. Mild enforcement or inconsistent messaging from leadership allows norms to drift toward permissive sharing.

Device and policy gaps:

• Personal vs. official devices. Service members commonly use personal phones and wearables because they are convenient; militaries struggle to control personal device usage outside approved networks.
• Ambiguity in rules. Where policies are unclear, personnel default to personal judgment. If regulations about fitness apps and posting are not explicit or reinforced, compliance falls.

Training and reinforcement failures:

• Single-event training is insufficient. Annual OPSEC briefs do not overcome daily sharing pressure. Behavioral change requires repeated, scenario-specific instruction and leadership modeling.
• Lack of feedback. When violations do not result in visible consequences, the behavior remains attractive.

An effective response must address motivation and the environment, not just rules. That means adjusting incentives and reducing friction for compliant behavior.

Policy and disciplinary responses: what militaries can do

The French Armed Forces General Staff’s statement — that the posts “does not comply with current regulations” and that “appropriate measures will be taken by the command” — signals a predictable disciplinary route. But discipline alone cannot fix a systemic exposure. Solutions should combine immediate containment, medium-term organizational controls, and long-term cultural change.

Immediate actions commanders typically take:

• Order removal of public activities. Require affected personnel to take down posts and change privacy settings.
• Inventory and assessment. Conduct a rapid OPSEC audit of devices and accounts to determine the scope of exposure.
• Re-issue guidance. Deliver explicit, written instructions clarifying prohibitions on sharing operational locations.

Medium-term organizational controls:

• Enforce device policies. Restrict use of personal devices in operational spaces and provide approved, controlled devices for necessary communications.
• Implement mobile device management (MDM). MDM systems allow commanders to enforce app blacklists, disable cameras, restrict network access, and remotely wipe devices in a unit’s inventory.
• Network-level controls. Block or restrict access to specific consumer apps on shipboard or base networks. Many modern warships and bases provide controlled Wi‑Fi; that infrastructure should prevent app synchronizations tied to public sharing.
• Operational checklists. Include device checks and pre-deployment account audits in the pre-sail or pre-deploy checklist.

Long-term cultural and structural measures:

• Revise OPSEC doctrine for personal tech. Doctrine should explicitly address wearable trackers, social media, and cloud-synced activities. Players include national militaries, NATO, and multinational task groups.
• Regular training and scenario-based simulations. Use interactive, realistic training that shows how casual posts can cascade into vulnerabilities.
• Leadership modeling. Commanders must model compliant behavior; if leaders share sensitive information, lower ranks will follow.
• Legal and disciplinary clarity. Agencies should codify penalties for willful violations that materially endanger forces.

Potential disciplinary outcomes range from reprimands and loss of privileges to career-impacting sanctions. The severity commonly depends on intent and consequence. Where an exposed position leads to demonstrable harm, militaries may pursue criminal or court-martial proceedings. Where exposure is inadvertent and quickly corrected, counseling and retraining may suffice. Ultimately, consistent application of rules matters more than the harshness of any single penalty.

Technical fixes and what app developers should do

App design choices determine how data flows and which defaults govern sharing behavior. The Strava episode in 2018 and the Charles de Gaulle incident show that platform-level changes can materially reduce risk. App developers can and should implement measures that protect sensitive locations while preserving legitimate user functionality.

Platform-level mitigations:

• Private-by-default settings for sensitive contexts. New accounts (or accounts flagged in sensitive regions) should default to private. Users can opt in to public sharing, but the platform should require explicit, informed consent rather than obscure defaults.
• Built-in geo-fencing for sensitive coordinates. Platforms should maintain a database of known sensitive areas (military bases, certain maritime zones) and automatically blur or restrict activities recorded inside those polygons. This is complicated politically but technically feasible; Strava implemented changes after the 2018 heatmap controversy.
• Automatic anonymization of start/end points. By truncating or applying noise to the endpoints of routes, apps can preserve workout geometry while obscuring the user’s true origin or destination.
• Rate-limiting and pattern detection. Platforms can flag accounts that frequently log activities in a narrow area consistent with deployments and prompt manual review or temporary restrictions.
• Better user education. Build contextual prompts during posting: “This activity was recorded in a location commonly linked to military bases. Are you sure you want to share publicly?”
• Enterprise features. Offer a specialized, privacy-hardened enterprise product for militaries and organizations that require strict controls, including the option to host data on private servers.

Trade-offs exist between privacy and user value. Many athletes and commuters want detailed analytics and social sharing. App makers must balance those desires with the legitimate security concerns state actors raise. Collaboration between developers and national security agencies can identify high-risk areas and create acceptable procedures for redaction and anonymization while protecting user privacy.

Strava’s 2018 heatmap incident prompted fixes: the platform removed certain sensitive areas from public view and adjusted default settings. The current episode suggests the work is unfinished: user behavior and the scale of global deployments mean that proactive detection and conservative defaults remain necessary.

Practical guidance for service members, commanders, and civilians

For individuals

• Set accounts to private. Make your fitness and social accounts private and restrict follower access.
• Disable location sharing when deployed. Turn off public sharing and avoid recording activities during deployments.
• Remove past activities. Audit and delete or privatize old workouts recorded in operational environments.
• Strip metadata from photos. If you must post images, remove Exif metadata or use social platforms that auto-strip metadata.
• Avoid identifiable labels. Don’t include uniforms, ship names, or unit references in captions or activity titles.
• Use approved devices only. Follow your chain of command on permitted devices. If in doubt, don’t post.
• Know the app’s privacy features. Many apps have “privacy zones” or hidden-start options that blur the start/end of an activity; configure these in advance.
• Seek guidance before sharing. When deployed, assume the default is no sharing until you receive explicit permission.

For commanders and military organizations

• Issue clear, written prohibitions tailored to current missions. Vague guidance will be ignored.
• Conduct pre-deployment audits of personal accounts and devices. Require personnel to remove or privatize sensitive content before sailing.
• Deploy MDM and restrict app installs on government devices.
• Monitor compliance and enforce rules consistently. Training without enforcement creates cynicism.
• Provide approved alternatives. If physical fitness monitoring is necessary for readiness reporting, supply vetted devices and platforms with locked-down sharing settings.
• Engage with app developers. Request enterprise-level privacy options and share relevant geospatial constraints. Work with allies to create multinational standards for deployed personnel’s social sharing.

For civilians and journalists

• Balance public interest with operational risk. When reporting on sensitive deployments, weigh the news value against the potential harm of revealing precise locations.
• Use redaction and delay. When publishing intelligence derived from fitness apps, consider redacting exact coordinates or delaying publication until risk subsides.
• Consider ethical OSINT practices. Responsible journalists and researchers should apply a harm-minimization rubric when exploiting public data tied to active military operations.

Balancing transparency, accountability, and force protection

Democratic societies expect transparency about military deployments and defense posture. Parliaments and the public require information to hold leaders accountable. At the same time, operational secrecy is a legitimate tool for protecting personnel and enabling effective action.

Finding the right balance requires calibrated rules:

• Public announcements of intent and presence can be sufficient for democratic oversight without exposing tactical detail. Governments can disclose that a carrier is present in a region while withholding precise coordinates and timing.
• Journalists and watchdogs should continue to investigate alleged misconduct and hold militaries to account, but they should also practice restraint when publishing actionable location data about active deployments.
• Military leaders should accept a baseline level of public scrutiny and avoid wrapping routine deployments in unnecessary secrecy; but when forces operate in contested zones, stricter controls on information dissemination are warranted.

The Charles de Gaulle episode suggests that neither side — military authorities nor individual service members — understood how a personal post could instantly bridge the gap between public accountability and tactical exposure. Reasoned policies and professional norms must coexist: transparency about the presence of forces should not equate to a license for real-time disclosure of their positions.

The evolving threat landscape: AI, sensors, and mass data

The risk posed by a single Strava post exists within an accelerating threat environment. Several technological trends multiply the ease and speed with which open data can be exploited.

Automated aggregation and machine learning:

• Bots and algorithms now collect, index, and correlate social media, fitness app activity, and satellite imagery at scale. Where humans once had to stitch evidence manually, automated systems can flag sensitive matches in near-real-time.
• Object detection models on satellite images can identify ships, vehicles, and installations with increasing accuracy. Combine that capability with a geo-tagged hint, and discovery becomes trivial.

Proliferation of commercial sensors:

• The number of satellites and the frequency of revisits have increased dramatically. Commercial imagery providers can supply daily or even hourly imagery of many regions.
• Small drones and aerial platforms proliferate, expanding local surveillance capability available to state and non-state actors.

Cross-domain fusion:

• Analysts now fuse visible traces from one domain (a fitness app) with signals from other domains (satellite, AIS, telecom metadata). The barrier to entry for adversarial intelligence collection is lower than ever.

These trends imply that human mistakes will be amplified. The speed and automation of modern OSINT turn minor disclosures into persistent, searchable records that adversaries will exploit. The military response must therefore evolve beyond reactive discipline and toward anticipatory controls, technological mitigation, and cooperative engagement with the tech sector.

Looking ahead: practical policy proposals

Policymakers and military planners should consider a set of practical measures that combine technical, organizational, and normative steps.

National and coalition-level recommendations:

• Establish minimum OPSEC standards for personal device use during deployments, including specific rules for fitness and social apps.
• Mandate pre-deployment account audits and a formal process for declaring compliant device configurations.
• Invest in MDM and hardened communication appliances suitable for downrange operations.
• Create liaison channels between defense ministries and major app platforms to request emergency takedowns or to coordinate privacy safeguards during high-risk operations.
• Launch public-awareness campaigns aimed at service members and families; educate homefront communities about how seemingly harmless posts can endanger forces.

Tech-sector recommendations:

• Adopt privacy-by-default for account creation and activities, especially for new signups from sensitive regions or accounts that show deployment-type behaviors.
• Build opt-in enterprise offerings that allow militaries to centralize fitness data on private infrastructure.
• Provide accessible user workflows to bulk-delete or anonymize historical activities.
• Implement complaint and takedown procedures tailored to national security requests that balance transparency and abuse prevention.

Practical research and development:

• Fund research into robust anonymization techniques that preserve analytics utility while eliminating precise geolocation.
• Develop standards for “sensitive area” databases, created jointly by governments and vetted nonprofits, to feed into consumer app privacy layers without leaking the list itself.
• Pilot technical solutions that allow offline activity logging with delayed synchronization after a deployment ends, giving commanders a window to review.

These steps will not eliminate all risk, but they will lower the probability that ephemeral habits become operational crises.

FAQ

Q: Exactly what did the French soldier post and how did it reveal the carrier’s location?
A: The soldier logged a four-mile run on Strava from the deck of a ship and left that activity public. The GPS coordinates attached to the activity placed him in a specific location between Turkey and Cyprus on March 13. Le Monde used those coordinates to obtain and match satellite imagery showing the Charles de Gaulle in the same location.

Q: Has the French military taken action?
A: The French Armed Forces General Staff stated the conduct “does not comply with current regulations” and said “appropriate measures will be taken by the command.” That language indicates disciplinary and corrective actions are forthcoming, though public reporting has not yet detailed individual sanctions.

Q: Can fitness apps really reveal secret military bases or patrols?
A: Yes. Precise GPS traces, timestamps, and aggregated activity maps can reveal patterns of movement and stationary locations that correspond to bases, patrol routes, and deployed platforms. The Strava global heatmap controversy in 2018 demonstrated how aggregated public activities could highlight security-sensitive areas.

Q: What immediate steps should service members take to avoid similar leaks?
A: Set fitness and social accounts to private; disable public sharing while deployed; remove or privatize past activities recorded in operational environments; strip metadata from photos; avoid posting identifiable images or captions; and use only approved devices according to unit policy.

Q: What can militaries do to prevent these leaks across a force?
A: Implement clear, specific rules governing personal device use; enforce pre-deployment account audits; use mobile device management and network-level restrictions; provide approved devices and privacy-hardened tools; conduct scenario-based OPSEC training; and engage with app vendors to request enterprise-level privacy controls.

Q: What responsibility do app developers bear?
A: App developers should adopt privacy-by-default defaults, offer robust anonymization and geo-fencing for sensitive areas, provide enterprise features for organizations, and create detection for activity patterns consistent with deployments. Platforms can significantly reduce risk through technical changes and improved user education.

Q: Are there legitimate reasons for service members to track workouts during deployments?
A: Physical fitness is a core component of military readiness, and commanders may require monitoring. That monitoring should occur on approved, controlled platforms that do not publish precise location data publicly and that allow centralized oversight.

Q: Is there a conflict between public transparency and operational secrecy?
A: Democratic accountability requires that militaries provide baseline information about deployments and activities. That transparency does not necessitate real-time disclosure of tactical positions. Reasoned policies can maintain public oversight while preserving necessary secrecy for force protection.

Q: Could an adversary use a public Strava post to target a ship?
A: A single public post offers geolocation data that adversaries can use to locate and surveil a ship. In a hostile environment, that information can contribute to efforts to target or interfere with naval forces. The practical impact depends on the threat level, capability of the adversary, and other intelligence they possess.

Q: What long-term trends make this problem more dangerous?
A: Increased availability of commercial satellite imagery, automated OSINT aggregation, machine learning-enabled object detection, and the proliferation of sensors and wearable devices reduce friction for adversaries to discover and exploit public traces. This means small leaks are amplified and persist, emphasizing the need for systemic mitigation.

Q: Should journalists refrain from publishing OSINT based on fitness apps?
A: Journalists must weigh public interest against harm. Responsible reporting can involve redaction, temporal delay, or coordination with authorities when publication would cause immediate operational risk. Ethical judgment is required on a case-by-case basis.

Q: What should app users who are not military personnel do to protect their privacy?
A: Set accounts to private, be mindful of geotags and timestamps, strip metadata from photos, use privacy features offered by platforms, and avoid posting identifiable routine locations (home address, workplace) publicly.

Q: Will legal penalties be used against personnel who post in violation of OPSEC?
A: Military justice systems often address willful breaches that endanger forces. Penalties can range from administrative sanctions to courts-martial in severe cases. The exact legal outcome depends on national law, the circumstances, and the harm caused.

Q: How can families and friends help reduce risk?
A: Encourage deployed relatives to avoid posting location details, resist posting photos that reveal operational environments, and understand that sharing from homefront communities (e.g., photos at a homecoming port) can likewise reveal sensitive logistics.

Q: What is the single most important preventive step?
A: For individuals, the simplest is to set fitness and social accounts to private and to assume that anything posted while deployed will be visible and permanent until explicitly removed.

The episode involving the Charles de Gaulle underlines a simple principle: when inexpensive data sources meet powerful analysis tools, small personal acts can have outsized consequences. The solution lies in coordinated action across three domains — individual behavior, organizational controls, and app design. Each prevents the next inadvertent leak and protects the personnel and missions that depend on secrecy.