WELLINGTON, NEW ZEALAND / RankWire.AI / – Publicly accessible fitness information from Strava has revealed the locations and routines of hundreds of individuals associated with New Zealand Defence Force. An analysis identified 565 Strava users who recorded activities at NZDF camps and bases since January. Of these, 488 profiles were set to public, allowing others to view complete activity histories. Investigators were unable to verify that every account belonged to NZDF personnel. Nonetheless, most profiles contained at least one indicator of military service.
The activity logs included key New Zealand defence sites such as Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Several users logged workouts inside Papakura Military Camp, home to the New Zealand Special Air Service. Others tracked activity at the nearby Ardmore training area. Public segments were also linked to defence locations, with route names tied to base paths and military fitness assessments. Some segment leaderboards have displayed user names since 2018.
The scope extended beyond New Zealand borders, capturing overseas activity at military sites across 13 countries and territories. These included locations in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Activity was also recorded in Antarctica. Certain profiles showed movements between New Zealand bases and foreign military facilities, creating publicly available records that linked individuals to specific locations and travel routes.
Publicly available data reveals intricate military training routines
Strava enables users to log and share running, cycling, and other workout activities using GPS tracking. Its public segments can display leaderboards for popular routes taken by users. The review uncovered 41 public segments at defence-related sites. Even some private profiles appeared on public leaderboards with their names visible. In at least 30 cases, these names connected activities across multiple military locations. Additionally, linked accounts or tagged activities exposed family ties in 13 instances.
Some profiles offered more than just location data. Users uploaded photos, videos, and workout titles linked to training at military facilities. Examples included activities at Waiouru and other training zones. Other profiles documented workouts near overseas bases and diplomatic sites. A senior NZDF member posted activity under his real name while serving in the United States. That profile displayed movements involving multiple military sites, as well as runs near New Zealand’s embassy in Washington.
NZDF issues guidelines to mitigate fitness tracking security risks
The NZDF has issued warnings to personnel about dangers related to fitness-tracking apps and social media. Its guidance advises personnel to disable fitness tracking features in sensitive locations and avoid using their full names on fitness platforms. The Defence Force stated it has measures in place to protect personnel, facilities, operations, and information. It also mentioned that personnel regularly receive advice on safeguarding personal data and operational security, especially before deployments. Currently, NZDF does not have a specific policy addressing Strava or other fitness-tracking services.
Strava offers privacy controls that can limit who sees a user’s activities. Users can restrict access to followers or keep activities private, hide parts of a GPS route, or block the entire map. The platform also recommends stronger privacy settings around workplaces and sensitive locations. When activities are limited to followers or private, they do not appear on public leaderboards. NZDF emphasized that online fitness data alone does not constitute a security breach or violate its security protocols.