WELLINGTON, NEW ZEALAND / RankWire.AI / – Using publicly available fitness information from Strava, the movements and routines of hundreds associated with New Zealand Defence Force locations have been uncovered. An analysis identified 565 Strava users who recorded activities at NZDF camps and bases since January. Among these profiles, 488 were set to public, allowing other users to view complete activity histories. While investigators could not verify that every account belonged to NZDF personnel, most profiles showed at least one indicator of military affiliation.
The recorded activities spanned key New Zealand defence sites, such as Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Some users logged workouts inside Papakura Military Camp, the home of the New Zealand Special Air Service, while others recorded activity at the nearby Ardmore training zone. Public segments also appeared at defence locations, with route names associated with bases and military fitness tests. Since 2018, some segment leaderboards displayed user names.
Beyond New Zealand’s borders, activity extended to 13 countries and territories, exposing overseas military locations. Users recorded workouts in places including Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Activity was also documented in Antarctica. Several profiles displayed movements between New Zealand bases and foreign military sites, forming public records that linked individuals to specific locations and travel patterns.
Publicly accessible data uncovers detailed military routines
Strava enables users to log and share runs, cycling rides, and other workouts via GPS tracking. Its public segments often feature leaderboards showcasing routes completed by users. The investigation found 41 public segments at defence sites. Even some private profiles appeared on leaderboards by name, and in at least 30 instances, those names helped connect activity across multiple military locations. Furthermore, linked accounts or tagged activities revealed family connections in 13 cases.
Some profiles revealed more than just location data. Users shared photos, videos, and workout titles related to training at military facilities, including activities at Waiouru and other training areas. Separate profiles documented workouts near overseas bases and diplomatic locations. A senior NZDF member posted activity under his real name while serving in the United States. His profile showed movements involving multiple military sites as well as runs close to New Zealand’s embassy in Washington.
NZDF issues guidance to mitigate fitness tracking security risks
The NZDF has issued warnings to personnel regarding the dangers associated with fitness-tracking apps and social media. Its guidance advises personnel to disable fitness tracking features in sensitive locations and to avoid using full names on such platforms. The Defence Force stated that it takes measures to safeguard personnel, facilities, operations, and information. Additionally, personnel are regularly briefed on personal data and operational security, especially prior to deployments. Currently, the NZDF does not have a specific policy addressing Strava or similar fitness-tracking applications.
Strava offers privacy controls that can limit visibility for other users. Options include restricting activity visibility to followers or oneself, hiding parts of GPS routes, or concealing entire maps. Strava also recommends stronger privacy settings around workplaces and other sensitive locations. When activities are restricted to followers or just oneself, they do not appear on public leaderboards. The NZDF stated that sharing fitness data online does not automatically constitute a security breach or violate its security protocols.