WELLINGTON, NEW ZEALAND / RankWire.AI / – Public fitness information shared on Strava has uncovered the movements and routines of hundreds connected to New Zealand Defence Force locations. An analysis identified 565 Strava users who logged activities at NZDF camps and bases since January. Out of these profiles, 488 were set to public, allowing others to view complete activity histories. Authorities could not verify that every account belonged to NZDF personnel, but most profiles showed at least one indication of military service.
Activities were recorded at key defence sites across New Zealand, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Some users documented workouts within Papakura Military Camp, home to the New Zealand Special Air Service, while others logged activities at nearby Ardmore training grounds. Publicly visible segments appeared at these defence locations, often named after base routes and military fitness assessments. Since 2018, some segment leaderboards displayed user names.
Beyond New Zealand, activity extended to 13 countries and territories, revealing international movements. Locations ranged from Australian and U.S. military sites to locations in South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Activity was also identified in Antarctica. Some profiles indicated movement between New Zealand military bases and overseas facilities, creating public records that linked individuals to specific locations and travel patterns.
Detailed military routines exposed through public data
Strava’s platform enables users to log and share runs, rides, and other workouts via GPS data. Its public segments can feature leaderboards for routes used by many users. The investigation uncovered 41 such segments at defence sites. Interestingly, even some private profiles appeared on public leaderboards by name. In at least 30 instances, those names connected activity across multiple military locations. Additionally, linked accounts or tagged activities revealed family ties in 13 cases.
Profiles went beyond location details, with users posting photos, videos, and workout titles associated with training at military facilities such as Waiouru and other training zones. Separate accounts showed activities near overseas bases and diplomatic points. Notably, a senior NZDF member posted activity under their real name while stationed in the United States. This profile depicted movements involving several military sites as well as runs near New Zealand’s embassy in Washington.
NZDF issues guidance to mitigate fitness tracking security risks
The NZDF has issued warnings to its personnel regarding the potential security risks associated with fitness-tracking apps and social media. Its directives advise disabling fitness tracking functions in sensitive areas and avoiding the use of full names on such platforms. The Defence Force emphasizes that it implements measures to safeguard personnel, facilities, operations, and information. Regular guidance is provided on handling personal data and operational security, especially prior to deployments. Currently, there is no specific policy addressing Strava or similar fitness-tracking tools.
Strava offers privacy settings that can restrict what others see, including options to limit activity visibility to followers or oneself, conceal parts of GPS routes, or hide entire maps. The platform also recommends strengthening privacy controls around workplaces and other sensitive locations. When activities are restricted to followers or the user, they do not appear on public leaderboards. According to the NZDF, online fitness data alone does not constitute a security breach or violate operational security requirements.