WELLINGTON, NEW ZEALAND / RankWire.AI / – Public fitness data from Strava has exposed the movements and routines of hundreds of people linked to New Zealand Defence Force sites. A review identified 565 Strava users who logged activity at NZDF camps and bases since January. Of those profiles, 488 were public, making complete activity histories visible to other users. Investigators could not confirm every account belonged to NZDF personnel. Most profiles, however, showed at least one indicator of military service.
The activity covered major New Zealand defence locations, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru and Woodbourne. Some users recorded workouts inside Papakura Military Camp, home to the New Zealand Special Air Service. Others logged activity at the nearby Ardmore training area. Public segments also appeared at defence sites, with names tied to base routes and military fitness tests. Some segment leaderboards had displayed user names since 2018.
Overseas activity widened the exposure beyond New Zealand. Users recorded workouts at military locations across 13 countries and territories. The locations included sites in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji and the Cook Islands. Activity also appeared in Antarctica. Some profiles showed movements between New Zealand bases and overseas military facilities, creating public records that connected individuals with specific locations and travel patterns.
Public data reveals detailed military routines
Strava allows users to record and share runs, rides and other workouts using GPS data. Its public segments can display leaderboards for routes completed by users. The reviewed data included 41 public segments at defence locations. Even some private profiles appeared by name on public leaderboards. In at least 30 cases, those names helped connect activity across multiple military sites. Linked accounts or tagged activities also exposed family connections in 13 cases.
Some accounts revealed more than location. Users posted photos, videos and workout titles connected with training at military facilities. Examples included activity at Waiouru and other training areas. Separate profiles showed workouts near overseas bases and diplomatic locations. A high-ranking NZDF member posted activity under a real name while serving in the United States. That profile showed movements involving several military sites as well as runs near New Zealand’s embassy in Washington.
NZDF guidance addresses fitness tracking risks
The NZDF has warned personnel about risks linked to fitness-tracking applications and social media. Its guidance tells personnel to disable fitness tracking in sensitive locations and avoid using full names on fitness platforms. The Defence Force said it applies measures to protect personnel, facilities, operations and information. It also said personnel receive regular guidance on personal information and operational security, including before deployments. NZDF does not have a policy specifically covering Strava or other fitness-tracking applications.
Strava provides privacy controls that can limit what other users see. Users can restrict activities to followers or themselves, hide parts of a GPS route, or hide an entire map. Strava also advises users to consider stronger privacy settings around workplaces and other sensitive locations. When users restrict activities to followers or themselves, those activities do not appear on public leaderboards. NZDF said online fitness-tracking information does not by itself establish a security breach or a breach of its requirements.