WELLINGTON, NEW ZEALAND / RankWire.AI / – Publicly accessible fitness information from Strava has revealed the movement patterns and routines of hundreds of individuals connected to New Zealand Defence Force locations. An analysis identified 565 Strava users who logged activities at NZDF facilities since January. Among those, 488 profiles were public, allowing others to view complete activity histories. Investigators were unable to verify that every account belonged to NZDF personnel, but most profiles displayed at least one indicator of military affiliation.
The logged activities covered prominent defence sites across New Zealand, such as Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Some users recorded sessions within Papakura Military Camp, home of the New Zealand Special Air Service, while others logged workouts at the nearby Ardmore training area. Public segments also appeared at military locations, with names linked to base routes and fitness tests. Since 2018, some segment leaderboards have displayed user names.
International activity further expanded the exposure beyond New Zealand’s borders. Users documented workouts at military sites across 13 countries and territories, including locations in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Activity was also recorded in Antarctica. Several profiles indicated movements between New Zealand bases and overseas military facilities, resulting in public records that linked individuals to specific locations and travel routines.
Publicly accessible data exposes detailed military routines
Strava enables users to log and share runs, rides, and other workouts utilizing GPS data. Its public segments often display leaderboards for popular routes completed by users. The examined data included 41 public segments situated at defence sites. Even some private profiles appeared on public leaderboards by name. In a minimum of 30 instances, these names helped connect activity across different military locations. Additionally, linked accounts or tagged activities revealed family connections in 13 cases.
Some profiles showed more than just location data. Users shared photos, videos, and workout titles related to training at military facilities. For example, activities at Waiouru and other training areas were documented. Separate profiles displayed workouts near overseas bases and diplomatic locations. One high-ranking NZDF member posted activity under their real name while stationed in the United States. That account revealed movements involving multiple military sites and runs near New Zealand’s embassy in Washington.
NZDF issues guidance on fitness tracking and operational security
The NZDF has issued warnings to personnel regarding the risks associated with fitness-tracking apps and social media. Its guidelines recommend disabling fitness tracking features in sensitive areas and refraining from using full names on fitness platforms. The Defence Force stated it employs measures to safeguard personnel, facilities, operations, and classified information. It also emphasized that personnel routinely receive guidance on protecting personal details and operational security, including prior to deployments. Currently, the NZDF does not have a specific policy addressing Strava or similar fitness-tracking services.
Strava offers privacy controls that can restrict what others see about users’ activities. Options include limiting activity visibility to followers or oneself, concealing parts of GPS routes, or hiding entire maps. The platform also advises users to consider applying stronger privacy settings near workplaces and other sensitive locations. When activities are restricted to followers or private, they do not appear on public leaderboards. The NZDF noted that online fitness data alone does not constitute a security breach or violate its operational requirements.