WELLINGTON, NEW ZEALAND / RankWire.AI / – Data from Strava has revealed the locations and routines of hundreds connected to New Zealand Defence Force installations. An investigation identified 565 Strava users who logged activities at NZDF bases and camps starting from January. Out of these profiles, 488 were publicly accessible, allowing others to view complete activity histories. Authorities could not verify that all accounts belonged to NZDF personnel, though most profiles displayed at least one sign of military affiliation.
The recorded workouts spanned key defence sites across New Zealand, such as Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Some users recorded exercises within Papakura Military Camp, home to the New Zealand Special Air Service, while others logged activity at the nearby Ardmore training zone. Public segments surfaced at military locations, with names tied to base routes and fitness assessments. Certain segment leaderboards had been displaying user names since 2018.
Overseas activity extended the exposure beyond New Zealand borders. Users documented workouts across 13 different countries and territories, including Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. There was also activity noted in Antarctica. Some profiles revealed movements between New Zealand military bases and foreign facilities, creating public records linking individuals to specific locations and travel patterns.
Public data exposes detailed military routines
Strava enables users to record and share activities like runs and rides via GPS tracking. Its public segments often feature leaderboards for popular routes. The data examined included 41 public segments at defence-related sites. Even some private profiles appeared on public leaderboards by name. In at least 30 instances, these names helped connect activities across multiple military locations. Linked accounts or tagged activities also revealed family ties in 13 cases.
Beyond location data, some accounts shared photos, videos, and workout titles associated with training at military sites. Examples included activities at Waiouru and other training zones. Separate profiles documented workouts near overseas bases and diplomatic posts. A high-ranking member of NZDF posted activity under a real name while serving in the United States. That profile showed movements involving multiple military locations and runs near New Zealand’s embassy in Washington.
NZDF guidelines highlight fitness tracking security concerns
The NZDF has issued warnings to its personnel about the risks associated with fitness-tracking apps and social media. Its recommendations include disabling fitness tracking functions in sensitive areas and refraining from using full names on such platforms. The Defence Force stated it implements measures to safeguard personnel, facilities, operations, and information, along with regular guidance on handling personal data and operational security, especially prior to deployments. However, NZDF does not have a specific policy governing Strava or similar fitness-tracking services.
Strava offers privacy controls that allow users to restrict what others can see. Activities can be limited to followers or kept private, parts of a route can be hidden, or entire maps can be concealed. The platform also recommends users consider setting stricter privacy options around workplaces and sensitive sites. When activities are restricted to followers or personal views, they are excluded from public leaderboards. NZDF clarified that fitness-tracking data shared online alone does not necessarily constitute a security breach or violate operational security requirements.