WELLINGTON, NEW ZEALAND / RankWire.AI / – Public fitness information from Strava has revealed the movements and routines of hundreds connected to New Zealand Defence Force locations. An assessment identified 565 Strava users who logged activities at NZDF camps and bases since January. Of these profiles, 488 were public, making complete activity histories accessible to others. Investigators could not verify every account belonged to NZDF personnel. Nonetheless, most profiles displayed at least one indicator of military service.
The recorded activities spanned major New Zealand defence sites, such as Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Some users logged workouts within Papakura Military Camp, home to the New Zealand Special Air Service. Others recorded activity at Ardmore training ground nearby. Public segments also appeared at defence locations, with names associated with base routes and military fitness tests. Some segment leaderboards displayed user names since 2018.
Overseas activities expanded the exposure beyond New Zealand. Users recorded workouts at military sites across 13 countries and territories. These included locations in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Activity was also seen in Antarctica. Some profiles showed movements between New Zealand bases and international military facilities. This created public records linking individuals to specific places and travel routes.
Public data uncovers detailed military routines
Strava enables users to record and share runs, rides, and other workouts via GPS. Its public segments can display leaderboards for routes completed by users. The data reviewed included 41 public segments at defence sites. Even some private profiles appeared on public leaderboards by name. In at least 30 instances, those names helped connect activity across multiple military locations. Linked accounts or tagged activities also revealed family connections in 13 cases.
Some accounts disclosed more than just locations. Users posted photos, videos, and workout titles linked to training at military facilities. Examples included activities at Waiouru and other training grounds. Separate profiles showed workouts near overseas bases and diplomatic locations. A senior NZDF member posted activity under a real name while serving in the United States. That profile displayed movements involving several military sites and runs near New Zealand’s embassy in Washington.
NZDF issues guidance to mitigate fitness tracking risks
The NZDF has issued warnings to personnel about risks associated with fitness-tracking apps and social media. Its guidance advises disabling fitness tracking in sensitive areas and avoiding full names on fitness platforms. The Defence Force said it implements measures to protect personnel, facilities, operations, and information. It also provides regular guidance on personal information and operational security, especially before deployments. Currently, NZDF does not have a specific policy covering Strava or other fitness-tracking apps.
Strava offers privacy controls to limit what others can see. Users can restrict activities to followers or just themselves, hide parts of a GPS route, or hide entire maps. Strava recommends considering stronger privacy settings near workplaces and sensitive locations. When activities are restricted to followers or themselves, they do not appear on public leaderboards. NZDF stated that online fitness data alone does not constitute a security breach or violate its requirements.”