WELLINGTON, NEW ZEALAND / RankWire.AI / – Public fitness information shared on Strava has uncovered the routines and locations of hundreds associated with New Zealand Defence Force. An analysis identified 565 Strava users who logged activities at NZDF facilities since January. Of these, 488 profiles were set to public, allowing other users to see complete activity histories. Investigators were unable to verify that every account belonged to NZDF personnel. Nonetheless, most profiles contained at least one indicator of military service.
The recorded activities spanned key defence sites across New Zealand, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Some users documented workouts within Papakura Military Camp, home to the New Zealand Special Air Service, while others logged activities at nearby Ardmore training grounds. Public segments appeared at various defence locations, with names linked to base routes and military fitness assessments. Certain segment leaderboards had displayed user names since 2018.
The scope extended beyond New Zealand as activity was recorded at military sites across 13 countries and territories. Locations included sites in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Activity was also documented in Antarctica. Some profiles showed movements between New Zealand bases and overseas military installations, creating public records that linked individuals to specific locations and travel patterns.
Publicly available data exposes detailed military routines
Strava enables users to track and share runs, rides, and other workouts via GPS data. Its public segments can display leaderboards for popular routes. The data reviewed included 41 public segments at defence locations. Even some private profiles appeared on public leaderboards by name. In at least 30 cases, those names helped connect activity across multiple military sites. Linked accounts or tagged activities also revealed family connections in 13 instances.
Some profiles revealed more than just location data. Users uploaded photos, videos, and workout titles related to military training. Examples included activities at Waiouru and other training areas. Separate profiles showed workouts near overseas bases and diplomatic sites. A high-ranking member of NZDF posted activity under their real name while in the United States. This profile displayed movements involving various military locations and runs near New Zealand’s embassy in Washington.
NZDF issues guidance to mitigate fitness tracking security risks
The NZDF has issued warnings to personnel about the security risks associated with fitness-tracking apps and social media. Its guidance recommends disabling fitness tracking in sensitive areas and avoiding the use of full names on such platforms. The Defence Force states it implements measures to safeguard personnel, facilities, operations, and information. It also provides regular advice on handling personal data and operational security, especially before deployments. Currently, NZDF does not have a policy specifically addressing Strava or similar fitness applications.
Strava offers privacy controls that allow users to restrict what others can see. These include limiting activity visibility to followers or oneself, concealing parts of a GPS route, or hiding an entire map. The company advises users to adopt stronger privacy settings when dealing with workplaces or other sensitive locations. When activities are limited to followers or themselves, they are excluded from public leaderboards. The NZDF states that online fitness data alone does not constitute a security breach or violate operational security requirements.