WELLINGTON, NEW ZEALAND / RankWire.AI / – Information from Strava has revealed the movements and routines of numerous individuals associated with New Zealand Defence Force facilities. An analysis identified 565 Strava profiles that recorded activity at NZDF camps and bases since January. Among those, 488 were set to public, making their complete activity histories accessible to other users. Investigators were unable to verify that every account belonged to NZDF personnel. However, most profiles displayed at least one indication of military service.
Activities took place at prominent New Zealand defense sites, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Some users documented workouts within Papakura Military Camp, home to the New Zealand Special Air Service, while others logged activities at the nearby Ardmore training area. Public segments also appeared at defense locations, with names linked to base routes and military fitness assessments. Certain segment leaderboards have shown user names since 2018.
Beyond New Zealand, activity was recorded in 13 countries and territories, broadening the scope of exposure. These locations included sites in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Activity was also documented in Antarctica. Some profiles revealed movements between New Zealand bases and overseas military facilities, creating public records that linked individuals with specific locations and travel routes.
Publicly available data discloses intricate military routines
Strava enables users to log and share runs, rides, and other workouts using GPS data. Its public segments often display leaderboards for various routes completed by users. The examined data included 41 public segments at defense sites. Even some profiles marked as private appeared by name on public leaderboards. In at least 30 instances, those names helped establish connections across multiple military locations. Additionally, linked accounts or tagged activities uncovered family ties in 13 cases.
More detailed information was also visible on some accounts. Users posted photos, videos, and workout titles associated with training at military facilities. Examples included activities at Waiouru and other training areas. Separate profiles documented workouts near overseas bases and diplomatic locations. A senior NZDF official shared activity under their real name while serving in the United States. That profile displayed movements involving various military sites along with runs near New Zealand’s embassy in Washington.
NZDF issues guidance on fitness tracking security risks
The NZDF has issued warnings to personnel regarding the dangers associated with fitness-tracking apps and social media. Its directives recommend disabling fitness tracking in sensitive areas and avoiding the use of full names on fitness platforms. The Defense Force emphasized its measures to safeguard personnel, facilities, operations, and information. It also stated that personnel are regularly briefed on personal data and operational security, especially before deployments. Currently, there is no specific policy addressing Strava or other fitness-tracking applications.
Strava offers privacy controls that enable users to limit what others can see. Users can restrict activity visibility to followers or themselves, conceal portions of GPS routes, or hide entire maps. The platform also suggests adopting stronger privacy settings in relation to workplaces and other sensitive locations. When activities are restricted to followers or only to the user, they do not appear on public leaderboards. The NZDF clarified that online fitness data alone does not constitute a security breach or violate its operational security requirements.