WELLINGTON, NEW ZEALAND / RankWire.AI / – Publicly available fitness information from Strava has uncovered the movements and routines of hundreds of individuals connected to New Zealand Defence Force installations. An analysis identified 565 Strava users who logged activities at NZDF military sites since January. Of these, 488 profiles were public, exposing complete activity histories to other users. While investigators couldn’t confirm that every account belonged to NZDF personnel, most profiles showed at least one indication of military affiliation.
Activities spanned key defense locations across New Zealand, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Some individuals recorded workouts within Papakura Military Camp, home to the New Zealand Special Air Service, while others logged activity at nearby Ardmore training grounds. Public segments associated with base routes and military fitness tests also surfaced, with some leaderboards displaying user names since 2018.
Overseas activity extended the exposure to 13 countries and territories, with workouts documented in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Activity was also recorded in Antarctica. Certain profiles tracked movements between New Zealand military bases and international facilities, creating public records that linked individuals to specific locations and travel routes.
Open data uncovers detailed military activity patterns
Strava enables users to record and share runs, rides, and other workouts via GPS. Its public segments often feature leaderboards for popular routes. The review identified 41 public segments at defense sites. Some private profiles appeared on leaderboards with their names visible. In over 30 instances, these names connected activity across multiple military locations. Additionally, linked accounts or tagged activities revealed family connections in 13 cases.
Beyond location data, users shared photos, videos, and workout titles linked to military training. Activities at Waiouru and other training zones were documented, and separate profiles showed workouts near overseas bases and diplomatic areas. A high-ranking NZDF member posted activity under their real name while stationed in the United States. That account displayed movements between several military sites and runs near New Zealand’s embassy in Washington.
NZDF issues guidance to mitigate fitness tracking security concerns
The NZDF has issued warnings to personnel regarding risks associated with fitness-tracking apps and social media. Its guidance advises disabling fitness tracking in sensitive areas and avoiding the use of full names on such platforms. The Defence Force stated it takes measures to safeguard personnel, facilities, operations, and information, and provides regular guidance on personal data and operational security, especially before deployments. Currently, NZDF has no specific policy addressing Strava or similar apps.
Strava offers privacy features that can restrict visibility of activities, including limiting access to followers or oneself, hiding segments of GPS routes, or concealing entire maps. The platform recommends users consider enhanced privacy settings around workplaces and sensitive locations. When activities are restricted to followers or oneself, they do not appear on public leaderboards. The NZDF noted that online fitness data alone does not constitute a security breach or violate its policies.