WELLINGTON, NEW ZEALAND / RankWire.AI / – The activity data publicly shared on Strava has shed light on the routines and movements of hundreds associated with New Zealand Defence Force facilities. An analysis identified 565 Strava profiles that logged activities at NZDF camps and bases starting from January. Out of these, 488 profiles were publicly accessible, allowing other users to view complete activity histories. It was not possible for investigators to verify that every account belonged to NZDF personnel, although most profiles showed at least one indicator of military affiliation.
The recorded activities spanned key New Zealand defense sites, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Some users documented workouts within Papakura Military Camp, which is home to the New Zealand Special Air Service, while others recorded activities at the nearby Ardmore training zone. Publicly visible segments also appeared at defense locations, with names linked to base routes and military fitness assessments. Certain segment leaderboards had displayed user names since 2018.
Activities extended beyond New Zealand, broadening the exposure to overseas military sites. Users recorded workouts at locations across 13 countries and territories, including Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Activity logs even surfaced in Antarctica. Some profiles revealed movements between New Zealand military bases and foreign facilities, generating public records that linked individuals to specific locations and travel patterns.
Publicly accessible data uncovers detailed military routines
Strava enables users to track and share runs, bike rides, and other workouts via GPS data. Its public segments feature leaderboards for routes completed by users. The data under review included 41 public segments at defense-related sites. Even some profiles marked as private appeared on public leaderboards by name. In at least 30 instances, these names helped connect activities across multiple military locations. Additionally, linked accounts or tagged activities exposed family connections in 13 cases.
Beyond locations, some accounts displayed more than just coordinates. Users uploaded photos, videos, and workout titles associated with training at military facilities, including activities at Waiouru and other training zones. Separate profiles recorded exercises near overseas bases and diplomatic locations. One high-ranking NZDF member posted activity under a real name while serving in the United States, showing movements involving multiple military sites and runs near New Zealand’s embassy in Washington.
NZDF issues guidelines to address fitness tracking security concerns
The NZDF has issued warnings to personnel regarding risks associated with fitness-tracking apps and social media. Its guidance advises disabling fitness tracking features in sensitive locations and avoiding the use of full names on such platforms. The Defense Force stated that it implements measures to safeguard personnel, facilities, operations, and information. It also mentioned that personnel regularly receive guidance on managing personal data and operational security, especially prior to deployments. Currently, NZDF does not have a specific policy solely addressing Strava or similar fitness-tracking applications.
Strava offers privacy options that can limit what others see. Users can restrict activity visibility to followers or themselves, hide parts of GPS routes, or make entire maps private. The platform recommends considering more robust privacy settings in relation to workplaces and sensitive locations. When activities are limited to followers or to oneself, they do not appear on public leaderboards. The NZDF emphasized that online fitness data alone does not constitute a security breach or violate its security protocols.