WELLINGTON, NEW ZEALAND / RankWire.AI / – Publicly available fitness data from Strava has uncovered the routines and movements of hundreds of individuals associated with New Zealand Defence Force. An analysis identified 565 Strava users who recorded activity at NZDF camps and bases since January. Out of these profiles, 488 were accessible to the public, revealing complete activity histories to other users. Investigators were unable to verify that every account belonged to NZDF personnel, but most profiles displayed at least one indicator of military service.
The recorded activities covered key New Zealand defence sites, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Some users logged workouts within Papakura Military Camp, which houses the New Zealand Special Air Service. Others recorded activity at the nearby Ardmore training zone. Public segments also appeared at defence locations, with names linked to base routes and military fitness assessments. Since 2018, some segment leaderboards have displayed user names.
The exposure extended beyond New Zealand through activity recorded at military sites across 13 countries and territories. These included locations in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Activity was also noted in Antarctica. Some profiles displayed movements between New Zealand bases and overseas military facilities, creating public records that linked individuals to particular locations and travel routes.
Publicly available data exposes detailed military routines
Strava enables users to log and share runs, rides, and other workouts using GPS tracking. Its public segments often feature leaderboards for routes completed by users. The review uncovered 41 public segments at defence locations. Notably, some private profiles appeared on public leaderboards by name. In over 30 instances, these names helped connect activity across various military sites. Additionally, linked accounts or tagged activities revealed family ties in 13 cases.
Some profiles revealed more than just location data. Users uploaded photos, videos, and workout titles associated with training at military facilities. Examples included activities at Waiouru and other training zones. Separate profiles documented workouts near overseas bases and diplomatic sites. A senior NZDF member posted activity under a real name while serving in the United States. That profile showed movements involving multiple military locations as well as runs near New Zealand’s embassy in Washington.
NZDF issues guidelines to mitigate fitness tracking security risks
The NZDF has issued warnings to personnel regarding the security risks linked to fitness-tracking apps and social media. Its guidance advises personnel to disable fitness tracking functions in sensitive areas and to avoid using their full names on fitness platforms. The Defence Force states it employs measures to safeguard personnel, facilities, operations, and information. It also provides regular guidance on managing personal information and operational security, especially before deployments. Currently, NZDF does not have a specific policy addressing Strava or similar fitness-tracking applications.
Strava offers privacy options that can restrict what others see. Users can limit activity visibility to followers or themselves, hide parts of GPS routes, or block entire maps. Strava also recommends adopting stronger privacy controls around workplaces and other sensitive locations. When users set activities to followers or private, those activities do not appear on public leaderboards. The NZDF states that online fitness-tracking data alone does not constitute a security breach or violate its operational security requirements.