WELLINGTON, NEW ZEALAND / RankWire.AI / – Data from Strava, a popular fitness tracking platform, has uncovered the routines and locations associated with hundreds linked to New Zealand Defence Force. An analysis identified 565 users who recorded activities at NZDF installations since January. Of these, 488 profiles were public, allowing others to see complete records of their activities. While investigators could not verify that every account belonged to NZDF personnel, most profiles showed at least one sign of military affiliation.
The recorded activities spanned key defence sites across New Zealand, such as Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Some users documented workouts inside Papakura Military Camp, home to the New Zealand Special Air Service, and at the nearby Ardmore training zone. Publicly visible segments included routes associated with bases and military fitness assessments, with some leaderboards displaying user names since 2018.
Beyond New Zealand, activity extended internationally, exposing movements at military locations across 13 countries and territories. These locations included sites in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Activity was also detected in Antarctica. Profiles showed travel between NZDF bases and overseas military sites, creating accessible records that linked individuals to specific locations and travel routes.
Publicly accessible data exposes detailed military routines
Strava’s platform enables users to log and share runs, rides, and various workouts via GPS data. Its public segments often feature leaderboards for popular routes. In the data examined, 41 public segments at defence locations were identified. Even some private profiles appeared on public leaderboards, with at least 30 of these linking activity to multiple military sites through names. Additionally, linked accounts or tagged activities uncovered family relationships in 13 instances.
More than mere location data was revealed by some accounts. Users uploaded photos, videos, and workout titles associated with training at military facilities. Activities at Waiouru and other training zones were documented, and separate profiles showed workouts near overseas bases and diplomatic locations. Notably, a senior NZDF member posted activity under their real name while serving in the United States. That profile included movements involving multiple military sites and runs near New Zealand’s embassy in Washington.
NZDF issues guidance to mitigate fitness tracking security risks
The NZDF has issued warnings to personnel about the potential security risks posed by fitness-tracking apps and social media. Its guidance recommends disabling fitness tracking in sensitive locations and avoiding the use of full names on such platforms. The Defence Force emphasized that it employs measures to safeguard personnel, facilities, operations, and information. It also states that personnel receive ongoing guidance concerning personal data and operational security, including prior to deployments. Currently, there is no specific policy addressing Strava or other fitness-tracking applications.
Strava offers privacy controls that allow users to limit what others can see. Options include restricting activity visibility to followers or oneself, concealing parts of GPS routes, or hiding entire maps. The platform also recommends users consider stronger privacy settings around workplaces and sensitive areas. When activities are limited to followers or oneself, they do not appear on public leaderboards. NZDF noted that sharing fitness data online does not inherently constitute a security breach or violate operational protocols.