WELLINGTON, NEW ZEALAND / RankWire.AI / – Open-access fitness activity data has exposed precise location information associated with hundreds of individuals exercising at New Zealand Defence Force sites. An investigation identified 565 Strava users who logged workouts at NZDF bases and camps since January, with 488 having public profiles displaying activity histories. While not all accounts could be confirmed as belonging to military personnel, most exhibited details suggesting a connection to defense services.
These activities spanned numerous prominent defence locations across New Zealand, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Records also showed workouts at Papakura Military Camp and the adjacent Ardmore training area. Public segments on Strava covered routes within or around defence sites, some bearing names related to military fitness tests or base landmarks. For years, several leaderboards displayed participant identities.
The data also revealed activity outside New Zealand, with workouts logged at military sites in 13 different countries and territories. Locations appeared in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands, along with entries from Antarctica. Some accounts demonstrated repeated travel between New Zealand military bases and overseas installations, forming visible timelines that linked individuals to specific locations.
Public Profiles Reveal Movement Patterns and Training Locations
Using GPS data, Strava records activities like running, cycling, and walking. Its public segments allow ranking users who complete identical routes. The review uncovered 41 public segments at defence sites, where even users with private profiles sometimes appeared on leaderboards by name. In over 30 instances, these names facilitated connections between activity across multiple military locations. Tagged workouts and linked accounts also uncovered family ties in 13 cases.
Some profiles went beyond route data, with users posting workout titles, images, and videos related to training areas and military facilities. Several showed activity near Waiouru and other defense locations. One senior NZDF officer used a real name while in the United States, with activity logged near several military installations and close to New Zealand’s embassy in Washington.
Military Authorities Issue Advice on Location Data Risks
The New Zealand Defence Force has issued guidelines highlighting the security risks posed by fitness apps and social media. Staff are advised to disable fitness tracking in sensitive areas and avoid using their full names on such platforms. The NZDF also provides routine operational security guidance before deployments and other activities, along with measures designed to safeguard personnel, facilities, operations, and information. Nonetheless, the organization does not have a specific policy tailored to Strava or other fitness-tracking apps.
Strava offers features that can minimize public location sharing, including options to restrict activity visibility to followers, set activities as private, or hide parts of maps. Users can also conceal entire activity routes. The company recommends employing stronger privacy controls near workplaces and sensitive sites. Activities set to private or followers-only are not visible on public segment leaderboards. The NZDF states that having fitness data online does not necessarily constitute a security breach.