WELLINGTON, NEW ZEALAND / RankWire.AI / – A total of 565 Strava users with activity logs at New Zealand Defence Force facilities have been identified, revealing the routines and locations of individuals linked to the NZDF. This discovery comes after a review of public fitness data from Strava. Since January, activity recordings were found at various NZDF camps and bases. Among these profiles, 488 were accessible publicly, allowing anyone to view complete activity histories. While investigators could not verify that every account belonged to NZDF personnel, the majority displayed at least one sign of military affiliation.
The recorded activities spanned prominent defense sites across New Zealand, such as Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Some logs documented workouts within Papakura Military Camp, which hosts the New Zealand Special Air Service, while others were logged at the adjacent Ardmore training zone. Public segments have also appeared at defense locations, with names associated with base routes and fitness assessments. Since 2018, some segment leaderboards have displayed user names.
Beyond New Zealand, activity logs extended to multiple countries, including Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands, with some records even in Antarctica. Certain profiles showed movement patterns linking New Zealand bases to overseas military facilities, creating public records that connect individuals with specific locations and travel routes.
Detailed military routines exposed through public data
Strava enables users to track and share activities like runs and rides via GPS. Its public segments feature leaderboards for popular routes. The data review uncovered 41 public segments at defense sites. Some activities associated with private profiles also appeared on public leaderboards, with at least 30 names linking activities across multiple military locations. Additionally, linked accounts or tagged activities identified family ties in 13 instances.
More than just locations, certain accounts included photos, videos, and workout descriptions related to military training. Examples included activities in Waiouru and nearby training zones. Separate profiles documented workouts at overseas bases and diplomatic areas. A senior NZDF member posted under their real name while serving in the United States, with activity logs involving several military locations and runs near New Zealand’s embassy in Washington.
NZDF issues guidance on fitness app security concerns
The NZDF has issued warnings to personnel regarding the security risks associated with fitness-tracking apps and social media. It recommends disabling GPS tracking in sensitive areas and refraining from using full names on such platforms. The Defence Force stated that it implements measures to safeguard personnel, facilities, operations, and information, with regular guidance provided on personal data and operational security, especially before deployments. Currently, there is no specific policy addressing Strava or similar fitness apps.
Strava offers privacy options that limit what others can see. Users can restrict activity visibility to followers or just themselves, hide portions of GPS tracks, or hide entire maps. The platform also advises users to enhance privacy settings around workplaces and other sensitive locations. When activities are restricted to followers or the user, they do not appear on public leaderboards. The NZDF emphasizes that sharing fitness data online alone does not constitute a security breach or violation of its policies.