WELLINGTON, NEW ZEALAND / RankWire.AI / – Recent analysis of public fitness activity has uncovered precise location information associated with hundreds of individuals utilizing New Zealand Defence Force facilities. An investigation identified 565 Strava users who logged workouts at NZDF bases and camps starting from January. Out of these, 488 accounts featured public profiles with accessible activity histories. While it was not possible for investigators to confirm that all accounts belonged to defense personnel, most contained data suggesting a link to military service.
These activities were spread across several prominent defense sites in New Zealand, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Users also recorded exercise sessions at Papakura Military Camp and the nearby Ardmore training area. Public segments on Strava captured routes within or near military facilities, with some carrying names associated with military fitness assessments or base landmarks. For years, certain leaderboards displayed participant names.
Furthermore, the records demonstrated activity outside New Zealand’s borders. Users documented workouts at military locations across 13 countries and territories, including sites in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Additional data originated from Antarctica. Some accounts indicated repeated travel between New Zealand military sites and foreign locations, creating visible timelines that linked individuals to specific places.
Public Profiles Reveal Travel and Training Activities
Strava relies on GPS data to log activities like running, cycling, and walking. Its public segments enable ranking of users completing identical routes. The review uncovered 41 public segments situated at defense locations. Even users with more restricted profiles were occasionally visible by name on segment leaderboards. In at least 30 instances, these names helped establish connections between activities at various military sites. Additionally, tagged workouts and linked accounts exposed family relationships in 13 cases.
Some profiles included more than just route information. Users uploaded workout titles, images, and videos tied to training zones and military installations. Several accounts showed activity around Waiouru and other defense sites. One senior member of the NZDF used a real name while stationed in the United States. This account displayed activity near multiple military bases and runs close to New Zealand’s embassy in Washington.
Military Authorities Issue Caution Over Location Data Risks
The New Zealand Defence Force has issued official guidance addressing the dangers posed by fitness apps and social media. Personnel are advised to turn off fitness tracking features when in sensitive areas and to avoid using their full names on fitness platforms. NZDF states it also provides ongoing operational security guidance ahead of deployments and other missions. The organization employs measures to safeguard personnel, facilities, operations, and information. Nevertheless, NZDF does not have a specific policy addressing Strava or similar fitness-tracking apps.
Strava provides several privacy features designed to minimize location exposure. Users can restrict visibility to followers, set activities to private, or conceal parts of their recorded routes. Entire activity maps can also be hidden. Strava recommends activating robust privacy controls, especially near workplaces and other sensitive locations. Activities designated for followers or marked private do not appear on public segment leaderboards. According to NZDF, having fitness data online does not automatically constitute a security breach.