WELLINGTON, NEW ZEALAND / RankWire.AI / – Public exercise activities have disclosed detailed location information linked to hundreds of individuals using New Zealand Defence Force facilities. An assessment identified 565 Strava users who recorded workouts at NZDF bases and camps since January. Of these, 488 accounts featured public profiles with visible activity histories. Authorities could not confirm that every account belonged to military personnel. Nonetheless, most contained data suggesting an association with military service.
The recorded activities spanned multiple prominent defence sites across New Zealand. These included Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Users also logged exercises at Papakura Military Camp and the nearby Ardmore training zone. Public Strava segments showcased routes within or surrounding defence facilities, some bearing names related to military fitness tests or base landmarks. For years, several leaderboards displayed participant names.
The data further revealed activity beyond New Zealand’s borders. Users tracked workouts at military locations across 13 countries and territories. These sites appeared in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Additional records originated from Antarctica. Some accounts demonstrated recurring travel between New Zealand military sites and overseas locations, creating visible timelines that linked individuals to specific places.
Public Profiles Reveal Travel Patterns and Training Details
Strava captures GPS data during activities like running, cycling, and walking. Its public segments rank users who complete identical routes. The investigation uncovered 41 public segments at defence sites. Even accounts with restricted privacy settings occasionally appeared on segment leaderboards by name. In over 30 instances, these names connected activities across multiple military locations. Tagged workouts and linked accounts also uncovered family ties in 13 cases.
Some public profiles included more than just route maps. Users uploaded workout titles, images, and videos related to training areas and military facilities. Several profiles showed activity near Waiouru and other defence sites. One senior NZDF member used a real name while based in the United States. His account displayed activities near several military installations, including runs close to New Zealand’s embassy in Washington.
Defense Authorities Issue Warnings on Location Data Risks
The New Zealand Defence Force has issued guidance highlighting the dangers associated with fitness apps and social media. Personnel are advised to disable fitness tracking in sensitive locations and to avoid using full names on such platforms. NZDF also states that it regularly provides operational security guidance before deployments and other activities. The organization employs measures to safeguard personnel, facilities, operations, and information. However, NZDF does not have a specific policy addressing Strava or other fitness-tracking services.
Strava provides several features that can help minimize the public display of location data. Users can restrict activity visibility to followers, set activities to private, or hide segments of recorded maps. Entire activity maps can also be concealed. Strava recommends strengthening privacy controls, especially near workplaces and sensitive sites. Activities restricted to followers or made private do not appear on public segment leaderboards. NZDF notes that having fitness data online does not necessarily constitute a security breach.