WELLINGTON, NEW ZEALAND / RankWire.AI / – Detailed location information linked to hundreds of individuals using New Zealand Defence Force facilities has been uncovered through public fitness activities. An investigation identified 565 Strava users recording workouts at NZDF bases and camps since January, with 488 of those accounts having public profiles displaying their activity histories. While investigators could not confirm that every profile belonged to defence personnel, most showed indications of a military connection.
These activity records spanned several key defence sites across New Zealand, such as Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Users also logged workouts at Papakura Military Camp and the adjacent Ardmore training area. Public Strava segments included routes within or surrounding military installations, with some segment names referencing military fitness tests or base landmarks, and participant names appearing on leaderboards for years.
The data extended beyond New Zealand borders, revealing activity at military sites in 13 countries and territories, including Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Records also originated from Antarctica. Certain accounts showed frequent travel between New Zealand military locations and overseas sites, creating visible timelines that linked individuals to specific places.
Public Profiles Reveal Movement and Training Data
Strava’s GPS tracking records activities like running, cycling, and walking, while its public segments rank users who complete identical routes. The review identified 41 public segments located at defence sites, and even users with more private profiles could sometimes be identified by name on segment leaderboards. In at least 30 instances, those names connected activities across various military locations. Tagged workouts and linked accounts also uncovered family relationships in 13 cases.
Profiles with public visibility often contained more than just route data; users uploaded workout titles, images, and videos related to training areas and military facilities. Several profiles showed activity around Waiouru and other defence locations. One senior NZDF member, using a real name while in the United States, displayed activity near multiple military installations and runs close to New Zealand’s embassy in Washington.
Security Warnings from Defence About Location Data
The New Zealand Defence Force has issued guidance highlighting the risks associated with fitness apps and social media, advising personnel to disable fitness tracking features in sensitive areas and avoid using full names on such platforms. NZDF states it also offers regular operational security guidance before deployments and other activities, with measures in place to safeguard personnel, facilities, operations, and information. Nonetheless, NZDF does not have a policy specifically addressing Strava or similar fitness-tracking apps.
Strava provides several privacy tools to help reduce public exposure, including options to limit activity visibility to followers, keep activities private, or hide parts of recorded routes. Users can also conceal entire activity maps, and Strava recommends employing stronger privacy controls near workplaces and sensitive sites. Activities shared only with followers or set to private do not appear on public segment leaderboards. NZDF emphasizes that having fitness data online does not automatically constitute a security breach.