WELLINGTON, NEW ZEALAND / RankWire.AI / – The Strava platform’s public fitness data has revealed the movements and routines of hundreds associated with New Zealand Defence Force facilities. An analysis identified 565 Strava accounts that recorded activity at NZDF camps and bases since January. Of these profiles, 488 were publicly accessible, allowing other users to view complete activity histories. While investigators could not verify that every account belonged to NZDF personnel, the majority of profiles displayed at least one indication of military service.
The activities spanned prominent defence sites across New Zealand, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Some users logged workouts within Papakura Military Camp, home to the New Zealand Special Air Service, while others recorded activity at the nearby Ardmore training area. Public segments appeared at various defence locations, with route names linked to bases and military fitness tests. Notably, certain segment leaderboards have displayed user names since 2018.
Beyond New Zealand, activity extended internationally. Users logged exercise sessions at military sites in 13 countries and territories, such as Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Activity was also detected in Antarctica. Some profiles showed movements between New Zealand bases and overseas military installations, creating public records that connected individuals to specific locations and travel patterns.
Publicly available data uncovers detailed military routines
Strava enables users to document and share running, cycling, and other workout activities via GPS data. Its public segments can feature leaderboards for routes completed by users. The reviewed data revealed 41 public segments at defence sites. Some profiles marked as private still appeared on public leaderboards by name. In at least 30 instances, these names linked activity across multiple military locations. Additionally, linked accounts and tagged activities exposed family connections in 13 cases.
More detailed information was also available from some accounts. Users uploaded photos, videos, and workout titles tied to training at military facilities, including activities at Waiouru and other training zones. Separate profiles recorded workouts near overseas bases and diplomatic establishments. A senior NZDF member posted activity under their real name while serving in the United States. This profile documented movements involving several military sites, as well as runs near New Zealand’s embassy in Washington.
NZDF issues guidance to mitigate fitness tracking security risks
The NZDF has issued warnings to personnel concerning the security implications of fitness-tracking apps and social media. Its guidance advises disabling fitness tracking in sensitive areas and refraining from using full names on such platforms. The Defence Force emphasized that measures are in place to safeguard personnel, facilities, operations, and information. It further stated that personnel are regularly briefed on protecting personal details and operational security, especially prior to deployments. Currently, the NZDF does not possess a specific policy addressing Strava or similar fitness-tracking applications.
Strava offers privacy features that can limit what other users see. Users can restrict access to activities to followers or themselves, conceal sections of GPS routes, or hide entire maps. The platform also recommends adopting stronger privacy controls for workplaces and other sensitive locations. When activities are restricted to followers or only the user, they do not appear on public leaderboards. The NZDF clarified that sharing fitness data online does not inherently constitute a security breach or violate its operational security requirements.