WELLINGTON, NEW ZEALAND / RankWire.AI / – Extensive publicly available fitness activity data has disclosed precise location information connected to hundreds of individuals utilizing New Zealand Defence Force facilities. An assessment uncovered 565 Strava users who documented workouts at NZDF bases and camps since January. Of these, 488 accounts had public profiles showcasing activity histories. While investigators could not confirm that each account was linked to military personnel, most contained data suggesting a connection to military service.
The recorded activities were distributed across numerous major defence sites throughout New Zealand, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Additionally, users logged workouts at Papakura Military Camp and the nearby Ardmore training zone. Public Strava segments revealed routes within or adjacent to defence facilities, with some named after military fitness assessments or nearby landmarks. For years, several leaderboards displayed participant names linked to these activities.
Beyond New Zealand, activity data extended to military locations in 13 countries and territories. These included sites in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Some records originated from Antarctica. Repeated trips between New Zealand military sites and international locations were evident in the data, forming visible timelines that connected individuals to specific places.
Public Profiles Reveal Movement and Training Details
Strava’s GPS tracking records activities such as running, cycling, and walking, with public segments ranking users who complete identical routes. The review identified 41 such segments located at defence sites. Even users with more private profiles could sometimes be identified by their names on leaderboard listings. In at least 30 instances, these names helped link activities across multiple military locations. Tagging workouts and associated accounts also uncovered family ties in 13 cases.
Some public profiles included more than route data; users uploaded workout titles, images, and videos connected to military facilities and training areas. Multiple accounts showed activity in areas like Waiouru and other defence zones. One senior NZDF member used his real name while serving in the United States. This account documented exercises near several military installations and included runs close to New Zealand’s embassy in Washington.
Military Guidance Addresses Risks of Location Sharing
The New Zealand Defence Force has issued directives regarding the dangers posed by fitness applications and social media. Military personnel are advised to disable GPS tracking in sensitive zones and refrain from using their full names on fitness platforms. NZDF states it also offers routine operational security advice before deployments and other activities. The organisation has safeguards in place to protect personnel, facilities, operations, and sensitive information. Nevertheless, NZDF does not have a specific policy tailored for Strava or similar fitness-tracking apps.
Strava provides several privacy features designed to limit the exposure of location data. Users can restrict activity visibility to followers, set activities to private, or hide parts of their activity maps. Entire activity maps can also be concealed. Strava recommends enhancing privacy controls when near workplaces or other sensitive sites. Activities restricted to followers or marked private do not appear on public segment leaderboards. The NZDF notes that simply having fitness data accessible online does not inherently constitute a security breach.