WELLINGTON, NEW ZEALAND / RankWire.AI / – In recent investigations, detailed location data linked to hundreds of individuals using New Zealand Defence Force facilities has come to light through public fitness activity. A review identified 565 Strava users who logged workouts at NZDF bases and camps since January. Of these, 488 accounts featured public profiles with visible activity histories, though authorities could not confirm that each account belonged to defense personnel. Most, however, contained details suggestive of a link to military service.
Locations of activity spanned several key defence sites across New Zealand. These included Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Additionally, workout recordings took place at Papakura Military Camp and the nearby Ardmore training area. Public Strava segments covered routes within or surrounding defence installations, some with names associated with military fitness tests or base landmarks. Several leaderboards displayed participant names over multiple years.
Beyond New Zealand, activity logs showed that users recorded workouts at military sites across 13 countries and territories. Locations were identified in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Records also originated from Antarctica. Evidence indicated repeated travel between New Zealand military sites and overseas locations, creating timelines that linked individuals to specific places.
Public Profiles Reveal Travel Routes and Training Data
Using GPS data to log activities like running, cycling, and walking, Strava’s public segments can rank users completing identical routes. The review identified 41 public segments at defence locations. Even users with restricted profiles sometimes appeared by name on segment leaderboards. In at least 30 instances, these names facilitated linking activities across various military sites. Additionally, tagged workouts and linked accounts uncovered family relationships in 13 cases.
Beyond route maps, some public profiles included workout titles, images, and videos connected to military training areas. Multiple profiles demonstrated activity around Waiouru and other defence locations. One senior NZDF member utilized a real name while stationed in the United States, with activity recorded near several military installations and runs close to New Zealand’s embassy in Washington.
Military Authorities Issue Warnings on Location Data Sharing
The New Zealand Defence Force has issued guidance highlighting the risks associated with fitness apps and social media. Personnel are advised to disable fitness tracking in sensitive areas and refrain from using their full names on such platforms. The NZDF also states that it regularly provides operational security guidance before deployments and other military activities. Measures are in place to safeguard personnel, facilities, operations, and information; however, there is no specific policy tailored to Strava or similar fitness-tracking applications.
Strava offers several privacy tools to mitigate location exposure. Users can restrict activity visibility to followers, set activities to private, or hide portions of maps. Entire activities can also be concealed. The company recommends employing stronger privacy controls near workplaces or other sensitive sites. Activities limited to followers or marked as private do not appear on public segment leaderboards. The NZDF states that having fitness data online does not automatically constitute a security breach.