WELLINGTON, NEW ZEALAND / RankWire.AI / – The Strava platform has inadvertently disclosed the activity patterns of hundreds connected to New Zealand Defence Force facilities. An analysis identified 565 users who logged workouts at NZDF installations since January. Of these, 488 accounts were set to public, allowing other users to see complete activity histories. While investigators could not verify every profile as belonging to NZDF personnel, most displayed at least one sign of military service.
The activities spanned prominent New Zealand defence sites such as Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru and Woodbourne. Some users recorded exercises within Papakura Military Camp, the base for the New Zealand Special Air Service, and others logged activity at the nearby Ardmore training range. Public segments tied to base routes and military fitness tests appeared at various defence locations, with some leaderboards showing user names since 2018.
The scope extended beyond New Zealand borders, with activity recorded in 13 countries and territories, including Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Activity was also visible in Antarctica. Some profiles indicated travel between New Zealand military bases and overseas facilities, creating public records that linked individuals to particular locations and movement patterns.
Publicly available data uncovers detailed military routines
Strava’s platform enables users to document and share runs, rides, and other workouts via GPS. Its public segments often display leaderboards for popular routes. Among the data reviewed, 41 public segments appeared at defence sites. Surprisingly, even some private profiles surfaced on public leaderboards through their names. In at least 30 instances, those names helped connect activity across multiple military locations. Additionally, linked accounts or tagged activities revealed family connections in 13 cases.
Certain profiles revealed more than just locations. Users shared photos, videos, and workout titles related to military training, including exercises at Waiouru and other training areas. Separate profiles documented workouts near overseas bases and diplomatic locations. A senior NZDF member posted activity under a real name while stationed in the United States. That account showed movements involving various military sites, as well as runs near New Zealand’s Washington embassy.
NZDF issues guidelines to mitigate fitness tracking security risks
The NZDF has issued warnings to its personnel regarding the potential security risks posed by fitness-tracking apps and social media. Its directives advise personnel to disable fitness tracking when in sensitive areas and to avoid using their full names on fitness platforms. The Defence Force emphasizes its efforts to safeguard personnel, facilities, operations, and sensitive information. Regular guidance on personal data and operational security is provided, particularly before deployments. Currently, the NZDF lacks a specific policy addressing Strava or similar fitness applications.
Strava offers privacy features that enable users to control what others can see. Users can restrict activity visibility to followers or themselves, obscure parts of GPS routes, or hide entire maps. The company recommends considering stricter privacy settings near workplaces and other high-security locations. When activities are limited to followers or private, they are excluded from public leaderboards. The NZDF has clarified that online fitness data alone does not constitute a security breach or violate its security protocols.