WELLINGTON, NEW ZEALAND / RankWire.AI / – Recent disclosures about public fitness tracking activities have exposed precise location information associated with hundreds of individuals utilizing New Zealand Defence Force facilities. An investigation identified 565 Strava users who logged workouts at NZDF bases and training camps since January, with 488 of those accounts maintaining public profiles that openly display their activity logs. While investigators could not confirm that every account belonged to members of the defense force, most contained details suggesting a link to military service.
These activity records spanned several prominent defense locations across New Zealand, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Additionally, workouts were documented at Papakura Military Camp and the nearby Ardmore training area, with public Strava segments covering routes situated within or surrounding these facilities. Some segment names referenced military fitness tests or notable base landmarks, and several leaderboards displayed participant names for multiple years.
Beyond national borders, activity logs also indicated that users had engaged in workouts across 13 different countries and territories, such as Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Some records even originated from Antarctica. Repeated travel between New Zealand military sites and foreign locations was evident in certain accounts, creating visible timelines that linked individuals to specific places and movements.
Public Profiles Reveal Details of Travel and Training
Strava employs GPS data to monitor activities like running, cycling, and walking, with public segments ranking users who complete the same routes. The review uncovered 41 public segments at defense sites, and even users with more restrictive profiles could occasionally be identified by name on segment leaderboards. In a minimum of 30 instances, these names facilitated connections between activity logs across various military locations. Additionally, tagged workouts and linked accounts sometimes revealed family relationships in 13 cases.
Beyond route information, some public profiles included workout titles, images, and videos tied to training areas and military facilities. Multiple profiles documented activity around Waiouru and other defense locations, while one senior NZDF member used their real name during service in the United States. That account showed activity near several military installations and included runs close to New Zealand’s embassy in Washington.
Defense Department Issues Advice on Location Data Privacy
The New Zealand Defence Force has issued guidance highlighting the security risks posed by fitness apps and social media, advising personnel to disable fitness tracking features when in sensitive locations and to refrain from using their full names on fitness platforms. The organization states it also regularly issues operational security advice before deployments and other critical activities, backed by measures designed to protect personnel, facilities, operations, and sensitive information. Nevertheless, NZDF does not have a specific policy addressing Strava or similar fitness-tracking apps.
Strava offers multiple privacy features that can help limit public exposure of location data, such as restricting visibility to followers, making activities private, or hiding parts of recorded routes; users can also entirely conceal their activity maps. Strava recommends enabling stronger privacy controls especially near workplaces and other sensitive sites. Activities set to private or visible only to followers do not appear on public segment leaderboards. While NZDF emphasizes that having fitness data online is not inherently a security breach, it underscores the importance of understanding and applying available privacy controls to mitigate risks.