WELLINGTON, NEW ZEALAND / RankWire.AI / – Detailed location data associated with hundreds of individuals using New Zealand Defence Force facilities has come to light through public fitness tracking activities. An investigation identified 565 Strava users who logged workouts at NZDF bases and camps since January. Of these, 488 had public profiles displaying their activity histories openly. Authorities could not confirm that each account belonged to defense personnel, but most contained details suggestive of military affiliations.
The recorded activities spanned multiple key defense sites across New Zealand. These included Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Users also tracked workouts at Papakura Military Camp and nearby Ardmore training grounds. Public segments on Strava revealed routes inside or around defense installations. Some segment names referenced military fitness assessments or prominent base landmarks. Participant names appeared on leaderboards for several years, indicating long-term visibility.
Locations outside New Zealand were also involved. Users logged activities at military sites across 13 countries and territories. These included Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Some records even originated from Antarctica. Repeated travel between New Zealand military sites and overseas locations was evident in certain accounts. This data provided visible timelines, linking individuals to specific places.
Public profiles reveal travel routes and training details
Strava relies on GPS data to track activities such as running, cycling, and walking. Its public segments can rank users sharing the same routes. The review uncovered 41 public segments at defense sites. Even users with restricted profiles sometimes appeared by name on leaderboards. In at least 30 cases, those names connected activities across multiple military locations. Tagged workouts and linked accounts also identified family relationships in 13 instances.
Some public profiles included more than just route information. Users uploaded workout titles, images, and videos linked to training areas and military facilities. Several profiles showed activity around Waiouru and other defense locations. One senior NZDF member used his real name while serving in the United States. His account displayed activity near multiple military installations and runs close to New Zealand’s embassy in Washington.
Military authorities issue warnings about location-sharing through fitness apps
The New Zealand Defence Force has issued guidance highlighting the dangers associated with fitness apps and social media. Staff members are advised to disable fitness tracking features in sensitive areas and to avoid using their full names on fitness platforms. NZDF states it also provides ongoing operational security advice prior to deployments and other operational activities. The organization has measures in place to safeguard personnel, facilities, operations, and sensitive information. Nonetheless, NZDF does not have a specific policy for Strava or other fitness-tracking services.
Strava offers several privacy options to minimize location exposure. Users can restrict activity visibility to followers, make activities private, or hide specific map segments. They can also choose to hide entire activity maps. Strava recommends utilizing these privacy controls especially near workplaces and sensitive sites. Activities limited to followers or set to private will not appear on public segment leaderboards. The NZDF emphasizes that having fitness data online does not automatically constitute a security breach.