WELLINGTON, NEW ZEALAND / RankWire.AI / – A recent analysis uncovered that 565 Strava users recorded workouts at New Zealand Defence Force bases and camps since January. Out of these, 488 accounts had public profiles with visible activity histories. While investigators could not confirm every account belonged to military personnel, most contained details suggesting a link to military service.
These activities were spread across several prominent defence sites in New Zealand, including Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru, and Woodbourne. Users also logged exercises at Papakura Military Camp and the nearby Ardmore training zone. Public Strava segments documented routes either within or around defence facilities, with some segments named after military fitness tests or base landmarks. For years, certain leaderboards displayed participant names.
Furthermore, the data showed activity outside New Zealand’s borders, with workouts recorded at military sites in 13 different countries and territories. Locations appeared in Australia, the United States, South Korea, Japan, Britain, Egypt, the Philippines, Fiji, and the Cook Islands. Records also originated from Antarctica. Several accounts indicated repeated travel between New Zealand military locations and overseas bases, creating visible timelines that linked individuals to specific sites.
Public profiles reveal travel routes and training details
Strava relies on GPS tracking to log activities such as running, cycling, and walking. Its public segments enable ranking users who complete identical routes. The investigation identified 41 public segments at defence sites. Even some users with more private profiles sometimes appeared by name on segment leaderboards. In at least 30 instances, those names were used to connect activity across various military locations. Tagged workouts and linked accounts also exposed family relationships in 13 cases.
Beyond route data, some public profiles included workout titles, images, and videos tied to training areas and military installations. Several profiles showed activity around Waiouru and other defence locations. One senior NZDF member used their real name while in the United States. This account displayed activity near multiple military facilities and included runs close to New Zealand’s embassy in Washington.
NZDF issues security advice regarding location sharing
The New Zealand Defence Force has issued guidelines addressing the potential risks posed by fitness apps and social media. Personnel are advised to disable fitness tracking functions in sensitive locations and to refrain from using full names on such platforms. The NZDF states it also offers routine operational security guidance prior to deployments and other activities. It maintains measures to safeguard personnel, facilities, operations, and information, but currently does not have a policy specifically tailored for Strava or similar fitness-tracking services.
Strava provides various privacy features that can limit the exposure of location information. Users can restrict activity visibility to followers, set activities as private, or hide sections of recorded maps. They can also choose to conceal entire activity maps. Strava recommends enhancing privacy controls especially near workplaces and other sensitive sites. Activities designated as followers-only or private are excluded from public segment leaderboards. The NZDF states that having fitness data online does not necessarily constitute a security breach.