1News investigation: NZDF fitness profiles expose military locations

More than 560 fitness tracking profiles have been identified logging physical workouts inside New Zealand Defence Force camps and bases, exposing sensitive operational movements and daily routines to foreign intelligence collection, according to a 1News investigation.

The accounts include military personnel mapping runs across domestic installations such as the Ohakea Air Force Base, Whenuapai, and the Papakura Military Camp—home to the NZSAS—alongside deployments in 13 countries and territories overseas. While military facilities are not secret, security experts warn that aggregated data from platforms like Strava allows potential adversaries to construct detailed “pattern of life” intelligence profiles.

“You’ve got potential adversaries that are always interested in collecting intelligence,” said David Capie, Director of the Centre for Strategic Studies at Victoria University of Wellington, noting that it would be naive to assume foreign actors are not harvesting public movement data.

Public Strava Profiles Expose New Zealand Military Sites

The 1News investigation uncovered 565 user accounts logging activity at New Zealand military sites since January. Of those profiles, 488 were set to public, exposing complete activity histories to anyone on the platform. The investigation tracked workouts through Strava’s public leaderboards and segments feature, which catalogued defence facility routes with titles such as “Loop in Base,” “Base Escape!” and “Runway Dash.”

Cole Proebstel, a former New Zealand Army intelligence specialist and founder of ALCON Intelligence, said the platform effectively provides an indexed directory of active service members. “You’ve instantly got a list of names that are almost certainly people in the military,” Proebstel said, explaining that threat actors can cross-reference those names with other social media networks to map personal relationships, military rank, and institutional access.

The digital footprint extended to high-ranking officials, including an NZDF member posted to the New Zealand Embassy in Washington DC whose public workouts traced travel between Alaskan airfields, the Presidio of Monterey language training centre, and the embassy perimeter. Other accounts revealed specific training exercises, live-fire drills, and operational details at locations including Waiouru, Linton, and Devonport.

Workouts Track New Zealand Military Activity Overseas

The investigation tracked New Zealand military workouts across multiple overseas jurisdictions, including Australia, the United Kingdom, Egypt’s Sinai Peninsula, South Korea, and Antarctica. Workouts were also logged near sensitive operational zones in Eastern Europe where New Zealand personnel assist in training Ukrainian forces.

“When you’re seeing people posted offshore, close to potential combat zones, conflict zones, operationally deployed—that is much more concerning and a real risk to operational security,” he said.

NZDF Warnings Follow Past Fitness App Security Breaches

Internal documents show that the New Zealand Defence Force has distributed warnings regarding fitness-tracking applications for years. The military’s social media handbook references a 2018 security breach where personnel visiting the United States National Security Agency’s Fort Meade headquarters were identified via a separate fitness platform. A more recent advisory was issued in June following an incident where a French naval officer using Strava inadvertently compromised the deployment location of an aircraft carrier headed toward the Middle East.

In an official statement, the NZDF noted that it applies comprehensive measures to safeguard personnel, facilities, and operations, expecting individual members to exercise sound judgment on digital platforms. “The availability of fitness tracking (or other) information online does not of itself indicate a security breach or compromise of operations or non-compliance with NZDF requirements,” the statement said.