Fitness app data exposes location of hundreds of NZDF staff

Security experts warn the data from fitness app Strava could provide valuable intelligence to foreign adversaries. NZDF has known about the risk for years, but has no specific policy to stop it. Ed O'Driscoll has this exclusive investigation.

It's just after midday at Ohakea Air Force Base.

A runner heads out on a 6km loop beside the airfield. Within minutes, the workout appears on the fitness app Strava.

Over the following weeks, the same account records workouts in Guam, outside Kadena Air Base in Japan - a major US Air Force installation, and Darwin, before returning to New Zealand.

Posted under the user's real name, the runs create a detailed public record of their movements across the Pacific.

The account was one of more than 500 uncovered by a 1News investigation. Their activity was logged at NZDF sites in New Zealand and across 13 countries and territories overseas.

Strava allows users to map and share their runs, walks and rides.

While military bases are not secret, security experts say fitness data can be pieced together to build a "pattern of life" picture of day-to-day military operations.

"You've got potential adversaries that are always interested in collecting intelligence," said David Capie, Director of the Centre for Strategic Studies at Victoria University of Wellington.

"The ability to vacuum up public information like this is a real help to them."

Capie said it would be "naive" to assume countries weren't trying to collect information about New Zealand's military.

Documents obtained by 1News show NZDF members have been repeatedly warned about the risks of sharing fitness data.

The latest warning came in June after a French naval officer using Strava inadvertently exposed the location of an aircraft carrier deployed towards the Middle East.

Even sharing unclassified information increases the risk of personnel being targeted through "cultivation and exploitation" and could compromise security, the warning said.

Since January, 565 Strava users have been identified logging activity at NZDF camps and bases by the 1News investigation. These locations include Whenuapai, Devonport, Ohakea, Linton, Burnham, Waiouru and Woodbourne.

Some ran inside Papakura Military Camp, home to the NZSAS. Others appeared at the nearby Ardmore training facility, used for special operations training.

Of the 565 profiles, 488 were public - meaning their full activity histories were visible to anyone.

Not every profile could be confirmed as belonging to NZDF personnel. But most showed at least one marker of military service - including activity across multiple bases, military-specific training, or workouts at overseas military installations.

The profiles were found through Strava's "segments" feature - running and cycling routes with public leaderboards showing users who have completed them.

A simple search uncovered 41 public segments at defence sites, including "Loop in Base" and "Base Escape!" at Whenuapai, "Runway Dash" at Ohakea and "Linton RFL" - a reference to the Required Fitness Level test soldiers must pass.

Some leaderboards had been active with lists of names since 2018.

"You've instantly got a list of names that are almost certainly people in the military," said Cole Proebstel, a former New Zealand Army intelligence specialist and founder of ALCON Intelligence.

"An actor can then go and look at other social media profiles, and then figure out your relationships, the network you're part of, who you work for, potentially your position, your rank, and what you might have access to."

Even users with private profiles appeared by name on public leaderboards. In at least 30 cases, that was enough for 1News to track activity across multiple military sites.

In 13 cases, family members could be identified through linked accounts or tagged activity.

The investigation identified activity at military sites around the world logged under users' own names.

Australia accounted for the largest overseas footprint, with activity at major air force bases in Richmond and Amberley, as well as Townsville and Edinburgh, where surveillance and signals intelligence operations are based.

In the US, personnel logged workouts at Joint Base Pearl Harbor-Hickam in Hawaii and Fort Irwin, an Army training centre in California.

Personnel shared runs inside Desiderio Army Airfield in South Korea - part of Camp Humphreys, the largest US military base outside the United States.

Capie said there was a significant difference between sharing a run around Waiouru and revealing activity at an overseas military posting.

"When you're seeing people posted offshore, close to potential combat zones, conflict zones, operationally deployed - that is much more concerning and a real risk to operational security," he said.

"We do have New Zealanders on the Korean Peninsula. We have New Zealanders training Ukrainian forces in Eastern Europe," he said. "Those situations can move from peace to war very quickly at the moment."

Other profiles revealed activity at RAF bases in the UK, camps in Egypt's Sinai Peninsula, where NZDF personnel serve with the Multinational Force and Observers, and Scott Base and McMurdo Station in Antarctica.

Activity was also found at military sites in the Philippines, Fiji and Rarotonga.

In March, two accounts appeared to follow a diplomatic and trade delegation led by Foreign Minister Winston Peters through Latin America, with workouts logged in Buenos Aires, Montevideo and near the Brazilian Army headquarters in Brasilia.

Another user deployed to Tonga described the country as "home for the next week", revealing their location and how long they expected to remain there.

The exposure ran both ways. Visiting Australian, Bruneian, Singaporean and Canadian military personnel were also identified through Strava activity at NZDF bases.

One profile belonged to a high-ranking NZDF member posted to the New Zealand Embassy in Washington DC.

Because the user recorded activity under their real name, it was possible to verify their rank through a basic internet search.

The profile traced movements from Ohakea Air Force Base to the United States, including Ladd Army Airfield in Alaska and the Presidio of Monterey - a US military foreign language training centre.

Runs were also posted outside the embassy itself.

Some profiles revealed more than location, including specific details of military training.

At Waiouru, one user posted a photo holding a training rifle, captioned: "10 days in the field done and dusted."

Two others uploaded videos from inside the camp during Exercise Thunder Warrior, a live-fire exercise involving visiting Singaporean troops.

Other users recorded workouts at Army Bay on the Whangaparāoa Peninsula and the Kaipara Air Weapons Range, under titles including "battle training" and "Combat Fitness Test".

Photos and videos of pack marches, where personnel could be identified, were also found.

Proebstel said, individually, the posts may seem harmless.

"It's not until you combine that with other information that you might find online or through open source," he said.

"Once you have that rich intelligence picture, that's when it becomes a risk."

Strava's public heatmap revealed military bases and patrol routes in conflict zones around the world between 2015 and 2017.

"This is not a new issue. This is as old as time itself," said John Howard, a retired Major General and former NZDF Chief of Defence Intelligence.

"We were exposed to this in 2015, during operations in the Middle East. That threat hasn't gone away - it has only accelerated because of the use of technology."

Documents obtained by 1News show NZDF has warned personnel about the risks posed by fitness-tracking applications.

The military's social media handbook cites a case in which several New Zealand personnel visiting the US National Security Agency's Fort Meade headquarters were identified through a different fitness app in 2018.

The guidance warns personnel to disable fitness-tracking apps in sensitive locations and avoid using their full names on fitness platforms.

Howard said he wasn't surprised by 1News' findings. "I'm disappointed in relation to people's understanding of their own personal security and their professional security," he said.

"This is an open book for the world to see if you choose to look."

Proebstel said the responsibility ultimately sat with individual personnel.

"At the end of the day the security of yourself, your colleagues and of the mission is of the utmost importance."

International concern over Strava has grown this year in the wake of the US-Iran war.

More than 500 British Armed Forces personnel had exposed their locations at sensitive military sites, according to an investigation in the i Paper.

In August, Sky News identified more than 1300 users sharing workouts from US military facilities across the Middle East, including bases later targeted by Iran.

New Zealand's Defence Force has no policy specifically covering Strava or other fitness-tracking applications.

In a statement, it said: "NZDF applies a range of measures to protect personnel, facilities, operations and information, and expects all personnel to exercise sound judgement when using personal applications and online platforms."

It said personnel receive regular guidance on protecting personal information and maintaining operational security, including during pre-deployment training.

"The availability of fitness tracking (or other) information online does not of itself indicate a security breach or compromise of operations or non-compliance with NZDF requirements," the statement said.