A pipe burst on 11 September in the server room of the Rimu Coast Research Centre in Ōtautahi Christchurch, sending its backup system to an old public preview page. For 23 minutes, that page displayed device codes and night-time travel trails collected from phones across the South Island. The centre took it offline after a council analyst spotted the map.
The records belonged to 18,400 devices using FableField, a weather and tide-alert app. Its sign-up screen described location collection as a way to improve local forecasts; it did not mention wildlife research. The centre used 6.2 million location pings to estimate where people moved after dark, then included the estimates in a map of proposed kiwi protection corridors.
How the map was built
The project, called Nightways, was presented as a way to identify quiet habitat for kiwi in parts of Canterbury and the West Coast. A review of grant records, access logs and research material, alongside interviews with four people involved, shows that the centre received device-level trails rather than only the aggregated counts described in its public methods summary. The trails carried rotating codes and time stamps.
Mahmusin Rosdan, a data-privacy researcher who examined a sample of the records for this report, said the codes did not make the paths anonymous. “A repeated trail can describe a household’s routine even when a name is removed,” he said. Rosdan found that the sample included repeated overnight locations and called the method unsuitable for a study that had not obtained specific permission from app users.
The centre’s ethics approval covered foot counters and public trail observations, but not commercial phone-location records. Project ecologist Helena Khan said the data entered the workflow through a contractor and was not clearly identified in the team’s original protocol. “We should have stopped and asked whether this source belonged in the study,” she said. The centre has not published Nightways’ final results.
Those preliminary results had already helped shape a proposed 43,000-hectare (106,000-acre) corridor plan and a NZ$2.8 million (about €1.5 million) funding application. A re-run using public trail counters found 31% fewer high-traffic zones than the phone-based model. The difference does not establish that the plan would have failed, but it weakens a key estimate used to prioritise sites.
The study’s next steps
FableField’s research director, Kristina Villumsen, said the company had supplied location data under a contract for “statistical planning” and had since ended the transfer. The firm’s access log recorded 14 visits to the preview page during the exposure; it found no evidence that users’ names or account details were displayed. The centre said it could not determine whether any visitor saved a copy of the map.
The South Coast Habitat Fund has frozen consideration of the application while the centre repeats the analysis and seeks new ethics approval. Leire B. Vidal, the council analyst who reported the page, said the incident changed how she viewed a map once treated as a reliable guide. The centre says it will publish its revised methods and results before any corridor decision is made.
