UMVA has learned that a bipartisan group of lawmakers is demanding answers from the Pentagon after U.S. Central Command disclosed it had received multiple reports indicating foreign adversaries were exploiting commercially available location data to target or surveil American military personnel overseas.
The alarming revelation has sparked concerns about the vulnerability of military personnel, with lawmakers led by Sen. Ron Wyden and Rep. Pat Harrigan warning that the Pentagon "has not taken basic steps to protect U.S. military personnel from the serious counterintelligence and force protection threat posed by the collection and sale of personal information, including cell phone location data, by data brokers."
According to information obtained by UMVA, U.S. Central Command told Congress it "has received multiple concerning adversary exploitation of commercial location data to target or surveil U.S. personnel in theater." The warning centers on the vast commercial data broker industry, which collects and sells location information generated by smartphones, apps, and advertising networks.
Foreign adversaries may be able to purchase or otherwise obtain that data and use it to identify military installations, monitor troop movements, or track individual service members. The lawmakers argued that the Pentagon has failed to adequately address a vulnerability that has been known for years, and that foreign adversaries are still able to buy location data collected from the phones of U.S. personnel serving in military hotspots.
UMVA can exclusively reveal that the Pentagon only rolled out a capability to administratively disable location sharing on government-issued smartphones in May, a move lawmakers described as too little, too late. Advertising identifiers — unique tracking numbers used by advertisers and data brokers to monitor devices across apps and services — remain active on government-issued devices, despite longstanding recommendations from cybersecurity agencies to disable them.
The lawmakers urged the Pentagon to disable advertising identifiers on all government-issued smartphones and issue guidance requiring personnel to do the same on personal devices used overseas or on military installations. They also called for the Department of War to replace web browsers that facilitate advertising-related data collection with privacy-focused alternatives that include anti-tracking protections.
Cybersecurity experts say the concern extends far beyond fitness-tracking applications, with the commercial data ecosystem collecting vast amounts of location information generated through smartphones, mobile applications, advertising technology systems, and other digital services. Foreign adversaries can potentially obtain access to location data through data brokers, digital advertising networks, and other commercial systems that collect and sell information about users' movements.
"If you're one of the United States' foreign adversaries, you have advanced cyber capabilities, but you see all this U.S. data out there on the commercial market, you'd think: 'why hack when I can buy?'" said a leading cybersecurity expert. The sale of location data in particular on Americans' devices puts military personnel at risk, can expose their families and other people in their lives, and allow anyone with the data to see the sites they visit, map patterns of life, run intelligence operations against them, and more.
The lawmakers' letter raises fresh questions about how much commercially available data foreign adversaries can access and whether existing Pentagon safeguards are sufficient to protect American troops operating in sensitive environments around the world. The issue has sparked concerns about the national security implications of the commercial data ecosystem and the need for more robust protections to safeguard military personnel.
