A bipartisan group of lawmakers is demanding answers from the Pentagon after U.S. Central Command confirmed it had received multiple threat reports of foreign adversaries exploiting commercially available cell phone location data to track American military personnel deployed overseas.
In a letter to Pentagon Chief Information Officer Kirsten Davies, lawmakers led by Sen. Ron Wyden (D-OR) and Rep. Pat Harrigan (R-NC) warned that the Defense Department “has not taken basic steps to protect U.S. military personnel from the serious counterintelligence and force protection threat posed by the collection and sale of personal information, including cell phone location data, by data brokers.”
CENTCOM told Congress directly that it “has received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil U.S. personnel in theater.”
The threat runs through the commercial data broker industry, which collects and sells location information generated by smartphones, mobile apps and advertising networks. Foreign adversaries can purchase that data on the open market and use it to identify military installations, monitor troop movements or track individual service members.
“That foreign adversaries are still able to buy location data collected from the phones of U.S. personnel serving in military hotspots is a direct result of DOD leadership’s failure to prioritize this threat and implement common sense cyber defenses recommended by federal cybersecurity experts,” the lawmakers wrote.
The letter reveals a pattern of lag at the department level. CENTCOM only rolled out, in May, a capability to administratively disable location sharing on government-issued smartphones. Advertising identifiers, unique tracking numbers used by data brokers to monitor devices across apps and services, remain active on government-issued devices. Federal cybersecurity agencies have recommended disabling them for years.
The lawmakers are calling on the Pentagon to disable advertising identifiers across all government-issued smartphones, issue guidance requiring service members deployed overseas to do the same on personal devices, and replace data-collecting web browsers with privacy-focused alternatives.
