A recent bipartisan push from lawmakers is bringing attention to a stark national security concern regarding the use of commercially available location data. Senators and representatives are focusing on the Pentagon after U.S. Central Command highlighted reports that foreign adversaries exploit this data to surveil American military personnel stationed overseas.
In a pointed letter addressed to the Pentagon’s Chief Information Officer, Kirsten Davies, lawmakers, including Sen. Ron Wyden and Rep. Pat Harrigan, raised alarming issues about the vulnerabilities present in how the Department of Defense (DOD) manages personal information. They warned that the Pentagon has not acted decisively to defend U.S. personnel against risks posed by third-party data brokers who collect and sell sensitive location data. This data, routinely gathered through smartphones and applications, is readily available for purchase by adversaries who could use it to monitor troop movements, identify military bases, and target individual service members.
The gravity of the situation is underscored by the fact that U.S. Central Command acknowledged receiving several reports of these threats. Lawmakers expressed frustration that the Pentagon’s response has been insufficient. “That foreign adversaries are still able to buy location data collected from the phones of U.S. personnel serving in military hotspots is a direct result of DOD leadership’s failure to prioritize this threat,” they asserted.
While the Pentagon has attempted to address this issue, such as by rolling out a feature to disable location sharing on government-issued smartphones in May, lawmakers argue that this response is too little, too late. The continued use of active advertising identifiers on these devices contradicts established cybersecurity recommendations. Lawmakers have urged the DOD to take immediate action, recommending that advertising identifiers be deactivated on all government devices and advising personnel to do the same on their personal devices.
The concerns are not new. In 2018, a fitness-tracking app inadvertently disclosed sensitive information about military personnel based on a global heat map it released. Such occurrences prompted the DOD to issue guidelines to restrict the use of applications that could compromise location data in operational zones. Yet, lawmakers contend that fundamental protections against the collection and sale of this data have not been adequately enforced.
Experts in the field, such as Justin Sherman of Global Cyber Strategies, emphasize that the threat extends well beyond fitness applications. The volume of location data amassed by commercial entities offers foreign adversaries many opportunities for exploitation. “If you’re one of the United States’ foreign adversaries…you’d think: ‘why hack when I can buy?’” Sherman remarked, highlighting the ease with which adversaries can acquire sensitive data.
Sherman further explained that this data is not merely about physical locations but can construct detailed profiles of individuals’ daily lives, which pose risks not only to military members but also to their families and associates. Reports suggest that by collecting, sharing, and analyzing this data, adversaries could effectively surveil American citizens and compromise their safety.
The lawmakers’ concerns elicit critical questions about operational security and the adequacy of the Pentagon’s defenses against these threats. As America’s armed forces remain deployed in sensitive areas, ensuring their safety from foreign surveillance via commercial data demands urgent and practical action. The persistent exploitation of such available information presents a serious national security challenge that cannot be overlooked.
"*" indicates required fields
