Pentagon Confirms Adversaries Exploit Commercial Phone Location Data to Track US Troops in War Zones
The Pentagon has confirmed that foreign adversaries are exploiting commercial geolocation data from smartphones to track and surveil US troops in Middle East war zones, prompting lawmakers to demand immediate security reforms.
The Pentagon has confirmed that foreign adversaries are exploiting commercial geolocation data—sourced from smartphone advertising IDs—to track and surveil US troops in active Middle East war zones. The admission came in responses to Senator Ron Wyden (D-OR) and Representative Pat Harrigan (R-NC), who released the information on Thursday alongside a letter demanding the Department of Defense (DoD) overhaul its smartphone security posture. According to the DoD's April responses, USCENTCOM has received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil US personnel in theater.
The mechanism is disturbingly simple: data brokers collect advertising IDs and location data from smartphone apps, then sell that information to third parties—including foreign adversaries. The DoD acknowledged that military personnel are allowed to use personal devices within operational areas without any mandatory policy requiring them to disable geolocation capabilities. Even government-issued smartphones with Mobile Device Management (MDM) policies fail to fully protect troops, as the Personalized Advertising setting is disabled by group policy, but Ad Targeting Information is not disabled and can be edited by a user. This means device advertising IDs and associated location data can still be transmitted and harvested.
The lawmakers' letter, signed by a dozen members of Congress, describes the DoD's response as the first public confirmation that commercial location data has been weaponized against American forces. The letter charges that the Pentagon has known about this threat for over a decade—government contractors briefed military leadership about the ease of tracking smartphones owned by service members as far back as 2016—yet has failed to take meaningful steps to protect troops. Wyden's team told The Register that the delay in publishing the information was due to markings that restricted public release, which Wyden reportedly pushed back on.
The DoD noted that it is migrating to a new MDM solution that allows location services to be completely disabled on government-issued devices, targeting a completion date of early May. However, it remains unclear whether that migration has been finished. Compounding the problem, the US Army announced earlier this month that it is phasing out government-issued work smartphones in favor of a broader Bring Your Own Device (BYOD) program, which could exacerbate the risk if personal devices lack the same security controls. CENTCOM has reportedly strengthened geolocation controls in its area of operations, but whether the average service member is complying is not indicated.
This is not an isolated incident. Previous examples of location data compromising military operations include the Strava heatmap incident, which revealed jogging routes on military bases, and social media posts that have exposed troop movements. The lawmakers' letter asserts that the Pentagon's failure to treat this as a five-alarm fire is a direct result of leadership's failure to prioritize the threat and implement commonsense cyber defenses. The DoD declined to answer questions from The Register, stating it would only respond to Wyden.
The confirmation underscores a broader systemic vulnerability: the commercial data broker ecosystem that sells location data to anyone willing to pay, including adversaries. While the Pentagon has acknowledged the threat and is taking some steps to mitigate it, the slow pace of reform and the expansion of BYOD policies suggest that US troops remain exposed. The letter demands that the DoD CIO Kirsten Davies implement immediate changes, including mandatory geolocation disabling in operational areas and full MDM enforcement. Whether the Pentagon will act with urgency remains to be seen.