The Pentagon has known that enemies can track troops’ phones for years now

For nearly a In the past decade, the Pentagon has been warned — by contractors, analysts and its own intelligence agencies — that anyone with a credit card could purchase a map of the whereabouts of American troops. Sleep, work and store nuclear weapons. And now the bill is due in a war zone.

A Newly revealed message It appears the warnings went unheeded: US Central Command now confirms that it has received “multiple threat reports relating to an adversary exploiting commercial location data to target or monitor US personnel in theater” – the first official acknowledgment that the data broker economy is being used to hunt US forces in the Middle East.

It was targeting First reported by ReutersWhich got the letter from the central command. But the assertion reaches a longer and more damning record than the single document suggests.

For the better part of a decade, US lawmakers have heard the same alarms about the dangers of commercially available location data that the Pentagon has heard — from the same intelligence assessments, from witnesses, and from their colleagues. However, sweeping privacy legislation has repeatedly faltered in Washington, and the one narrow reform that has passed — a requirement that data shared with military contractors not be resold — has left the broader industry untouched.

One of the first warnings came in 2016. At the Joint Special Operations Command compound at Fort Bragg, California, a government technician, briefing senior officers, explained how commercial location data — purchased, not hacked — could track phones from Fort Bragg and MacDill Air Force Base in Florida, home stations for elite U.S. units, through Turkey and northern Syria, where they are assembled at a secret forward operating base. The same data was available to any advertiser or foreign intelligence service.

Even as the Pentagon was warned that the location data market was putting its employees at risk, parts of the department were eager to become its customers. Defense Intelligence Agency It will be unveiled to Congress in 2021 It uses commercially purchased phone location data — including that of Americans — without a warrant, taking the position that none of it is needed. Months ago, Motherboard reported that the US military was purchasing location data Harvested from popular consumer applications.

In 2023, the military paid the costs of clarifying the threat. Researchers at Duke University – working under a grant from the U.S. Military Academy at West Point –Set out to purchase data on US service members The way a foreign adversary might do. They collected hundreds of data broker sites and found thousands of lists advertising data on military personnel, including datasets titled “Military Families Mailing List” and “Key Military Families.”

Researchers are starting to buy in. For as little as 12 cents, with almost no vetting, they purchased the names, home addresses, health conditions and financial details of active-duty troops. Posing as buyers operating through a domain based in Singapore, they also obtained the same type of geo-located data at Fort Bragg, Quantico and other installations. One broker offered to skip ID verification if paying via bank transfer.

A year later, WIRED found The same kind of data that flows through Google’s own advertising platform. Working with data obtained by the Irish Civil Liberties Council — whose investigator gained access to U.S. intermediary audience lists by staking out a fake analytics company — WIRED identified marketing “segments” on Google Display & Video 360 that singled out U.S. government employees deemed “decision makers” working “specifically in the area of ​​national security,” along with lists targeting people who work for companies licensed to build rockets, space launch vehicles, and encryption systems that protect classified data.

The Irish Council for Civil Liberties investigator said he expected his cover story to be tested. “When I signed up, there were absolutely no questions,” he told WIRED at the time. “I could have been anyone.”