The Pentagon's efforts to stop adversaries from tracking US troops through commercially available location data haven't worked as planned, according to US Senator Ron Wyden and Representative Pat Harrigan, who on Friday requested an investigation by the Defense Department Inspector General. Despite policies meant to block the flow of such data, military personnel locations continue turning up for sale. The lawmakers want to understand why protective measures have only partially succeeded in eliminating this national security threat.
Multiple military branches—including the Army, Air Force, Navy, Marine Corps, and Special Operations Command—now disable advertising identifiers on government-issued devices to shield personnel from tracking. These advertising identifiers, often captured by mobile apps and advertising software development kits, allow location data to be sold commercially. Congress released details in May showing how this purchased data can identify where US military members congregate and enable targeting of those sites. Lawmakers noted the Defense Department has known about this vulnerability since at least 2016. Following congressional pressure in May, various service branches implemented blocking measures on official phones.
"We commend these service branches for implementing this cybersecurity defensive best practice on government devices," the lawmakers wrote in their letter to the DoD Inspector General. However, they added that "recent reports regarding the continued availability of commercial location data originating from DoD facilities raise troubling questions." Wyden and Harrigan suggested three possible explanations: some DoD components only disabled advertising identifiers as recently as July, turning off these identifiers may no longer sufficiently limit location data availability, or the data stems entirely from personal devices carried by military personnel and contractors.
Zach Edwards, a staff threat researcher at Infoblox, told The Register that disabling advertising IDs on military phones will make service members and their families safer, particularly those deployed in combat zones overseas. Mobile advertising identifiers function as join keys that link different datasets, allowing data brokers to connect mobile phone location information for bulk sales to anyone willing to pay. Edwards explained the change ensures military device location data won't appear in these bulk sales and also prevents this identifier from being broadcast to all advertising systems participating in auctions. He noted that Russian and Chinese ad tech companies partner with Western publishers and mobile apps to gather data, and firms in those nations face legal obligations to share information with their governments without recourse or public disclosure.
The lawmakers' call for an investigation signals that technical fixes alone may not solve the problem if personal devices remain unaddressed. Congress previously urged Defense Department CIO Kirsten A. Davies to issue policies requiring personnel to disable advertising identifiers on all personal devices brought into DoD facilities or taken overseas, though it remains unclear whether such mandates have been fully implemented. Edwards noted it's "truly unfortunate" that Google and Apple haven't effectively reformed mobile advertising IDs despite documentation that they're the primary data point brokers use to link people's location information. The persistence of military location data in commercial markets suggests the Defense Department faces a choice between more restrictive device policies and accepting continued exposure through the personal phones its workforce carries daily.