Last week, United States Senator Ron Wyden, D-Ore. and Rep. Pat Harrigan, R-N.C., released information confirming that foreign adversaries are exploiting commercial location data to track U.S. servicemembers in active war zones. Wyden, along with other members, called for the Department of Defense (DOD) to address this concern in a letter. 

“Commercial location data can be used to identify where U.S. troops congregate and their pattern of life, which can be exploited by adversaries to target attacks such as missiles, drones, and roadside bombs, as well as for counterintelligence purposes,” reads the letter written to DOD Chief Information Officer Kirsten Davies. “That foreign adversaries are still able to buy location data collected from the phones of U.S. personnel serving in military hotspots is a direct result of DoD leadership’s failure to prioritize this threat and implement commonsense cyber defenses recommended by federal cybersecurity experts.”

Reportedly, the DOD has been aware of this threat since at least 2016.

“While the security community has long anticipated this vulnerability, regulatory action remains paralyzed because the digital advertising ecosystem relies on a lucrative opt-out model, and defense agencies themselves frequently purchase commercial data for intelligence gathering,” says John Carberry, Solution Sleuth, Xcape, Inc. “This systemic policy failure shifts the entire burden of protection onto immediate technical defense. To mitigate this exposure, security leaders must treat personal mobile devices as active tracking beacons.”