US troops can still be tracked by purchased location data, and Congress wants to know why
AI Signal Decode
Despite the DoD's acknowledgment of the threat since 2016 and subsequent actions by several military branches to disable advertising identifiers on government devices, location data linked to US military personnel continues to be available for purchase. Lawmakers Wyden and Harrigan are pushing for a thorough investigation by the DoD Inspector General to understand why these measures have not been fully effective. This includes examining if the disabling of ad identifiers is still sufficient or if data acquisition methods have evolved to circumvent these protections. The availability of such data poses a direct threat to national security by enabling adversaries to track troop movements and identify sensitive locations.
The market for location data is a significant concern, with numerous vendors compiling and selling this information, often without stringent vetting of buyers. Zach Edwards, a threat researcher, points out that mobile advertising identifiers (MAIDs) act as crucial links between various datasets, making them prime targets for data brokers. While disabling these on military devices prevents their inclusion in bulk data sales to unknown entities, the underlying infrastructure of data brokering remains. The involvement of potentially state-sponsored actors in Russia and China, who may acquire this data through programmatic ad tech auctions and have obligations to share it with their governments, further escalates the security risk for US military personnel.
Several hypotheses are being considered for the persistent data leakage. These include the possibility that some DoD components only recently implemented policies to disable advertising identifiers, or that disabling these identifiers alone is no longer a complete solution. A significant concern is that the data may increasingly originate from the personal devices of military personnel and contractors, which are often brought into DoD facilities and overseas locations. This necessitates a re-evaluation of DoD policies to encompass a broader range of devices and data acquisition channels to effectively safeguard sensitive information and personnel.
The situation underscores the broader challenge of regulating the commercial data broker industry. While some US states have introduced data broker registries, the global nature of data collection and sale, particularly involving entities in adversarial nations, presents a complex regulatory landscape. The continued availability of location data on military personnel highlights the urgent need for more robust cybersecurity measures, potentially including stricter controls on personal devices within secure facilities and enhanced monitoring of data streams. Congress's intervention signals a growing awareness of these vulnerabilities and a push for more comprehensive solutions beyond simply disabling advertising IDs on government-issued equipment.