Iffa Jayyana
For nearly a decade, the Pentagon has been warned by its own contractors, academic researchers, and intelligence analysts: the modern data-broker economy represents a catastrophic national security vulnerability. The warning was simple and stark—anyone with a credit card and an internet connection could purchase precise, real-time location data pinpointing where American troops sleep, work, and store sensitive military assets, including nuclear weapons.
For years, these warnings were treated as abstract academic exercises. Now, the bill has finally come due in an active war zone.
In a chilling confirmation, US Central Command (CENTCOM) has officially acknowledged receiving "multiple threat reports concerning adversary exploitation of commercial location data to target or surveil US personnel in theater." This marks the first time the Pentagon has conceded that the shadowy, multi-billion-dollar data-broker industry is being weaponized to hunt American forces in the Middle East. While the report was first unearthed by Reuters, it is merely the tip of a much larger, more dangerous iceberg that has been forming for ten years.
A Chronology of Failure: From Warning to Weaponization
The vulnerability of military personnel to commercial tracking is not a new discovery; it is a decade-long failure of oversight.
2016: The First Alarms
The initial warnings were sounded within the secure confines of the Joint Special Operations Command (JSOC) at Fort Bragg, California. During a briefing for senior officers, a government technologist performed a terrifyingly simple demonstration. Without hacking into a single system, the technologist used commercially available data to track mobile devices from Fort Bragg and MacDill Air Force Base—the nerve centers of America’s most elite units—as they traveled through Turkey and into northern Syria. The data clearly showed these devices clustering at a covert forward operating base. The intelligence community realized then that the same information was available to any advertiser, malicious actor, or foreign intelligence service with a modest budget.
2021: The Pentagon Becomes a Consumer
Even as the alarm bells rang regarding the danger to personnel, the Department of Defense (DoD) began to view the data-broker marketplace as a resource rather than a threat. The Defense Intelligence Agency (DIA) disclosed to Congress that it was purchasing smartphone location data on Americans—without a warrant—claiming that such surveillance did not require legal oversight. Around the same time, investigative reports revealed that the US military was actively buying location data harvested from popular, seemingly innocuous consumer apps.
2023: Buying the Threat
The US Military Academy at West Point commissioned researchers at Duke University to quantify the risk. The researchers set out to buy data on American service members using the same methods an adversary might employ. They scraped hundreds of data-broker websites and found thousands of listings specifically advertising data on military personnel, including datasets labeled "Military Families Mailing List" and "Hard Core Military Families."
The researchers purchased names, home addresses, health conditions, and financial details for as little as 12 cents per record. Posing as a buyer via a Singapore-based domain, they geofenced sensitive installations like Fort Bragg and Quantico. One broker even offered to bypass identity verification entirely if the researchers paid via wire transfer.
2024–2025: Global Exposure
An investigation by WIRED, alongside German media partners, exposed the scale of the threat in Europe. Reporters obtained a "free sample" of location data from a Florida broker: 3.6 billion coordinates tied to 11 million phones in Germany. The data revealed the daily movements of US personnel stationed in the country, including devices moving through 11 different US installations. Most alarmingly, reporters could track devices inside Büchel Air Base—where US nuclear weapons are housed—and monitor vehicles navigating armored-vehicle training courses at Grafenwöhr, the very site where saboteurs were later arrested for scouting.
Supporting Data: The Anatomy of the Vulnerability
The threat is not limited to location data; it is an endemic failure of the digital ecosystem surrounding military life.
In May 2025, the Army Cyber Institute at West Point released a technical report revealing that over 20% of the most-visited web domains on the service’s stateside unclassified networks were commercial trackers. The institute proposed "minimal-cost" fixes, such as restricting the use of Google’s Chrome browser on government workstations, as it was the only major browser failing to block third-party cookies that follow users across the internet.
The data broker economy functions with almost no regulatory friction. When investigators from the Irish Council for Civil Liberties (ICCL) attempted to access "audience lists" on Google’s Display & Video 360 platform, they stood up a fake analytics firm. Their cover story was never questioned. They successfully identified marketing segments targeting "decision-makers" in the field of national security, as well as lists of employees at firms licensed to manufacture missiles, space-launch vehicles, and cryptographic systems.
Official Responses and the "Individual Responsibility" Fallacy
For years, the Pentagon’s official response to these findings was to push the burden onto the individual. A spokesperson famously urged service members to "remember their training" and follow operational security (OPSEC) protocols. This framing—suggesting that a soldier is personally responsible for the sophisticated, multi-layered tracking apparatus of the modern advertising industry—has been widely condemned by military researchers as both impractical and dangerous.
Finally, in a newly disclosed letter signed by 14 bipartisan members of Congress, lawmakers pressed the Pentagon to stop ignoring its own experts. The letter demands that the Department’s Chief Information Officer, Kirsten Davies, implement long-overdue defenses:
- Disable advertising IDs on all military-issued devices.
- Remove Chrome from government systems in favor of privacy-focused alternatives.
- Enroll personnel in automated data-broker opt-out programs.
The most damning piece of evidence in the letter is a matter of timing: CENTCOM only rolled out the capability to switch off location sharing on government smartphones this month—a full decade after the first, clear warning was issued in 2016.
Implications: The High Cost of Policy Stagnation
The military’s recent shift to a "Bring Your Own Device" (BYOD) mobility program has only exacerbated these risks. The Army is now requiring soldiers to use personal phones for government work, even as these devices continue to broadcast advertising IDs and feed location data to the very brokers who have been proven to sell that information to the highest bidder.
While the Army claims that its work-related applications are "walled off" from the rest of the phone’s data, cybersecurity experts emphasize that this does nothing to stop the phone’s OS from leaking location, browsing, and behavioral data to third-party brokers.
Sean Vitka, executive director of the privacy advocacy group Demand Progress, notes that the failure to act is not due to a lack of options, but a lack of political will. Two years ago, the House passed significant legislation intended to bar the government from subsidizing this predatory industry. However, the bill was effectively killed by a coalition of surveillance-minded lawmakers and a failure of Senate leadership to bring it to a floor vote.
"Despite the bad-faith claims of policymakers who consistently wield their power to undermine privacy, surveillance is not inherently good for security," Vitka says. "The public can now see disturbing evidence proving privacy is not only a core human right but also critical to keeping people safe."
As the Pentagon remains largely silent on the specific measures it will take to secure personnel currently in theater, the reality remains: the modern battlefield is no longer confined to physical geography. It has expanded into the digital footprint of every soldier, and for a decade, the US military allowed that footprint to be sold to the very adversaries it is deployed to counter. The question now is whether the Pentagon will finally prioritize the safety of its personnel over the convenience of a data-broker economy that has effectively turned the American warfighter into a commodity.
Evan Lee Salim
Jia Lissa
