The U.S. military has disabled advertising tracking tools in government-issued phones, computers and other devices, officials recently told Congress.
The different military branches confirmed they had done so, some only this summer, following reporting that commercially available data taken from these devices and sold freely by data brokers, was being used by Iran and other adversaries to track and in some cases target American bases and personnel. The confirmation came from a letter shared by Sen. Ron Wyden (D-Ore.) and Rep. Pat Harrigan (R-NC). The letter calls on the Department of Defense Office of the Inspector General to review department security guidelines. Wyden and others revealed in a similar letter in May that foreign groups were using commercially available location data to target U.S. troops.
“The sale of location data, particularly that of U.S. government personnel, poses a serious threat to national security,” Wyden wrote.
According to Wyden and Harrigon’s letter, the Army, Navy, Air Force, Marine Corps and Special Operations Command all confirmed they have disabled mobile advertising IDs on government-issued devices. However, that has only been recent for some service branches; the Air Force admitted in its letter to the members of Congress that it only directed disabling ad trackers in July.
Mobile advertising IDs, also known as MAIDs , are unique identifying numbers that go with specific devices. They are a key part of the data collected by mobile apps and can track location, common routes and habits, something that can be exploited by adversarial groups. Disabling those MAIDs is “a very simple and straightforward way that you can close a loophole,” according to Eva Galperin, Director of Cybersecurity for the Electronic Frontier Foundation. MAIDs aren’t the only way devices can be tracked, but are a major one.
“Minimizing the attack surface is always good, even if you don’t get the entire attack surface,” Galperin told Task & Purpose.
Another “particularly alarming” factor is that people are still using personal devices inside military installations and operating areas, exposing these places despite military restrictions. Wyden and Harrigon called on the office of the inspector general to see if personal devices are the main source of location data getting out and if so, the office “should recommend concrete policy changes to eliminate this vulnerability, enforce technical controls on personal devices in sensitive areas, and safeguard DoD personnel and OPSEC from commercial surveillance.”
Galperin noted that Wyden, who is on the Senate Intelligence Committee, releases letters like this to call attention to an urgent but classified matter.
Commercial data and location tracking features in apps have been an issue for the armed forces for years. U.S. Central Command issued stricter cybersecurity orders in December as part of the buildup of forces in the Middle East prior to the war with Iran. Since the war started, CENTCOM has updated those rules and warned troops that Iran was using “reactions, photos, and footage from the cellphones” of personnel to see how successful attacks are. Despite that, troops have continued using apps and Internet features with location data, including fitness apps.
Most recently, the Department of the Navy warned sailors and Marines that a “coordinated, multi-domain campaign” was underway to target them, including tracking people via their digital footprint. The notice advised, among other things, hiding one’s ties to the military online.
Existing commercial data from months prior to tracking being cut off could potentially still be useful to adversaries, but they don’t have real-time information, Galperin noted. But the continued use of personal phones and devices is the bigger risk, she said and military personnel overseas “probably shouldn’t be using them.”
