Cybersecurity Policy Report, Military Personnel Remain Exposed to Data Tracking, Lawmakers Warn, (Sep 8, 2026)
The Department of Defense has taken steps to protect personnel from location-tracking and data brokers, but data originating from “DoD facilities” apparently is still being collected, according to Sen. Ron Wyden (D., Ore.) and Rep. Pat Harrigan (R., N.C.), who asked DoD’s inspector general (IG) to conduct an investigation.
Sen. Wyden and Rep. Harrigan were among 14 lawmakers who expressed concern last May about the ability of foreign adversaries to track warfighters’ cellphones, calling it a “five-alarm fire” (CPR, May 28).
The Army, Air Force, Navy, Marine Corps, and Special Operations Command subsequently confirmed that they had ordered personnel to disable advertising IDs on government-issued devices to enhance DoD’s data security, the lawmakers noted in a letter sent Friday to Platte Moring, DoD’s IG.
One of the “most effective ways to mitigate data broker threats is to disable the unique advertising IDs built into smartphones,” they noted.
“We commend these service branches for implementing this cybersecurity defensive best practice on government devices. However, recent reports regarding the continued availability of commercial location data originating from DoD facilities raise troubling questions,” the lawmakers told the IG.
“One possibility is that certain DoD components have not, in fact, fully disabled the advertising IDs on government devices or only recently implemented these policies,” they said. “Another possibility is that disabling the advertising ID is no longer a sufficient defense on its own, as data brokers can still capture, correlate, and monetize unique location data using other information collected from phones.”
“A third—and particularly alarming—possibility is that the commercial data currently available for sale originates entirely from personal devices brought into DoD facilities and operational areas by service members and government contractors,” they said.
Sen. Wyden and Rep. Harrigan asked the IG to “review the effectiveness of existing DoD policies, technical controls, and operational security (OPSEC) guidelines” and identify where DoD policies have proven to be ineffective.
“In particular, we request that you determine whether commercially available data is originating from personal phones,” they added. “If personal devices are identified as the primary source of this data, your office should recommend concrete policy changes to eliminate this vulnerability, enforce technical controls on personal devices in sensitive areas, and safeguard DoD personnel and OPSEC from commercial surveillance.”
MainStory: TopStory FederalLegislation DataSecurity DataPrivacy