CENTCOM Confirms Adversaries Used Commercial Location Data to Track U.S. Troops

U.S. Central Command has confirmed to Congress that it received multiple threat reports about foreign adversaries exploiting commercial location data to target or surveil U.S. personnel in its area of responsibility. The acknowledgment appears in an April letter from CENTCOM that was referenced in a new bipartisan letter sent Thursday by members of the House and Senate to the Pentagon's chief information officer.

Background on the Threat CENTCOM's area of responsibility covers 21 countries across Central Asia, South Asia, and the Middle East. The command stated that its Threat Fusion Cell tracked and disseminated the reports to force protection personnel and component commands.

Lawmakers wrote that this marks the first time the Defense Department has confirmed adversaries are using commercial location data to target U.S. military personnel in an active war zone. They added that such data can reveal where troops congregate and their patterns of life, information that could be used for missile, drone, or roadside bomb attacks.

The letter states that the department has known about the threat for more than a decade yet has not adopted recommended cyber defenses. It notes that CENTCOM only completed migration of government-issued devices to a new management server allowing location services to be disabled in early May.

They also called for removal of web browsers that facilitate data collection by advertising companies from unclassified computers and smartphones. The letter further recommended coordinating with state privacy agencies to enroll California-resident personnel in data-broker opt-out systems and extending similar measures to other states with comparable programs.

CENTCOM said the identified threats were being mitigated through dissemination of assessments to force protection personnel. The Pentagon did not immediately respond to questions about the new letter.