U.S. Central Command received reports of location data used to target troops

U.S. Central Command stated it had received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil U.S. personnel in theater. The message was sent on April 14 and offered no further specifics. The disclosure marked the first official confirmation that U.S. forces had been targeted in an active war zone, according to a letter sent on Thursday to the Pentagon by U.S. Senator Ron Wyden and a bipartisan group of legislators.

Location data and national security concerns Commercial location data can be used to identify where U.S. troops congregate and their pattern of life, which can be exploited by adversaries to target attacks such as missiles, drones, and roadside bombs, as well as for counterintelligence purposes, the letter warned.

U.S. Senator Ron Wyden said in a statement that it was time to start treating the adtech industry as a national security threat. The Pentagon did not return messages seeking comment. Lawmakers said their efforts to obtain more information from military officials about the reported targeting had been unsuccessful.

How location data reaches adversaries Location data is widely used in digital advertising, a key source of revenue for many tech companies. Such data is typically collected from smartphones or other devices by apps or service providers before being sold to data brokers who collate and resell the data, sometimes via complex networks of intermediaries.

As far back as 2016, one U.S. defense contractor was able to leverage commercially available location data to track special operations forces from their bases in the United States to a sensitive staging post in Syria, according to an account first disclosed by the Wall Street Journal.

More recently, journalists at Wired and two German news outlets drew on billions of coordinates collected by a data broker to expose the granular comings and goings of people stationed at or around 11 U.S. military and intelligence sites in Germany.

Recommendations and industry response The letter from U.S. lawmakers to the Pentagon said that, given what military officials know about the trade in location data, they should have acted faster to protect their personnel, for example by disabling the unique advertising ID attached to military-issued devices, automatically turning off location sharing on smartphones in the field, and steering staff away from Google's Chrome web browser toward more privacy-focused alternatives.

U.S. Representative Pat Harrigan said that browsers like Chrome are built from the ground up to collect and share user data and that every day they remain on government-issued devices is another day we are handing our adversaries a weapon against our own troops.

In a statement, Alphabet's Google said that Chrome had industry leading security. The company added that it had long advocated for stronger rules and safeguards against data brokers.