US troops can still be tracked by purchased location data, and Congress wants to know why

The US military's effort to prevent troops from being tracked by adversaries through purchased location data hasn't worked as well as anticipated, and lawmakers want to know why. US Senator Ron Wyden (D-OR) and Rep. Pat Harrigan (R-NC) on Friday asked for an investigation by the Defense Department Inspector General into policies that have only partially stanched the flow of location data that allows military personnel to be tracked and targeted. In May, Wyden, Harrigan, and a bipartisan group of 12 other members of Congress released details about how commercially purchased location data – often captured by mobile apps and advertising SDKs – can be used to identify where US military personnel gather and to target those locations. They noted that the DoD has been aware of this threat since at least 2016. The lawmakers urged Defense Department CIO Kirsten A. Davies to take steps to mitigate this risk, including turning off advertising identifiers on DoD smartphones and issuing a policy requiring the disabling of advertising identifiers on all personal devices brought into DoD facilities or overseas. Since then, various military branches have blocked advertising identifiers on government-issued devices. According to the letter, "several DoD components – the Army, Air Force, Navy and Marine Corps, and Special Operations Command – confirm that they now disable advertising IDs on government-issued devices to protect their personnel from such threats." But that hasn't entirely eliminated the availability of location data tied to US military personnel. Citing ongoing reports, Wyden and Harrigan want to know why location data pinpointing the movement of troops continues to be available. "We commend these service branches for implementing this cybersecurity defensive best practice on government devices," they said in their letter [PDF] to the DoD IG. "However, recent reports regarding the continued availability of commercial location data originating from DoD facilities raise troubling questions." The two lawmakers speculate about the reason DoD policies have fallen short. One possibility, they say, is that some parts of the DoD turned off their advertising identifiers only as recently as July. Another, they say, is that disabling ad identifiers may no longer be sufficient to limit the availability of location data. And the third is that the location data is coming entirely from the personal devices of DoD personnel and contractors. Zach Edwards, staff threat researcher at Infoblox, told The Register in an email that it's good to hear all the military branches have disabled advertising IDs on their phones because it will make members of the military and their families safer, especially those serving in combat zones overseas. "This change will essentially ensure that military device location data isn't being included in bulk data sales being done by numerous vendors," he said. "It’s truly unfortunate that Google and Apple have not effectively reformed their mobile advertising IDs, even after it’s been well documented that it’s the primary piece of data being used by data brokers to connect up people’s mobile phone location data for bulk sales." Mobile advertising identifiers (MAIDs), Edwards explained, serve as join keys for tracking people – they can link different datasets. "So one core benefit is that military data won't be available for sale via data brokers, who will sell to literally anyone with a pulse and a credit card," said Edwards. "But the other slightly less obvious benefit is that this MAID was also being broadcast to all ad systems participating in the auctions." Edwards said that while states like California, Vermont, Texas, and Oregon have data broker registries, he's unaware of any Russian or Chinese ad tech vendors who have registered. And those companies, he said, partner with Western publishers and mobile apps to collect data anyway. "I think it's important to appreciate that these ad tech companies in Russia and China have also likely been getting MAID data from the programmatic ad tech auctions from members of the military, and companies in those countries have an obligation to share it with the state without any ability to appeal or provide any external notice," he said. ®