U.S. military personnel in active war zones are being targeted by foreign adversaries using commercially available cellphone location data [1].
This vulnerability exposes the intersection of private ad-tech ecosystems and national security. Because data brokers sell precise movement patterns to the highest bidder, adversaries can bypass traditional espionage to locate troops in real time.
Reports emerged Thursday that foreign actors are exploiting the global surveillance and ad-tech data-broker ecosystem to monitor and potentially strike personnel [1, 3]. A spokesperson for U.S. Central Command said, "We have received multiple threat reports involving adversaries exploiting commercial location data to monitor or target American personnel" [1].
More than 12 lawmakers signed a letter warning that this practice puts military members at risk [3]. The letter said that foreign adversaries need to be stopped from using location data collected and sold by data brokers to target U.S. military members in active war zones [3].
Sen. Ron Wyden (D-OR) highlighted the systemic nature of the problem. "The adtech industry is a national security threat," Wyden said [2].
While some reports suggest troops have already been targeted, others indicate the data creates a critical risk of future attacks [1, 2]. The location data used for this tracking is the same information that typically helps apps and advertisers track everyday phone users [2].
The Pentagon said that the availability of this data allows adversaries to identify patterns of life and operational hubs without needing to penetrate secure military networks [1].
“"The adtech industry is a national security threat."”
This situation reveals a critical gap in U.S. operational security where private-sector data collection outpaces military countermeasures. By utilizing 'gray-market' data from brokers, adversaries can achieve intelligence goals through legal commercial transactions rather than illegal hacking, making the threat harder to litigate or block through traditional cybersecurity means.
