The Pentagon shut off ad IDs on military devices because marketers’ data was helping enemies map our troops’ lives.
Story Snapshot
- Air Force, Army, and Special Operations Command disabled advertising IDs on government devices.
- U.S. Central Command warned that commercial location data helps target troops with drones and bombs.
- Lawmakers pressed for tougher rules and a full review of safeguards across the Defense Department.
- Ad-tech data has exposed “patterns of life” around military sites in past investigations.
The move: shut the ad IDs before the data kills
Military leaders told Senator Ron Wyden that they disabled advertising identifiers on major device fleets. The Air Force switched them off about two months before letters became public. U.S. Special Operations Command disabled them on Windows machines. The Army had acted earlier in the year on mobile devices. These steps aim to cut off a steady feed of location breadcrumbs that ad networks sell to the open market, where hostile actors can buy them cheap.
U.S. Central Command warned lawmakers that commercial location feeds help adversaries spot where U.S. forces gather, trace daily routines, and plan strikes with drones, missiles, or roadside bombs. The command described “multiple threat reports” tied to this data stream. That warning pulled a technical problem into the center of force protection. When location pings tie to the same advertising ID day after day, they sketch a soldier’s commute, gym time, and convoy schedules.
Why ad-tech data is a battlefield problem now
Mobile advertising runs on a simple trade: free apps for you, behavioral data for them. Each phone carries a unique ad ID that apps pass along with time, place, and other signals. Brokers buy, package, and resell those feeds by the billions. Investigators have shown how these datasets reveal sensitive sites and routines, including around U.S. military and intelligence facilities overseas. One study traced 3.6 billion points from about 11 million devices in a single month in Germany.
Shutting off ad IDs reduces the leak but does not erase it. Many apps still gather precise location for “function” that blurs into profiling. Browser telemetry, Wi-Fi probes, and Bluetooth beacons add more tracks. From a common-sense, conservative view, the mission standard is simple: deny the enemy. That means lean devices, strict app lists, and strong controls by default. The recent steps align with that goal, but they should be the floor, not the ceiling.
Lawmakers’ push: good start, not game over
Senator Ron Wyden and Representative Pat Harrigan asked the Pentagon’s watchdog to review protections across all services. Their focus includes ad IDs, location sharing, and default browser choices that amplify tracking risk. They pressed for clear rules, regular audits, and enforcement across commands. This is not “tech theater.” Rules that live only on a slide deck fail in the field. Units need hardened builds, rapid patching, and spot checks that catch drift early.
Leaders must also tackle the personal phone gap. Many service members carry a second device. Guidance exists on turning off geolocation, but it does not always work as promised across apps and operating systems. Training should spell out red zones, from geofenced prayer times at known bases to repeat check-ins near staging areas. Risk scales fast when many devices follow the same pattern. One sloppy app on a handful of phones can still light up a convoy route.
What closes the window for adversaries
Commanders can cut exposure with four habits. First, strip devices to mission apps and block new installs. Second, default all settings to deny tracking, then verify with telemetry. Third, rotate safe-use rules by location and threat level, and enforce them with mobile management tools. Fourth, hunt the data itself. Contract red teams to buy ad-broker feeds and test whether dots cluster around your units. If they do, you will see it soon enough—and fix it fast.
Sources:
taskandpurpose.com, reuters.com
