A look at the risks posed by data, including geolocation, harvested from common apps for phones belonging to US intelligence officers and military personnel
Apps show troop movements buried in data available for purchase: ‘a major risk to national security’
Wall Street JournalByron Tau
Context & Ripple Effects
This WSJ report lands inside an arc the coverage has been building since early 2021: the same commercial location-data market the US government shops in turns out to be a mirror that reflects back at its own personnel. An unclassified memo first showed DIA analysts using commercial app-location databases to track Americans without warrants (the DIA's warrantless tracking practice), and Mobilewalla later confirmed to Sen. Wyden it supplied data used by DHS, the IRS, and the military (Mobilewalla's admission as source broker).
What changed with this story is the direction of the threat: instead of agencies buying Americans' locations, anyone with a broker budget can buy the movements of US intelligence officers and troops themselves — a risk Wired later documented concretely when phone coordinates from broker Datastream exposed US military and intelligence workers in Germany (the Datastream Germany exposure). The supply chain runs through advertising plumbing, which Israeli vendors like Bsightful, backed by Verint, already tap via ad exchanges (ad-exchange location siphoning).
First-order effects
US military and intelligence officers' daily movements become purchasable commodities: any actor able to pay a data broker can reconstruct where personnel live, work, and travel from ordinary apps they never treated as surveillance tools.
Second-order effects
Agencies now face a self-inflicted dilemma, since the same broker feeds they procure for warrantless tracking — Treasury's Babel Street purchases for tax and sanctions enforcement being one example — are built on the app telemetry that endangers their own staff.
Third-order effects
If the pattern holds, the commercial location-data market forces a structural choice between exploiting it as an intelligence source and treating it as an attack surface requiring bans, procurement restrictions, or device policies for sensitive personnel — with Congress, prompted by Wyden-style inquiries, positioned to arbitrate.
The trend: Commercial app-location brokering is maturing from a government surveillance shortcut into a two-way national-security liability, exposing the very personnel whose agencies buy the data.
The free ad-supported Internet comes with a cost: tracking. And that tracking — of mobile locations and everything else — can be turned against U.S. servicemembers serving in warzones. How one company saw evidence of secret U.S. missions in ad data. https://www.wsj.com/...
Strava's heat map was just the beginning. From the POTUS Secret Service detail, to the Capitol Riots, and these U.S. special-operations in Syria, so much sensitive operational data is leaking through mobile apps and location aggregators https://twitter.com/...
The personal phones of U.S. soldiers pose a national security threat, emitting signals while in hot spots that can betray troop movements. Anyone can buy the data. Fascinating story by @byrontau: https://www.wsj.com/...
DoD should have started looking at this problem set after the Strava cluster****. But only recently have I noticed some progress in understanding how all this data allows active duty troops to be targeted, and collected on. Warrants serious attention. https://twitter.com/...
The problems with location data is usually best explained by concrete examples. @ByronTau shows how a US company could track American soldiers to an abandoned cement factory in Northern Syria, a staging area for US special operations. https://www.wsj.com/...
“Devices appeared at US facilities such as Fort Bragg... Fort Hood... or tiny desert outposts... before later traveling to the Lafarge Cement Factory in Northern Syria. They would reappear back in the US—often at private residences—presumably the homes of military personnel.” htt…
Soldiers' personal phones pose a national security threat, emitting signals while in hotspots that can betray troop movements. Anyone can buy the data. https://www.wsj.com/...