In a stark demonstration of the vulnerabilities facing American service members, an investigative team was able to purchase commercially available data and, within months, identify a special operations officer, his home, and even photos of his children—all without hacking, subpoenas, or breaking any laws. The exercise, conducted this summer, underscores a growing national security threat that military and congressional leaders are only beginning to grapple with.
The investigation began with a military installation publicly linked to sensitive special operations units. By pulling advertising IDs from that location, the team found tens of thousands of devices. Cross-referencing those IDs with two other known special operations locations narrowed the field to a few hundred. One phone led to a house, and public records and social media identified the owner as an Army officer whose public profile suggested a logistics role. Further analysis revealed his actual, more sensitive duties—information an adversary would value highly.
The ease of this process is alarming. As a former Green Beret, I recall that such tracking required expensive, government-grade equipment. Today, a laptop and a few hundred dollars for data can achieve similar results. The cost of AI has plummeted—Stanford's AI Index shows a 280-fold decrease in the price of running capable models between late 2022 and late 2024—making pattern recognition and data mining even more accessible. The unchecked power of tech in this realm is a growing concern.
Adversaries Already Exploiting This Data
This is not a hypothetical risk. U.S. Central Command has reported multiple threat reports involving adversary use of commercial location data to target or surveil U.S. personnel during Operation Epic Fury. The data is also distressingly cheap: Duke University researchers purchased records on service members, including home addresses and information about their children, for as little as 12 cents per person.
The Pentagon has taken some initial steps. On September 4, Sen. Ron Wyden (D-Ore.) and Rep. Pat Harrigan (R-N.C.) released responses from the military services showing that the Army, Air Force, Department of the Navy, and Special Operations Command had disabled mobile advertising IDs on government-issued phones. While a positive move, it does not address the core problem: the officer in our investigation was found via his personal phone, not his government device.
Personal Devices Remain a Gap
Wyden and Harrigan highlighted this in their letter, noting that personal phones carried onto military installations are still a rich source of commercial location data. Moreover, turning off an advertising ID does nothing to erase historical data already collected. An adversary could reconstruct years of an officer's movements, training, and assignments from existing datasets.
Some suggest using burner phones or privacy-focused carriers, but these are not panaceas. A burner phone loses its anonymity when loaded with common apps, connected to familiar Wi-Fi networks, or carried alongside a known personal phone. Even a phone with no cellular service generates data through Wi-Fi and apps. The cellular carrier is just one part of the data trail.
Congress Begins to Act
Congress is starting to address the broader issue. The House-passed Fiscal Year 2027 National Defense Authorization Act includes a provision on what the government calls ubiquitous technical surveillance. It would require the Secretary of Defense to designate an organization to coordinate the identification of surveillance vulnerabilities, develop a department-wide strategy, provide training, and establish a permanent program of record.
However, commercial surveillance does not fit neatly into existing categories like cybersecurity, intelligence, communications, or force protection. Different agencies own pieces of the problem, but no one owns it entirely. This fragmentation leads to one-off fixes that are easily circumvented. As one vulnerability is closed, another appears. The Defense Department needs a single accountable owner to understand the full scope of exposure—identifying which service members and families are most at risk, assessing what data is already available, and developing mitigation strategies.
The military has shown it can act quickly when a threat is clear. But the challenge of commercial data surveillance requires a more comprehensive, coordinated response. The stakes are too high for piecemeal solutions, especially as political dynamics and funding fights complicate long-term defense planning.
