US troops can still be tracked by purchased location data, and Congress wants to know why

The US military's effort to prevent troops from being tracked by adversaries through purchased location data hasn't worked as well as anticipated, and lawmakers want to know why.

US Senator Ron Wyden (D-OR) and Rep.

Pat Harrigan (R-NC) on Friday asked for an investigation by the Defense Department Inspector General into policies that have only partially stanched the flow of location data that allows military personnel to be tracked and targeted.

In May, Wyden, Harrigan, and a bipartisan group of 12 other members of Congress released details about how commercially purchased location data – often captured by mobile apps and advertising SDKs – can be used to identify where US military personnel gather and to target those locations.

They noted that the DoD has been aware of this threat since at least 2016.

The lawmakers urged Defense Department CIO Kirsten A.

Davies to take steps to mitigate this risk, including turning off advertising identifiers on DoD smartphones and issuing a policy requiring the disabling of advertising identifiers on all personal devices brought into DoD facilities or overseas.

Since then, various military branches have blocked advertising identifiers on government-issued devices.

According to the letter, "several DoD components – the Army, Air Force, Navy and Marine Corps, and Special Operations Command – confirm that they now disable advertising IDs on government-issued devices to protect their personnel from such threats." But that hasn't entirely eliminated the availability of location data tied to US military personnel.

Citing ongoing reports, Wyden and Harrigan want to know why location data pinpointing the movement of troops continues to be available.

"We commend these service branches for implementing this cybersecurity defensive best practice on government devices," they said in their letter [PDF] to the DoD IG.

"However, recent reports regarding the continued availability of commercial location data originating from DoD facilities raise troubling questions." The two lawmakers speculate about the reason DoD policies have fallen short.

One possibility, they say, is that some parts of the DoD turned off their advertising identifiers only as recently as July.

Another, they say, is that disabling ad identifiers may no longer be sufficient to limit the availability of location data.