A Pentagon watchdog review found that unclassified wireless networks within the Department of Defense were not adequately protected, leaving information such as troop positions and the whereabouts of command facilities open to potential exposure. An audit by the Defense Department's Office of Inspector General found that while some communications under a wireless telecommunications contract had been given a degree of protection, the department had not evaluated the security practices of the carriers involved.
Doing so preserved metadata — including transmission timestamps and origin points — in a way that made geographic tracking of those messages possible.
Two senators — Ron Wyden of Oregon and Eric Schmitt of Missouri — sent a letter toward the end of 2024 raising concerns that Pentagon-issued devices contained security vulnerabilities accessible to foreign intelligence services, a disclosure that moved the Office of Inspector General to launch a formal investigation. Auditors set out to determine whether the Pentagon held the tools needed to protect unclassified wireless traffic flowing through its Wireless Mobility Services agreement, known as Spiral 4. Tallied across phones, tablets, and other connected devices, the Spiral 4 contract was carrying upwards of 568,000 active service lines by January 2026.
Voice and email communications received protective measures from the military, whereas text-based SMS exchanges were left outside the scope of those same safeguards. A written record put in place by the department's chief technology officer set out an accepted level of operational exposure tied to unencrypted SMS exchanges — covering both staff and outside parties — provided that mission needs justified the practice, with specific allowances carved out for communications involving prospective recruits and members of the news media.
Government findings had already documented that threat actors were exploiting tools capable of intercepting device communications and reading unencrypted text messages — yet the activity continued regardless. The report noted that, despite the Chief Information Officer's office having recorded awareness of threat actors exploiting known vulnerabilities to intercept SMS traffic on department-issued mobile devices, no formal policy governing the protection of those text communications had been put in place; investigators also found that the department had not examined what steps mobile carriers were taking to secure data and communications, nor assessed whether additional protective measures were warranted.
Those gaps, researchers found, left room for unauthorized parties to chart communication networks across defense infrastructure, identify the positions of operationally sensitive sites, and uncover weaknesses in how forces are deployed — conclusions the military had already begun acting on through a series of access restrictions put in place after earlier incidents involving exposed or readily accessible metadata and location-tracking data.
Separate written confirmations from each branch of the military — obtained by Wyden and Rep. Pat Harrigan (R-NC) — indicated that advertising tracking tools had been turned off on government-issued devices and phones. Publicly available location data was reportedly being purchased and used by Iran and other actors to monitor — and in some cases physically target — military personnel stationed at bases across the Middle East, with certain installations not deactivating tracking tools until after hostilities had begun. Fitness-tracking platforms including Strava were found to have leaked the whereabouts of military personnel and contractors operating in the area, with those coordinates corresponding to sites that subsequently came under attack.
The Inspector General report's recommendations have yet to be acted upon. A recommendation from the Office of Inspector General directed the Chief Information Officer to evaluate what protective measures are needed for military metadata and to examine outside security assessments tied to the Spiral 4 contracts.
Wyden noted in a written statement that the Inspector General's intervention had prompted the Department of Defense to revise its carrier contracts and commission outside security reviews, while also conveying that he held ongoing concerns about the vulnerability of military personnel to communication security gaps and intended to monitor further findings from the Inspector General's inquiry.
