Abstract:
The U.S. military recently turned off ad tracking on some devices. Previously, U.S. military officials reported that hostile forces may use commercial location data to target or monitor U.S. personnel deployed in the Middle East. The move highlights how personal location data originally used for digital advertising is becoming a security risk on the battlefield.
The U.S. Air Force and U.S. Special Operations Command have recently turned off the Mobile Advertising Identifier (MAID) on some computers and mobile devices, according to a letter provided to Reuters by U.S. Senator Ron Wyden’s office. The U.S. Army also confirmed that it had taken similar measures earlier this year. The Navy and Army did not disclose the specific implementation time.
MAID is an advertising identifier used to identify mobile devices, allowing advertisers to track user activity and deliver targeted ads. Although it usually does not directly contain the user's name, when combined with other data, it may still be used to infer personal identity, activity trajectories, and daily whereabouts. The measures taken by the military this time are precisely to reduce the possibility of such information being used to locate military personnel.
Wyden has previously asked the Pentagon whether the military is taking enough steps to prevent commercial location data from being used to attack U.S. personnel. U.S. Rep. Pat Harrigan also participated in related actions. The two said the Pentagon should investigate whether military personnel are at risk due to the collection and sale of location data by the ad tech industry.
U.S. Central Command said in a letter sent on April 14 that it had received multiple threat reports about hostile forces using commercial location data to target or monitor U.S. personnel. The command is responsible for U.S. military operations in the Middle East and other regions. The letter did not disclose specific details of the incident, but Wyden and other lawmakers believe it is the first time the U.S. military has officially confirmed that U.S. personnel may be targeted based on commercial location data in active combat zones.
Commercial location data is typically collected by smartphone apps or service providers and subsequently sold to data brokers. Data brokers aggregate, collate, and resell this information through a complex network of middlemen. While the industry has long been criticized for privacy violations, the risk that location data could be used for military reconnaissance and attacks has also been a growing concern in recent years.
As early as 2016, a U.S. defense contractor used commercial location data to track U.S. special operations forces from their home base to a sensitive assembly point in Syria. In recent years, Wired magazine and two German media have also used billions of coordinate information collected by data brokers to expose the detailed movement tracks of personnel around 11 US military and intelligence facilities in Germany.
Wyden said that commercial location data can help hostile forces identify where U.S. military personnel gather and their daily activity patterns, and may be used to plan missile, drone or roadside bomb attacks, or even conduct counterintelligence operations. He believes the government should move faster to protect military personnel, including turning off advertising identifiers on military devices, automatically turning off location-sharing features on smartphones in war zones, and directing military personnel to use more privacy-focused browsers.
The Pentagon said it would respond directly to lawmakers' concerns but did not elaborate further. Wyden and Harrigan said they had repeatedly tried to get more information about the threat reports from military officials but had been unable to get satisfactory answers.
This action also reflects that the U.S. military is reassessing the impact of commercial data on national security. In the past, the ad tech industry was primarily viewed as a privacy issue, but as commercial location data can be used to track military personnel and identify patterns of base activity, the risks go beyond protecting personal privacy.
However, privacy experts point out that turning off advertising identifiers is only a step to reduce risk and does not completely eliminate the possibility of location data leakage. Other apps, services and devices may still collect location information, so the military will also need to take more comprehensive steps to limit the collection, sharing and use of location data.
Comments