Your phone is constantly snitching on you. Every single second, it leaks a steady stream of coordinates, search queries, and digital habits. Now, imagine you’re a US soldier deployed in a highly volatile region, and that digital trail is being scooped up by hostile intelligence agencies to program precision-guided drone strikes.
This is not a hypothetical spy thriller. It's happening right now in the Middle East.
Recently, US Central Command (CENTCOM) confirmed a terrifying reality to Congress. Foreign adversaries, heavily suspected to be linked to Iran, have been using commercially available smartphone location data and cellular network exploits to track and target US military personnel in active war zones. This is the first time the Pentagon has openly admitted that our own soldiers’ digital footprints are being weaponized against them in a live conflict.
Here is exactly how it happened, why the military has failed to patch this hole for a decade, and what needs to change before the next missile launch.
The Commercial Ad Tech Pipeline
If you want to track a military unit, you don't need a high-tech spy satellite or a double agent in the barracks. You just need a credit card and an internet connection.
Most smartphone apps—weather apps, dating platforms, casual games, and even flashlight apps—make their money by selling user data. They log your device's Mobile Advertising ID (MAID), which is a unique string of numbers assigned to your phone to serve you targeted ads. When you grant an app permission to access your location, it packages your precise GPS coordinates alongside that ad ID.
Data brokers purchase these massive digital trails, aggregate them, and resell them to the highest bidder.
During the buildup to military operations in Iran, actors linked to Tehran used these commercial advertising databases to zero in on US personnel and contractors. By analyzing geofenced location data around specific hotels and forward operating bases in Iraqi Kurdistan, they built highly accurate "patterns of life". They knew exactly where troops gathered, where they slept, and when they moved.
It turns out your smartphone's "digital exhaust" is the ultimate open-source intelligence weapon.
SS7 Exploits and the Legacy Phone Network
While ad tech targets the software on your device, adversaries are also exploiting the physical infrastructure of the global cellular network.
When a soldier roams onto a local partner network in the Middle East, their phone has to communicate with local towers. This relies on a decades-old routing protocol called Signaling System No. 7 (SS7). Developed in the 1970s, SS7 has practically no built-in security. It assumes that any network operator pinging the system is acting in good faith.
Iranian state-linked mobile operators abused these roaming agreements to send rogue SS7 tracking requests. This trick allowed them to locate specific roaming US phones, pinpointing their exact locations without ever having to hack the physical device.
The combination is devastating:
- The Software Side: Ad tech databases track troop habits, movements, and group gatherings.
- The Hardware Side: SS7 exploits pinpoint exact real-time coordinates of specific phones on local networks.
Combined, they create a highly effective, low-cost targeting array.
Why Has the Pentagon Ignored This for Years
The most frustrating part of this security failure is that the Department of Defense (DoD) knew about it for over a decade.
As far back as 2016, contractors briefed senior military officials at the Joint Special Operations Command on how easily phone location data could be weaponized. In fact, the US military has actively bought the same type of commercial location data for its own intelligence purposes. The Pentagon essentially fell into the classic trap of assuming only they were clever enough to use the technology, ignoring the massive vulnerability on their own side.
Even worse, basic cyber defenses were left on the shelf. CENTCOM only rolled out the capability to administratively disable location sharing on military-issued smartphones in May 2026. Shockingly, the advertising IDs on government-issued devices remain active because the Defense Information Systems Agency is still "testing" how to disable them.
That is unacceptable. We are talking about basic software toggles that could protect lives on the front line.
The Hard Reality of Modern Battlefield Security
You can't solve this problem by just telling soldiers to turn off their phones. In modern operations, mobile devices are often an operational necessity. Furthermore, a soldier off-duty is going to want to call their family or browse the web. Expecting 100% digital silence across thousands of troops is a fantasy.
If we want to stop adversaries from tracking our troops, we have to treat commercial data as a primary national security threat. This requires immediate, concrete policy shifts:
- Enforce Hard Ad-ID Blocks on Military Devices: The DoD must instantly block all advertising IDs on any phone brought into a theater of operations. This shouldn't require years of testing.
- Aggressive Roaming Firewalls: US military networks must route roaming traffic through secure, encrypted virtual private networks that mask SS7 ping requests on foreign telecom infrastructure.
- Regulate the Data Broker Wild West: The US government needs to crack down on the unregulated sale of location data. If an adversary can buy a database containing the GPS locations of US bases for a few thousand dollars, our export control laws have utterly failed.
The war in Iran has proved that the battlefield is no longer just physical. If the military doesn't wake up to the threat of the commercial data pipeline, the next targeting notification won't be an ad on a screen—it will be a missile hitting a barracks.
