Security1 publisher2 min readPublished
Army, Navy, Air Force and SOCOM switch off the advertising ID on issued devices
The identifier that lets data brokers follow one handset from app to app is now disabled on government-issued phones at four US military organisations, after months of pressure from Senator Ron Wyden.
The Watch · Security desk
What happened
- The US Army, Air Force, Navy and Special Operations Command have disabled advertising IDs on government-issued devices, confirmed after Senator Ron Wyden released a set of letters last week.
- US Central Command reportedly warned in April of multiple threat reports concerning adversary exploitation of commercial location data.
- Wyden and Representative Pat Harrigan wrote to the Pentagon last week asking its inspector general to investigate whether the armed forces have properly countered the trade in their location data.
- At the end of last month the US Navy told personnel to clean up their social media profiles because adversaries might be mining them for open-source intelligence.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The policy reaches government hardware. The personal handsets carried by the same people still emit the same identifier next to the same locations, and confiscation at a deployment site is the only remedy so far applied to those.
- constraint The change works forward only. Brokers keep the location records they have already bought, so an organisation doing this now limits future collection and leaves the back catalogue where it is.
- precedent Four US military organisations have now set a benchmark an inspector general can measure others against. That makes ad-ID suppression the default expectation for any employer whose staff travel into hostile or contested countries.
- capability Both mobile platforms already expose the control to the device holder, so an organisation can match the military posture without buying a product to do it.
An advertising ID by itself is nearly worthless to an adversary. It is a character string tied to one handset, Apple's IDFA or Google's GAID, and its job is to let advertisers recognise the same device as it moves between unrelated apps [4]. Most apps pass it to outside companies, and from there it reaches data brokers who buy and sell it [5]. Join it to the location data those same apps collect and it becomes a way to see where one phone goes, day and night [6].
Reuters reported Representative Pat Harrigan saying: "[US enemies] should not be able to pull out a credit card and buy information that helps them track American troops." [9]
So far the disabling rests on reporting. Bitdefender, whose account rests on Wyden's released letters and on Reuters reporting, says confirmation emerged after the letters went out, and it did not date the switch-off at each organisation or say how the change is enforced on issued hardware [1][2]. Wyden has been pressing the Pentagon on this for months [3]. The Marine Corps and Space Force are not on the list of organisations named [16].
The same problem produced a blunter instrument in July, when Reuters reported that troops in Jordan had been told their personal devices would be confiscated to prevent adversaries getting at the "reactions, photos, and footage from the cellphones of our troops" [10].
For everyone outside the Pentagon, the control is two settings. On an iPhone: Settings > Privacy & Security > Tracking, then switch off "Allow Apps to Request to Track" [12]. On Android: Settings > Privacy > Ads, where recent versions allow deleting the advertising ID outright [13]. Neither step closes every route to tracking a handset [14].
What to watch
- Whether the Pentagon inspector general takes up the Wyden and Harrigan request, and whether the scope covers contractors as well as uniformed personnel.
- Whether the Marine Corps and Space Force publish the same control or say they already had it in place.
- Whether any service moves from confiscating personal devices to setting policy on the advertising ID they carry.