The US Military Just Turned Ad Tracking Into a Security Issue

An advertising identifier looks harmless until someone uses it to locate a soldier.

The U.S. Department of Defense has disabled advertising tracking across government-issued devices used by military personnel following concerns that commercially available location data could be used to identify and target troops.

The changes cover managed iPhones, Android devices and Windows computers across the Army, Air Force, Navy, Marine Corps and U.S. Special Operations Command.

It's a cybersecurity story that has surprisingly little to do with malware.

Instead, it exposes the security risks hidden inside the digital advertising economy.

Your location has commercial value

Many apps collect information about how and where devices are used.

That data can be shared with advertising technology companies and data brokers, where it may eventually become commercially available.

In normal consumer advertising, that information helps companies understand audiences and deliver targeted ads.

In a military context, the same data can become operational intelligence.

Senator Ron Wyden raised concerns after finding that unnamed foreign adversaries had used commercially obtained location information to target U.S. troops in the Middle East.

That turns an ordinary privacy issue into a national-security problem.

The advertising ID matters

Phones and other devices can carry advertising identifiers that help advertisers associate activity with a particular device.

Disable that identifier and connecting data back to one person becomes more difficult.

That's why military departments have begun switching off advertising tracking on managed devices.

It's a relatively simple technical change.

The broader problem is much harder.

Military personnel don't only carry government-issued phones.

Personal smartphones belonging to troops, employees and contractors can still travel onto sensitive bases and potentially generate commercially valuable location signals.

Cybersecurity is expanding beyond hacking

The episode demonstrates how much the definition of cybersecurity has changed.

Organizations traditionally focused on threats such as phishing, ransomware, stolen credentials and compromised networks.

But modern digital systems generate enormous amounts of metadata.

Location.

Advertising IDs.

Purchase history.

App activity.

Device information.

Individually, some of this information may appear relatively harmless.

Combined at scale, it can reveal movements, routines, relationships and sensitive locations.

Attackers may not need to hack an organization if the information they want can simply be purchased.

Data brokers are becoming part of the threat model

That creates a difficult problem for governments and businesses.

Companies often protect their own databases while employees continue generating sensitive information through third-party apps and services outside the organization's direct control.

Cybersecurity teams may increasingly have to ask not only:

Who can hack our systems?

But also:

What information about us can someone legally buy?

For industries dealing with defense, critical infrastructure, healthcare or executive security, that question could become especially important.

What happens next?

The military's decision could become a model for other security-conscious organizations.

Enterprises may start restricting advertising identifiers, reviewing app permissions and treating commercial location data as a cybersecurity exposure rather than simply a privacy concern.

The lesson is uncomfortable but important.

Not every valuable piece of intelligence has to be stolen.

Sometimes it is already for sale.