The Army can screen the personal electronic devices of deceased soldiers to check for information that is either deemed classified or controlled in nature, according to a new policy.
The screening will be done by the Joint Personal Effects Depot, which manages the personal items of troops who die overseas. An Army policy memo sent to the force this month sets up a process for future conflicts where the service can retain soldiers’ personal cell phones and computers to screen for classified information, Controlled Unclassified Information, operational security, or personally identifying information left on the device.
Classified information is broken into multiple tiers, including Top Secret, Secret, and Confidential, based on the impacts that it could have on national security. Controlled Unclassified Information is a separate designation used to describe government-owned or created information that is sensitive in nature and considered protected.
The Army’s mortuary affairs regulation states that documents and sealed materials belonging to deceased soldiers will be reviewed to “ensure proper safeguarding of military information” and that classified materials will be withdrawn. It also states that civilian or military law enforcement can retain soldiers’ personal items for investigations.
The new policy was issued to clarify gray areas over the handling of personal devices, said Lt. Col. Orlandon Howard, an Army spokesperson.
The policy was issued to “keep up with the pace” of evolving technology and the “understanding that these devices have capability to transfer sensitive information,” Howard said, adding that the policy helps clarify “who should we be checking more closely or handling differently based on their access to sensitive information,” because of their job.
The policy not only outlines who is and isn’t allowed to store or access classified information on their cell phones or computers, but also shows the growing concern over the amount of information stored on personal devices, said David Cook, an intelligence soldier in the Army Reserve and national security director at ShadowDragon, an open-source intelligence software tool.
“It’s telling of sort of the time and age that we’re in where your phone tells everything about you. I mean, we develop patterns of life on terrorists because of the devices that they carry in their pocket,” Cook said.
Troops are not allowed to access classified information on their personal devices, under Department of Defense policies, but many soldiers will have military files like alert rosters on their phones, which include contact information for every soldier in their unit. While one piece of information alone might not be classified, it can be combined with other pieces of data to reveal classified information — a concept referred to as classification by compilation.
“If you have an alert roster, a date for a deployment and a location like any one of those pieces of information by itself is not classified or CUI or anything like that, but if you put it all together then it becomes either CUI or higher,” Cook said.
To further muddy the waters of what information is technically off limits, the Army’s Bring Your Own Device program allows soldiers to remotely connect to their service email, Microsoft Teams chat and OneDrive cloud storage on their own devices.
Force protection
Gary Barthel, a retired Marine lieutenant colonel and a civilian lawyer who has represented troops in military and civil legal cases said the policy acts as a force protection measure to prevent sensitive military information disclosures.
“If there’s something that’s on a deceased service member’s phone or other equipment that might jeopardize that operation or certain individuals or certain enemy combatant targets, that would be a concern,” he said.
At a minimum, troops can be punished for accessing classified information on their personal devices under the Uniformed Code of Military Justice or, in the worst cases, they can be federally prosecuted for leaking it online. But for family members, the military doesn’t have direct control over their conduct online.
“Even seemingly innocent posts about a family member’s deployment or redeployment date can put them at risk. Small bits of information can be assembled to make big pictures,” an Army website on social media guidelines states.
The policy also mentions personally identifiable information which Cook said may include more innocuous data that could be exploited — a real-world consequence playing out on the battlefields in Ukraine and Russia where cell phone tower data has been used to geolocate troop positions.
“Service members that are down range, especially those deceased, they have pictures on their phone that may give away sensitive information,” he said. “If I snap a picture down range, I don’t post it anywhere, but it is on my phone and I die, then who has access to it? If it’s uploaded to a cloud and the cloud gets compromised in a rapid fashion, then that could expose sensitive information, troop movements, location, all that kind of stuff.”
‘Open season on searching the devices’
The policy limits the screening to information physically kept on the device but also states that any evidence indicating that classified information was transferred to the cloud will be relayed to investigators.
Brian Ferguson, an Air Force reservist who represents troops as a civilian lawyer said the expectation of privacy “dies along with a person.” In investigations into service members suicides or criminal investigations, the military typically holds onto personal devices to look for evidence.
“It’ll be open season on searching the devices, but honestly I think that’s kind of always been the policy,” he said. “The point of this might be to make it more restrictive, not less, honestly, because I can’t think of an instance where a military law enforcement agency that finds a dead soldier isn’t immediately gonna go through his devices.”
According to the policy, personnel in charge of managing soldiers’ personal items “will make reasonable attempts” to bypass any encryption and can enlist the help of “an external agency,” like the National Security Agency, for instance. If officials can’t get past the encryption, they will do an assessment and deem it high or low risk of whether they believe sensitive information exists on the device. Depending on the result of that assessment they’ll either retain the device and review it, if it’s deemed as high risk, or transfer it to the soldier’s next of kin, if it’s deemed to be at low risk of having sensitive information.
Daniel Conway, a former Army lawyer, said the policy could raise future privacy concerns and gives little information on the risk assessment scope and implementation.
“We don’t know what’s happening to the data after it’s being retrieved. We don’t know how it’s being stored. We don’t know whether it’s being destroyed,” Conway said. “Are they going through all his emails? Are they going through his photos? Are they inspecting his banking data? Are they inspecting his phone calls? What other purposes is the data being used for?”
The policy states that classified, personally identifiable and private health information will be removed before the device is returned to the next of kin.
As a private lawyer, Conway has represented family members of troops who want legal help getting their deceased child’s cell phone back after they were retained for suicide investigations. While deceased service members have little to no privacy protections, Conway said this could raise privacy problems for grieving parents or spouses.
“I wouldn’t want presumptively unqualified soldiers going through all of the digital data of my loved one, seeing probably private content, seeing maybe evidence of the depression, seeing mental health related concerns that they may have had all under the guise of protecting national security,” Conway said. “I can see how that might be a significant invasion of a living person’s privacy, particularly if they’re going through spousal issues and whatnot, maybe there’s sensitive financial data that’s now going into possession of the government.”
The latest on Task & Purpose
- Sergeant Major of the Marine Corps learns an old lesson: Don’t mess with Audie Murphy
- A breakdown of safety procedures ‘directly contributed’ to an 82nd Airborne paratrooper’s death
- WWII Marine Raider who fought at Iwo Jima, Guadalcanal wants cards for 100th birthday
- Navy identifies special warfare sailor killed while parachuting
- Pentagon appears to pause renaming of Navy ships
