Pentagon’s wireless services left locations, data exposed, watchdog finds

The Department of Defense failed to fully secure unclassified wireless communications, allowing sensitive data including locations of troops and command facilities vulnerable to be exposed, the Pentagon’s watchdog found.

A new report from the Department of Defense Office of Inspector General found that although the department had taken steps to protect some communications under a major wireless telecommunications contract, it failed to vet carriers’ security measures. As a result, that left metadata intact, such as when messages were sent and from where, allowing locations to be pinpointed.

The Office of Inspector General initiated the investigation following a late 2024 letter from Senators Ron Wyden (D-Ore.) and Eric Schmitt (R-Mo), which warned of vulnerabilities in Department of Defense devices that put them at risk of foreign espionage groups. The objective was to see if the Defense Department “had capabilities to secure its unclassified wireless communications” procured through its Wireless Mobility Services, or Spiral 4, contract.

The subject was the Pentagon’s massive Spiral 4 contract, which as of January 2026, the IG said, has more than 568,000 service lines for phones, tablets and other devices. The military did enact security measures for voice and email communications, but did not do so for text messages that use short message service or SMS messaging. The department’s chief information officer “accepted the operational risks from mobile device users sending unencrypted text messages using SMS messaging to meet mission needs by exception.” Those exceptions included outside communications to potential recruits or to journalists.

That was despite several government findings that showed malicious actors were using tools to hijack and breach devices and communications lines and read unencrypted SMS texts. Although the office of the Chief Information Officer “stated that they were aware that malicious actors could exploit known vulnerabilities to intercept and read SMS messages transmitted to and from” department mobile devices, the report said, it “had not issued policy for protecting text messages.”

Additionally, investigators found that the department had not looked into what mobile carriers were doing to secure data and communications or see if additional security measures were needed. That left vulnerabilities through which “malicious actors could map entire communication networks within the DoW, pinpoint sensitive locations like safe houses or command posts, and expose operational vulnerabilities, significantly compromising national security.”

The findings come after the military initiated several security restrictions after instances of metadata and other location tracking technologies being exposed or found to be easily accessible. This summer, Wyden and Rep. Pat Harrigan (R-NC) shared confirmation from the different branches of the military that they had disabled advertising tracking tools in government-issued devices and phones. That came after reports showed Iran and other groups were using commercially available location data to track and even target American personnel at bases in the Middle East, with some only disabling trackers after the war had started. An investigation this summer showed that data on apps such as Strava exposed the locations of service members and contractors in the region, in places that were later attacked.

According to the Inspector General report, its recommendations remain unresolved. The Office of Inspector General called for the Chief Information Officer to assess necessary security measures to protect military metadata, review third-party security assessments for the Spiral 4 contracts

In a statement to Task & Purpose, Sen. Wyden said that he was “glad that the Inspector General spurred the DOD to change its contracts with the wireless carriers and receive third-party security assessments.”

“I remain concerned that our service members remain at risk from the military’s insecure communications and look forward to seeing what else the Inspector General finds,” Wyden added.