# The Pentagon Just Admitted Commercial Ad Tracking Is an Intelligence Problem
The US military has done something quietly significant: it turned off advertising tracking IDs on its mobile devices. The official reason, according to reporting on the Pentagon's decision, is that location data sold through the commercial advertising ecosystem has reportedly been used by foreign adversaries to track American troops.
Read that again slowly. The same data pipeline that decides whether to show you a mattress ad or a pizza coupon has been weaponized against US servicemembers.
This is not a privacy story. It's a surveillance infrastructure story — and the Pentagon's response raises uncomfortable questions about the tens of millions of people this technology watches every single day.
## How an Ad Ping Becomes a Target
Every time a mobile app requests an ad, it sends a bundle of data to ad exchanges: a timestamp, GPS coordinates, the device's advertising identifier (Apple's IDFA or Google's GAID), and often dozens of behavioral signals. This happens silently, constantly — location data companies like Venntel, Babel Street, and X-Mode (now rebranded as Outlogic) have amassed records of hundreds of millions of devices, updated with granular precision throughout the day.
The advertiser just wants to know whether you're near a Starbucks. But the dataset looks very different to an intelligence analyst. Pull the movement history for an advertising ID that spent the last six months pinging from Fort Bragg, then a remote base in Germany, then a region you'd rather not specify — and you have a rough order of battle. Do that for a few thousand IDs, and you have something worth paying for.
The commercial market for this data has always had obvious national security implications. Wyden's office, the FTC, and a string of investigative reporters have documented how easily law enforcement, private firms, and — it now appears confirmed — foreign adversaries can purchase this data or obtain it indirectly. The ad-tech industry's standard response has been that the data is "anonymized." The intelligence community has known for years that it isn't.
## What the DoD Actually Did
The specific technical measure the Pentagon implemented is disabling advertising identifiers at the device management level — essentially setting the ad ID to a null value or resetting it constantly so it can't be linked across sessions. Both iOS and Android have long supported this at the individual user level; enterprise Mobile Device Management systems can enforce it fleet-wide.
What this signals, more than anything, is official acknowledgment of a threat model the military almost certainly understood earlier than they're admitting. The question is what took so long.
The answer is probably bureaucratic rather than technical. Commercial OS telemetry, app permissions, and data broker pipelines aren't the Pentagon's traditional adversary infrastructure. They're products, subject to EULA agreements, running on devices soldiers use voluntarily. Until the threat was concrete enough to generate a policy response, it existed in a gray zone that nobody owned.
## The Problem Doesn't Stop at DoD Devices
Here's what the Pentagon's fix doesn't address: the problem is systemic, and the military's supply chain extends far beyond uniformed personnel on government-issued phones.
Defense contractors, cleared staff, family members of intelligence officers, congressional aides with classified briefings — none of these people are covered by a DoD MDM policy. The same adversary who can't track a soldier's IDFA-disabled government phone can still track their spouse's. Can still track the contractor's personal device they brought to the SCIF parking lot. Can still pull movement data for the civilian employee who lives on base.
There's a documented parallel here in how foreign intelligence services have approached OSINT in recent years. The Russian and Chinese intelligence services that have invested heavily in commercial data acquisition don't need to break into government systems when the advertising ecosystem hands them a persistent tracking layer for free, or near-free. The Office of the Director of National Intelligence flagged commercial data broker access as a specific threat vector in a 2024 assessment — and the industry has largely continued operating without meaningful regulation.
## What You Can Do — And Why You Should
The practical steps aren't complicated, but they require actually doing them:
On iPhone: Settings → Privacy & Security → Tracking → toggle off "Allow Apps to Request to Track." Then Settings → Privacy & Security → Apple Advertising → toggle off Personalized Ads.
On Android: Settings → Privacy → Ads → "Delete advertising ID." On newer Pixel devices running Android 12+, this is a one-tap option that replaces your ad ID with zeros permanently.
Neither option makes you invisible. Apps can still use IP geolocation, WiFi fingerprinting, and behavioral inference. But removing the persistent advertising identifier eliminates the single most useful cross-app tracking handle, and it costs nothing.
VPN services reduce exposure further, though they don't eliminate it. The more meaningful systemic fix — regulation of data brokers and real enforcement of consent requirements — hasn't arrived, and the advertising industry has historically fought it hard.
---
## HackWire Analysis
The Pentagon's move is more significant as a political signal than a technical one. Disabling an ad ID is trivially easy; the military could have done this years ago. The fact that it's happening now, and that it's being discussed publicly, suggests the threat intelligence is specific enough that someone decided the optics of admitting "commercial ad data is being used against us" were less costly than continuing to ignore it.
What the coverage is mostly missing is the data broker ecosystem's role in making this possible. This isn't just apps being nosy — it's a purpose-built infrastructure for persistent surveillance that was monetized for advertising and turns out to be equally useful for intelligence. The companies in the middle — the data aggregators, the exchanges, the "enrichment" vendors — have faced almost no accountability. The FTC's action against X-Mode in 2024 was meaningful, but the broader market continued operating.
The pattern here matches what we've seen with infrastructure security more broadly: defenders are perpetually playing catch-up to threat models that were obvious years before they got official acknowledgment. The DoD figured out that classified networks needed rigorous controls in the 1990s. It's taken until 2025-2026 to apply similar rigor to the commercial data layer that sits underneath every personal device its personnel carry.
The other story nobody is writing: cleared contractors and family members remain fully exposed. If the threat model is "adversary purchases data to identify and track military personnel," disabling ad IDs on government phones addresses maybe 20% of the actual attack surface. The rest is still for sale.
For defenders outside the military context — enterprise security teams, critical infrastructure operators, anyone with personnel whose physical movements are sensitive — this should be a prompt for a policy review. MDM configurations that disable advertising IDs are not complex. The question is whether your organization has decided to do it.
— HackWire Editorial
---
## Related Coverage