Pentagon’s wireless services left locations, data exposed, watchdog finds

The Defense Department’s watchdog found that unclassified wireless communications could expose sensitive military information. The biggest gap involved metadata and SMS text messages. Metadata can show when a message was sent and where it originated. That information can reveal the locations of troops, safe houses, and command posts even without reading message content.

The department had security measures for voice and email under its Spiral 4 wireless contract. It did not establish comparable protections for SMS messages. Officials knew malicious actors could intercept unencrypted texts, but the Chief Information Officer had not issued a policy protecting them. The department also failed to review carriers’ security measures.

The report warned that attackers could map communication networks and pinpoint sensitive facilities. Its recommendations remained unresolved. The Inspector General called for stronger metadata protections and reviews of third-party security assessments for the wireless contracts.

SMS messaging is the common mobile service used to send short text messages between phones and wireless networks. “Unencrypted” means the message is not protected by a coded layer that restricts access to its contents. If attackers gain access to the device, network connection, or communications line, they may be able to capture and read the message.

The Defense Department knew malicious actors could exploit known weaknesses to intercept SMS traffic. Investigators cited findings that attackers were using tools to hijack devices and communications lines. The department still allowed unencrypted texts by exception for mission needs, including messages to potential recruits or journalists.

The watchdog found that the Chief Information Officer had not issued a policy protecting SMS messages. That left military users exposed to interception. Stronger messaging systems, device controls, and encryption policies could reduce this risk, but the report’s recommendations remained unresolved.

The Defense Department’s Spiral 4 contract was a massive wireless services arrangement. As of January 2026, it covered more than 568,000 service lines. These lines supported phones, tablets, and other mobile devices used across the department.

The contract mattered because it governed the wireless communications that investigators examined. The department had added protections for voice and email, but not for SMS text messages. It also had not assessed whether its wireless carriers were using adequate security measures or whether additional protections were necessary.

That scale makes weaknesses harder to contain. A gap affecting SMS or metadata could touch a large number of devices and communication links. The Inspector General recommended protecting military metadata and reviewing third-party security assessments connected to Spiral 4. The report said those recommendations remained unresolved.

Communications metadata describes a message’s surrounding details rather than its words. It can include the time a message was sent and the place associated with its transmission. Those details matter because they can reveal who is communicating, when activity increases, and where mobile devices are operating.

For example, messages sent repeatedly from a previously unknown location could help identify a safe house or command post. A sudden burst of messages near a base might indicate troop movement or an operation. The Inspector General warned that malicious actors could use such information to map entire Defense Department communication networks and pinpoint sensitive locations.

The department had not fully assessed how carriers protected this data. The watchdog called for necessary safeguards for military metadata and third-party reviews of Spiral 4 security. Until those steps are resolved, metadata can remain a serious operational security risk.

The department had two major responsibilities it did not fully carry out. It needed to assess how wireless carriers protected communications and data under the Spiral 4 contract. It also needed to decide whether additional security measures were necessary for military users and information.

Investigators found that those carrier reviews had not occurred. The department therefore lacked assurance that wireless providers were adequately protecting communications and metadata. Separately, the Chief Information Officer knew malicious actors could intercept SMS messages but had not issued policy protecting texts. Unencrypted SMS remained allowed by exception for mission needs.

The consequences could be severe. Attackers might map communication networks, locate command posts, and expose operational weaknesses. The Inspector General recommended reviewing third-party security assessments and protecting military metadata. Sen. Wyden said he was glad the department changed its carrier contracts and began receiving outside assessments, but recommendations remained unresolved.

Several technologies can strengthen protection. End-to-end encrypted messaging protects message content so only approved devices can read it. Encrypted network connections protect data while it travels. Virtual private networks, secure government messaging systems, and multifactor authentication can add further barriers. Device management tools can disable risky apps, advertising identifiers, and unnecessary location sharing.

Location security also needs operational controls. Military organizations can limit GPS access, remove commercial tracking tools, restrict Bluetooth and Wi-Fi exposure, and prohibit personal apps on sensitive devices. They can minimize metadata collection and review carrier security through independent assessments. These steps address both interception and location mapping.

The article reports that military branches disabled advertising tracking tools after location data exposed service members and contractors. It also says the Inspector General called for metadata protections and carrier assessments. Those actions show that technical safeguards must be backed by policy, contract requirements, and regular testing.

Encryption protects information by transforming readable data into scrambled code before transmission. The receiving device uses a key to restore the original message. Anyone who captures the encrypted data without the correct key should see unreadable material rather than the message itself.

For mobile communications, encryption can operate between a device and a network or directly between communicating devices. End-to-end encryption offers stronger protection because the message remains coded until it reaches the intended recipient. Encryption does not automatically hide every detail, however. Metadata such as timing, destination, or location may still be exposed unless separately protected.

That distinction mattered in the Defense Department report. The department left SMS messages unprotected and had not fully assessed carrier safeguards. Strong encryption, protected metadata, secure devices, and clear policies would address different parts of the risk. The Inspector General recommended stronger protections and independent security reviews.