This summer, my team bought three months of commercially available data to see what someone — perhaps someone ill-intentioned — could learn about American troops. We started with a military installation publicly associated with some of our most sensitive special operations units. We pulled the advertising IDs seen there. There were tens of thousands. We then looked for IDs that also appeared at two other publicly known special operations locations. A few hundred remained.

We picked one phone that spent its nights at a house. Public property records and social media led us to an Army officer publicly described as working in logistics. His movements told us something else. Our researchers eventually confirmed that his actual role was one about which an adversary would care a great deal. A few more clicks led to photos of his children. The phone was his personal phone. We did not hack it. We did not compromise a government network or do anything illegal.

We did not subpoena a wireless carrier. All we had to do was buy commercially available data. That should terrify everyone. The exercise made me uncomfortable, and rightly so. We were looking at the movements of an American service member and, indirectly, his family. A foreign intelligence service, not operating under our Constitution, can buy much of the same data we bought. So could a private company, a criminal organization or anyone else with access to the market. When I served as a Green Beret, finding someone through his phone required expensive equipment and capabilities that largely belonged to governments.

Today, a laptop and a data set available for purchase by anyone can get you surprisingly close. AI makes the problem worse. It can sort through enormous datasets and identify patterns that once took an analyst days to piece together. Stanford's AI Index found that the cost of running capable AI models fell more than 280-fold between late 2022 and late 2024. The economics of surveillance have changed. U.S. Central Command has reported receiving multiple threat reports involving adversary use of commercial location data to target or surveil U.S. personnel during Operation Epic Fury.

The data can also be remarkably cheap. Duke University researchers purchased data about service members that included home addresses and information about their children for as little as 12 cents per person. The Pentagon has finally started responding. On Sept. 4, Sen. Ron Wyden (D-Ore.) and Rep. Pat Harrigan (R-N.C.) released responses from the military services showing that the Army, Air Force, Department of the Navy and Special Operations Command had disabled mobile advertising IDs on government-issued phones.

That closes a real vulnerability, and the services deserve credit for moving on it. But that would not have stopped us from finding the officer we found this summer. His government phone wasn’t what exposed him — we found him through the phone in his own pocket, along with public records and information his family had posted online. That distinction matters, because government guidance governing government devices does not eliminate the data generated by personal devices. Wyden and Harrigan raised the same concern in their September letter, including the possibility that personal phones carried onto military installations remain an important source of commercial location data.

Turning off an advertising ID also does nothing to data that has already been collected. Commercial datasets can preserve years of history. An adversary looking at an officer today may be able to reconstruct where that officer lived, trained, traveled and worked long before the setting was changed. I am often asked whether a burner phone or a privacy-focused carrier solves this. Both can help, but neither makes the problem disappear.

A burner phone stops being anonymous when you load your normal apps onto it, carry it between your home and office, connect it to familiar Wi-Fi networks, or routinely place it next to the phone everyone already knows belongs to you. The same problem exists with a phone that has no cellular service at all. Wi-Fi networks, apps, advertising technology and other commercial systems continue to generate information that can help connect a device to a person. The cellular carrier is only one part of the data trail.

Congress has started looking at the larger problem. The House-passed Fiscal Year 2027 National Defense Authorization Act addresses what the government calls ubiquitous technical surveillance. The provision would require the Secretary of Defense to designate an organization responsible for coordinating the identification of surveillance vulnerabilities, along with a department-wide strategy, new training, and a plan for establishing a permanent program of record across the department.

Commercial surveillance doesn't fit neatly inside the traditional boxes of cybersecurity, intelligence, communications or force protection. Different organizations own pieces of the problem. Nobody owns all of it. That makes one-off fixes almost inevitable. Turn off one identifier and another source of data becomes useful. Remove a record from one broker and it can reappear somewhere else. Lock down a government device and the personal phone beside it may still be broadcasting enough information to identify its owner.

The Department needs an accountable owner responsible for understanding that exposure as a whole: identifying which service members and families are most exposed, assessing what information about them is already commercially available, determining what can be removed or mitigated, and giving commanders a way to understand a person's digital exposure before deployment and as it changes over time.

The services have already shown that they can move quickly when a vulnerability is clear. Turning off advertising IDs was a useful step. The harder problem is everything that remains outside that setting: years of existing data, personal phones, apps, public records, social media and an industry built to connect all of it. Our adversaries don't need to invent a new intelligence capability to exploit that information. They can buy it. Erik Wittreich is chief executive officer at Veilant and a former Army Green Beret.