You pack your gear, log out of your personal accounts, and leave your laptop behind. But you keep your smartphone in your pocket. That single device might be the biggest security vulnerability you carry into a theater of operations.
Data leaked from global telecommunications systems and commercial networks shows that during the recent conflict involving Western and regional forces in Iran, an aggressive, quiet surveillance campaign targeted the phones of US military personnel and contractors. This wasn't a sophisticated exploit that required zero-day malware or complex hacking tools. Instead, it weaponized the everyday plumbing of global cellular networks and the digital ad economy.
If you think your location is safe just because you turned off your GPS or swapped your SIM card, you don't understand how modern mobile infrastructure works.
The Secret Exploitation of Roaming Networks
When you travel abroad, your phone needs to find a local network to handle calls and text messages. To make that happen, global carriers rely on an old signaling framework called SS7 (Signalling System No. 7). It's a protocol built decades ago on absolute trust. It assumes that if a telecom network asks where a phone is to route a call, the request is legitimate.
During the build-up to the military actions in late February, and continuing through the subsequent drone and missile exchanges, regional mobile networks faced a barrage of suspicious requests. These requests are known as SS7 pings. They don't send a message to your screen or trigger an alert. They simply ask the local network where a specific roaming device is currently registered.
Data analyzed by cybersecurity researchers, including Gary Miller at Citizen Lab, revealed a highly coordinated campaign. This wasn't random, automated network scanning. It was precise user targeting aimed at identifying specific devices carried by Western personnel.
Many of these tracking attempts carried a specific technical fingerprint that pointed directly back to an Iranian mobile operator. Because Iranian carriers maintain roaming agreements with providers across the Persian Gulf, they could legally send these routing queries straight across international borders into networks hosting US troops.
Ad Tech Is a National Security Threat
The network signaling abuse was only half the problem. In areas like Iraqi Kurdistan, adversaries bypassed the telecom operators entirely by exploiting commercial advertising databases.
Every smartphone generates an advertising identifier—a unique string of numbers used by marketers to track your habits and serve you relevant ads. Apps on your phone constantly broadcast this identifier alongside your precise geographic coordinates to ad exchanges around the world. This is what security professionals call "digital exhaust".
Hostile actors bought or intercepted this commercial data stream to map out exactly where US government workers and contractors were staying. They used it to pinpoint specific hotels and compounds housing foreign personnel.
You don't need a state-sponsored cyber weapon when you can buy location data on the open market for a fraction of a cent per device. US Central Command openly acknowledged this reality, telling Congress that it received multiple threat reports regarding how adversaries use commercial location data to monitor forces in the field.
What This Means for Operational Security
The Pentagon has downplayed whether this data tracking directly caused specific kinetic hits or missile strikes. Military targeting is rarely built on a single source of information anyway; it combines satellite imagery, local informants, and open-source intelligence like public social media posts.
But relying on deniability is an incredibly dangerous strategy. If an adversary knows which hotel is filled with foreign contractors because fifty phones are broadcasting ad IDs from the exact same coordinates every night, the operational security of that entire unit is compromised.
Lawmakers like Senator Ron Wyden have pushed for tighter controls on how technology companies handle and sell location data linked to government personnel. But policy fixes take years. The technical vulnerabilities in SS7 and the global ad exchange ecosystem are baked into the way the modern internet runs. They aren't going away anytime soon.
If you deploy to a high-risk region, relying on standard phone settings isn't enough. You need to manage your personal digital footprint actively.
- Turn off roaming entirely before entering a sensitive theater. If your phone never tries to shake hands with a local network, it can't be pinged via regional SS7 loops.
- Reset or disable your advertising ID in your phone's privacy settings. On iOS, turn off "Allow Apps to Request to Track." On Android, delete your advertising ID completely.
- Utilize localized travel routers or secure, vetted hotspots rather than relying on direct cellular connections for your primary device. Keep your phone in airplane mode with location services turned off at the system level whenever possible.
The realities of the modern battlefield mean that the device in your pocket is constantly talking to the world around you. If you don't control what it says, someone else will use it against you.
