NDAA Proposal Targets Troop Mobile Data Risk After CENTCOM Warning

A proposed FY2027 defense bill provision would require the Pentagon to test technologies that reduce troops’ exposure to commercial mobile surveillance.

Social media apps are displayed on a mobile phone, in this file photo. Saeed Khan/AFP via Getty Images

A proposed provision for the FY2027 National Defense Authorization Act (NDAA) would require the Pentagon to test technologies aimed at reducing U.S. troops’ exposure to commercial mobile surveillance, after U.S. Central Command (CENTCOM) told Congress that adversaries had exploited commercial location data to target or surveil U.S. personnel during Operation Epic Fury.

The proposal, prepared for congressional distribution by Joe Weil and Mike Yeagley of Unplugged and obtained by The Epoch Times, would direct the defense secretary to establish a pilot program for “mobile device force protection technologies” intended to reduce operational exposure from application-generated signals.

The draft proposal says a servicemember’s phone can become a “targeting feed for adversaries” because data collected by applications can pass through third-party networks and be reassembled into a trackable identity.

CENTCOM told Congress on April 14 that it had received “multiple threat reports” concerning adversary exploitation of commercial location data to target or surveil U.S. personnel in theater during Operation Epic Fury, according to a May 28 letter led by Sen. Ron Wyden (D-Ore.) and Rep. Pat Harrigan (R-N.C.).

The proposal would move the Department of War (DoW) beyond settings-based privacy controls and require outcome-based testing of technologies that can identify, report, and control mobile application signals that may expose troop movements or patterns of life.

Proposal Targets App Data

The proposed NDAA provision would require the war secretary to establish a pilot program within 180 days of enactment. Within 90 days after a pilot is completed, the secretary would determine whether the tested technology produced measurable reductions in operational exposure from commercial mobile surveillance.

The draft text would require tested technologies to identify applications generating force-protection-relevant signals, determine where those signals are sent, characterize the categories of information transmitted, distinguish legitimate app functions from analytics, diagnostics, advertising, profiling, and related exploitation activity, and generate commander-level reporting.

The technologies would also have to actively control application-generated transmissions, including by blocking or throttling signals leaving a device, according to the proposal.

The draft calls for annual reassessments of any deployed technology and says the provision should not be construed to require a particular technical architecture or commercial vendor.

CENTCOM Confirmed Threat Reports

In their May 28 letter to DoW Chief Information Officer Kirsten Davies, lawmakers said the department had not taken basic steps to protect military personnel from the collection and sale of personal information, including cellphone location data, by data brokers.

“DoD has now confirmed to Congress that foreign adversaries are exploiting commercially available location data to target U.S. military personnel in war zones,” the lawmakers wrote.

CENTCOM’s written response, attached to the letter, said personnel were not prohibited from possessing or using personal smartphones in the CENTCOM area of responsibility. It said the command maintained restrictions on geolocation features through Command Policy Letter No. 25-10, dated Dec. 4, 2025.

The response said CENTCOM guidance directs personnel to disable geolocation functionality when not needed, review device and application privacy settings, and limit public sharing of information. It also said disabling geolocation capabilities does not always fully disable them on commercial products.

CENTCOM told Congress that the command’s Threat Fusion Cell identified, tracked, and disseminated the threats through a threat working group and to component force-protection personnel.

CENTCOM, in its response, said the personalized advertising setting was disabled by group policy on government-issued phones, but that ad-targeting information was not disabled and could be edited by users. It said the Defense Information Systems Agency was testing implementation to disable the ad-targeting setting.

Congressional Response

Harrigan’s office told The Epoch Times that the DoW had not responded to the May 28 letter and that it was unknown whether the department had determined that commercial location data played a role in a March 1 attack in Kuwait that killed six U.S. Army Reserve soldiers.

His office said Harrigan supports FY2027 NDAA language addressing the issue.

When asked what immediate steps the DoW should take, Harrigan’s office said troops in deployed high-threat environments should stop using vulnerable apps and software and move to encrypted devices, apps, servers, and browsers that do not sell or disclose troop data.

The May 28 letter was signed by a bipartisan group of lawmakers, including Wyden, Harrigan, Sen. Martin Heinrich (D-N.M.), Sen. Elizabeth Warren (D-Mass.), Sen. Edward Markey (D-Mass.), Sen. Alex Padilla (D-Calif.), Rep. Elijah Crane (R-Ariz.), Rep. Robert Garcia (D-Calif.), and others.

The lawmakers urged the department to disable advertising IDs on all DoW-issued smartphones, mandate that personnel disable advertising IDs on personal phones brought onto DoW facilities or overseas deployments, remove data-collecting browsers from DoW devices, and coordinate with state privacy regulators on data-broker deletion systems.

China Data Risks

China is a central concern in the broader U.S. data-security debate.

The DOJ said in 2025 that its Data Security Program is intended to prevent China, Russia, Iran, and other foreign adversaries from using commercial activities to access and exploit U.S. government-related data and Americans’ sensitive personal data for espionage, surveillance, counterintelligence, artificial-intelligence development, military capabilities, and other national-security harms.

In its final rule implementing Executive Order 14117, the department said countries of concern can use access to U.S. government-related data or Americans’ bulk sensitive personal data to track and build profiles on U.S. individuals, including military members, federal employees, and contractors, for blackmail, espionage, and other illicit purposes.

The rule said China “aggressively obtains and exploits data on U.S. persons through both commercial means and theft” and has growing artificial-intelligence capabilities, creating what the DOJ described as a significant risk that Beijing could exploit government-related data or Americans’ bulk sensitive personal data to harm U.S. national security.

U.S. prosecutors have also alleged Chinese military involvement in major data thefts. In 2020, the DOJ charged four members of China’s People’s Liberation Army with hacking Equifax and stealing sensitive personally identifiable information of about 145 million Americans. The FBI described the breach as the largest known theft of personally identifiable information carried out by state-sponsored actors.

The proposed NDAA provision focuses on a narrower operational problem: whether the Pentagon can measure and reduce signals generated by mobile applications before those signals become commercially available or are combined with other data sources.

The proposal says current legal authorities address data primarily at the point of sale or transfer, while the force-protection gap begins earlier, on the devices carried by personnel.

Force Protection Concerns

The data warning comes amid continuing concern over force protection during Operation Epic Fury. Six U.S. Army Reserve soldiers were killed on March 1 in Kuwait at the Port of Shuaiba during an unmanned aircraft system attack while supporting the operation, according to the Army Reserve, which said the incident remains under investigation.

A defense official responding for CENTCOM on background declined to discuss force-protection measures for operational security reasons.

“Generally speaking, we continue to take all appropriate measures to ensure the safety and well-being of our forces,” the official said.

The Epoch Times also sought comment from the Pentagon and the Army Reserve, neither of which responded by press time.

CENTCOM’s April 14 written response to Congress said the command’s threat assessments inform force-protection measures across the area of responsibility.