Vast amounts of location data — 3.6 billion GPS coordinates — legally collected and sold by U.S.-based data brokers such as Florida-based Datastream Group are exposing the movements of American military personnel, intelligence workers, and even nuclear weapon sites in Germany. The data from everyday mobile devices reveals sensitive patterns, including visits to classified installations, barracks, and even personal routines, posing a severe national security risk.
With minimal regulation in the data brokerage industry, foreign adversaries, criminals, and other malicious actors could exploit this information for espionage, blackmail, or targeted attacks.
An investigation by Wired, Bayerischer Rundfunk, and Netzpolitik.org exposes alarming gaps in data regulation and underlines the urgent need for comprehensive reforms to safeguard national security and personal privacy.
“We traced these devices from barracks to work buildings, Italian restaurants, Aldi grocery stores, and bars. As many as four devices that regularly pinged from Ramstein Air Base were later tracked to nearby brothels off base, including a multistory facility called SexWorld,” researchers said.
The investigation tracked devices through thousands of signals at more than 11 sensitive sites in Germany, including intelligence hubs, training grounds, and weapon storage facilities. The data, which can be purchased legally, offers insights into guard schedules, building entry points, and even personnel’s off-base leisure activities — information ripe for exploitation by adversaries.
Devices transmitting from Lucius D. Clay Kaserne, the US Army’s European headquarters, revealed predictable daily routines, including commutes to restricted areas and dining habits. The investigation uncovered similar patterns at other critical installations, such as Ramstein Air Base, a key hub for drone operations, and Büchel Air Base, where nuclear weapons are reportedly stored in underground vaults.
The implications of such data being accessible to hostile actors are severe. As Justin Sherman of Duke University’s Sanford School of Public Policy notes, even low-ranking personnel with access to critical systems could become targets for exploitation.
“The data is not infallible. Mobile ad IDs can be reset, meaning multiple IDs can be assigned to the same device. Our analysis found that, in some instances, devices were assigned more than 10 mobile ad IDs,” researchers continued. “The location data’s precision at the individual device level can also be inconsistent. By contacting several people whose movements were revealed in the dataset, the reporting collective confirmed that much of the data was highly accurate—identifying work commutes and dog walks of individuals contacted.”
At the heart of this issue is the unregulated data broker industry, which collects, packages, and sells data from mobile apps under the guise of advertising. Datastream Group and other companies often profit from selling these datasets without robust checks or oversight.
Researchers explain that US lawmakers have known about these risks for years. In 2016, a contractor demonstrated how location data could trace the movements of US troops abroad, but little has changed since. Senator Ron Wyden, a longtime advocate for data privacy, criticised the lack of regulatory action, calling the sale of sensitive location data “outrageous.”
Moreover, efforts to pass privacy legislation like the American Privacy Rights Act and the Fourth Amendment Is Not For Sale Act have stalled in Congress, leaving the door open for continued abuses.
In the News: Microsoft unveils 4 security features to prevent future outage incidents
