How Troops' Phones Became Iran's Target Map, and How the Military Is Fighting Back

Iran did not need a spy inside the wire to learn the daily rhythms of American bases in the Middle East. According to the Los Angeles Times, Iranian planners pulled data from social media accounts, fitness apps and even mobile advertising to build what analysts call a "pattern of life" at U.S. installations across the region, then paired it with overhead imagery reportedly supplied by Russian satellites.

The results showed up on the ground. Mark Cancian, a defense analyst at the Center for Strategic and International Studies, told the Times that satellite pictures of struck bases show no random craters, a sign the strikes were carefully aimed. The military is now working to shrink the digital trail its people leave behind, the Times reported.

What follows is a look at how that trail formed, what commanders and Congress have done about it, and what every service member and military family can do starting today.

The conflict with Iran began on Feb. 28. By late July, 18 American service members had been killed and more than 600 wounded, Reuters reported. Iranian missiles and drones have repeatedly targeted U.S. facilities across the Gulf region, which is why even routine details about where troops eat, sleep, work out and shelter have become valuable to the enemy.

The threat has also reached Europe. This month the U.S. moved aircraft out of RAF Mildenhall in England over a reported threat linked to Iran, the second such relocation from a U.S.-run base in Britain in less than two months, Al Jazeera reported. Earlier, American bombers were withdrawn from RAF Fairford while British police investigated a suspected terror plot tied to Iran, an allegation Tehran has denied. A U.S. official described the latest move as a precaution rather than a response to an immediate danger, and the British government said its air bases are safe.

In a letter dated July 28, Adm. Brad Cooper, commander of U.S. Central Command, warned troops that cellphone videos posted online were helping Iran target American bases in near real time, Reuters reported. Cooper explained that U.S. jamming and other battlefield measures would normally make it hard for Iran to tell whether its strikes had worked, so Tehran was combing news coverage and online posts for troops' reactions, photos and footage instead.

He cited one example: video posted to Instagram, reportedly recorded on smart glasses, showing where and how a service member evacuated to a bunker during an Iranian missile and drone attack. Cooper urged the force to "redouble our focus on operational security". Reuters also reported that some deployed personnel could be ordered to surrender their phones, and that troops in Jordan had been told theirs would be collected. A CENTCOM spokesman, Capt. Timothy Hawkins, described the letter as a broad reminder rather than a new set of rules.

The point is not that troops are careless. It is that a single clip, shared with family or friends in a moment of relief, can tell an adversary exactly what a strike hit and how people reacted.

The fitness-app danger is not new. In January 2018, the Strava app's global heat map, which plotted where its users exercised, revealed the outlines of U.S. outposts in Syria and Iraq, because many American personnel wore fitness trackers while few local residents did, NPR reported. That August, the Pentagon barred personnel from using geolocation features on government and personal devices in designated operational areas, left commanders room to weigh exceptions elsewhere, and promised added cybersecurity training. The memo warned that such features can reveal personal information, locations, routines and the number of Defense Department personnel at a site.

Eight years later, the problem has not gone away. A Sky News investigation identified more than 1,300 Strava users sharing thousands of workouts from U.S. military installations across the Middle East, and a follow-up Stars and Stripes review found Strava posts revealing recurring routes and exercise spots at bases in several CENTCOM countries, some with photos of personnel or equipment. The reporting did not establish that Iran used this data to choose its targets, but it showed where people gathered at sites Iran later struck.

CENTCOM's own policy requires personnel to turn off location features they do not need, review their privacy settings and limit what they share publicly, according to Stars and Stripes. Asked whether the public Strava activity complied with those rules or whether anyone had been disciplined, the command declined to say, citing operational security. CENTCOM has also told Congress it received threat reports about adversaries exploiting commercially available location data against U.S. personnel.

Fitness apps are only one leak. Nearly every smartphone carries a mobile advertising identifier. Combined with the location data many apps collect, that identifier can be used to follow a single phone day and night, Task & Purpose reported.

Officials have now told Congress that the Army, Navy, Air Force, Marine Corps and Special Operations Command have disabled those advertising IDs on government-issued devices. The timelines vary: the Air Force acknowledged in a letter to lawmakers that it only ordered the change in July. The fix also stops at government equipment. It does not cover the personal phones most service members carry, and troops can still be tracked through data that apps and mobile networks collect.

Congress has kept up the pressure on a bipartisan basis. Sen. Ron Wyden, an Oregon Democrat, and Rep. Pat Harrigan, a North Carolina Republican, asked the Pentagon's inspector general to investigate whether the military has adequately addressed the risk, and Wyden said existing efforts have not neutralized the threat. The Pentagon said it would respond to the lawmakers directly.

The good news is that most of this exposure can be closed by individuals in a few minutes. Based on the rules and warnings above, these steps make the most difference:

Turn off location services for fitness apps, or better yet, do not record workouts at all while deployed or on base. If you use Strava or a similar service at home, set the profile and every activity to private, hide start and end points, and remove your full name and unit from the profile. CENTCOM's policy already calls for disabling unneeded location features and limiting public sharing.

Do not post photos or video of strikes, damage, shelters, flight lines or base layouts, and do not post your reactions in the moment. Cooper's letter makes clear that Iran mines exactly that material. Wait, and when in doubt, leave it out.

On personal phones, turn off or reset the advertising ID, deny location access to apps that do not need it, and review which apps can track you in the background. The military's own fix covers only government devices.

Families matter just as much. Spouses, parents and friends should avoid posting deployment locations, dates, unit movements, homecoming plans or photos that show base landmarks. A proud post can reveal more than intended.

Wearables and smart glasses deserve the same caution as phones. The Instagram clip Cooper cited was reportedly filmed on smart glasses.

America's service members accept real danger to defend this country, and they deserve every protection their leaders can give them. That includes better enforcement of rules the Pentagon wrote eight years ago, stronger safeguards against the commercial data trade, and clear guidance that reaches every barracks and every military family. It also includes the quiet discipline that has always been part of military life: loose lips, and now loose apps, can cost lives. Guarding that information is one more way Americans at home can stand with those who serve.