The U.S. Central Command (Centcom) confirmed to Congress in April that adversaries could exploit commercial location data to surveil or target U.S. personnel in theater. Following this admission, several military branches moved to disable mobile advertising IDs on government-issued devices to prevent tracking. The Navy issued “cyber threat hygiene recommendations,” urging sailors to limit social media activity and disable location services on personal devices. An acting secretary of the Navy later directed personnel to “harden” their online profiles and advise family members to do the same. In high-risk areas, some units have instituted procedures for confiscating and locking away personal devices.
The effectiveness of these measures remains under scrutiny. A letter to the Pentagon from Sen. Ron Wyden and Rep. Pat Harrigan cited the continued availability of commercial location data from Pentagon facilities, suggesting personal devices may still be leaking information. Additionally, a Sky News investigation found that over 1,300 users of the fitness app Strava were still sharing workout routes and timings, despite the Pentagon having flagged the platform as a security risk more than seven years prior. Analysts note that such data can reveal shift rotations, meal times, and base geometry with high precision. Erik Wittreich, CEO of secure-communications firm Veilant, stated that this represents an era of “ubiquitous technical surveillance,” where data brokers allow adversaries to purchase intelligence without hacking systems.
Naval Support Activity (NSA) Bahrain, the Navy’s main logistics hub since 1995, exemplifies the vulnerability of fixed infrastructure. For decades, personnel viewed the base as safe, comparable to installations in the U.S. mainland. However, Google Maps listings for the base, including reviews of its gym and galley, provided detailed insights into its layout and operations. Mark Cancian of the Center for Strategic and International Studies noted that satellite imagery of attacked bases showed no random craters, indicating precision targeting rather than indiscriminate fire. Iran targeted 26 U.S. military sites in the first six months of the conflict, along with hotels used for evacuations.
Despite intercepting more than 90% of Iranian attacks, the U.S. suffered extensive damage to runways, hangars, aircraft, and radar systems. Estimates suggest that repairing damage to regional bases, excluding aircraft and equipment, will cost approximately $9 billion. Admiral Daryl Caudle, Chief of Naval Operations, stated in August that due to the extensive damage at NSA Bahrain, “we’re not getting back in there anytime soon.” The base currently appears largely abandoned, with only security personnel permitted on premises. Questions are now intensifying regarding the strategic viability of maintaining large, fixed U.S. installations in close proximity to Iran, given the reduced time available for detection and interception.
