A recent study by the Army Cyber Institute at West Point has found that the U.S. Army’s unclassified IT infrastructure in the continental United States is heavily infiltrated by corporate surveillance. The researchers analyzed the 1,000 most frequently requested internet resources on Army networks over a two-month period and discovered that 21.2% were “tracker domains” that exist solely to harvest user data and analytics.
The study revealed that these tracker domains, which include companies such as Adobe, Microsoft, and Akamai, accounted for nearly 42% of actual web requests. Additionally, 10.4% of the original sample consisted of standard websites embedded with tracking code. The data collected by these adtech trackers includes geolocation, email addresses, and browsing preferences, which is then aggregated and sold by data brokers as commercially available information (CAI). This raises concerns that adversaries could potentially purchase this data to identify and analyze how servicemen and women interact online. The study also found that TikTok, which was banned on federal devices due to its Chinese ownership, was among the tracker domains, along with Google China and a defunct gambling site.
According to Alan Woodward, professor of cybersecurity at the University of Surrey, the findings suggest that lessons from past incidents involving commercial products exposing sensitive military data have not been learned. Woodward cited the example of fitness app Strava‘s public “heat map” revealing the locations and patrol routes of military bases around the world in 2018. “It sounds like simple operational security,” Woodward says, “but still many systems administrators haven’t learned that old lesson that on the internet, if you’re not a paying customer you are the product.” The study’s findings highlight the need for the U.S. Army to re-examine its online security measures to prevent the exposure of sensitive information.
Leave a Reply