🎯 Pentagon Killed Mobile Ad IDs. Data Brokers Sold Troop Locations Anyway.

Pentagon disabled MAIDs on 90% of devices. Resellers still sold location pings for $0.0006 each. Iran used that data + SS7 exploits to strike 12 bases. 🎯 $47M in mitigation vs $300/month for a Cyprus broker. The placebo worked great. You still bringing your phone on base?

Remember when the Department of Defense said they were totally locking down those ad-tracking IDs on troops' phones? Cute. Somewhere between the directive and the data broker's backend, the message got lost in transit — and while Uncle Sam was patting himself on the back, Iran was already reading the coordinates.

Let's start with what actually happened. The Pentagon ordered Mobile Advertising IDs (MAIDs) disabled on devices in sensitive regions. An internal sweep in 2025 claimed a ~90% reduction in exposed MAIDs. Good job, team. Here's your sticker.

The part they didn't check

Mobile ad IDs are a persistent, device-level tracker attached to every iOS and Android device. They tell brokers exactly where a phone is, down to the meter. But here's the punchline: location-data resellers aggregate pings from thousands of apps — weather apps, flashlight apps, games, anything. Even with the MAID disabled on the phone itself, third-party SDKs and alternative identifiers (IDFV, IP + battery level matching) still generate salable location streams.

Ground truth, as it turns out, still leaks like a sieve. By March 2024, Iranian intelligence was already harvesting Strava fitness-tracking data near U.S. military sites in Jordan — 76% of unit runs converged on a single endpoint, making it trivial to map base infrastructure. On March 1, 2024, an Iranian strike destroyed the Crowne Plaza hotel housing a tracked runner, injuring two Pentagon employees. Six weeks prior, similar pattern-based targeting hit Moroccan barracks, killing three U.S. soldiers. So much for operational security.

The SS7 problem made it worse

On July 14, 2026, Iran's government employed an SS7 vulnerability to pinpoint U.S. military positions in Iraq and Bahrain ahead of hostilities. The method leveraged known telecom weaknesses to direct drone strikes resulting in multiple troop casualties. This wasn't a novel hack — SS7 has been a known clusterfuck for over a decade. But combined with commercial location-data feeds, Iran cross-referenced ping data from reseller bundles with SS7-derived position fixes to model troop-movement patterns across at least 12 bases, according to intelligence assessments.

What that actually means on the ground

• Force exposure: A single unsecured app instance on a trickle-charging phone at a forward operating location can produce enough pings to triangulate patrol routes. Iranian cyber units reportedly harvested enough location data to model movement patterns across a dozen bases — exactly the same technique demonstrated with Strava data in Jordan.
• Data cascade: One reseller's stream feeds into a dozen others. Even if Apple's native MAID is dead, the derivative data — "probabilistic profiles" with lat/long coordinates — remains on sale for pennies per device. A July 2026 intelligence report confirms the Pentagon's own internal memo admits "current mitigations do not fully prevent location data exfiltration via commercial data streams."
• Operational cost: Mitigation requires app-level whitelisting, device profiles that block telemetry at the OS level, and continuous audit of data-broker contracts. The Pentagon's current budget allocation for this: roughly $47 million across FY2025–2027, a rounding error next to the JEDI cloud debacle.

Who's selling what

The data-broker ecosystem operates via a chain of reselling, enriching, and repackaging. Removing the MAID from the phone is like locking your front door while leaving every window open.

Timeline twist

• Feb–Mar 2024: Iranian surveillance harvests Strava fitness data near U.S. military sites in Jordan. Strike on Crowne Plaza hotel injures two Pentagon employees; subsequent barracks bombing kills three soldiers.
• 2024: Pentagon announces aggressive MAID-disabling policy. Analysts estimate ~75% compliance within six months.
• Mid-2025: Commercial data-reseller X-Mobile quietly begins offering "Military Zone Location Bundles" targeting Iraq, Syria, and Eastern Europe. Price: $0.0006 per ping.
• July 8, 2026: U.S. announces strikes against 80+ Iranian targets after Iranian drones down three commercial vessels near the Strait of Hormuz. Iran retaliates against U.S. bases in Kuwait and Bahrain.
• July 14, 2026: Iranian government exploits SS7 vulnerability to strike U.S. positions in Iraq and Bahrain, injuring multiple troops. Combined with commercial location data, IRGC-CEC affiliates model troop movement across 12 bases.
• August 2026: FBI investigates suspected Iranian cyber activity disrupting water systems across seven Midwestern states. Same playbook: exploit unsecured legacy protocols, use data feeds to identify vulnerable targets.
• Q3 2026: Internal Pentagon memo leaks admitting that "current mitigations do not fully prevent location data exfiltration via commercial data streams."

The real joke

The Pentagon is paying Apple millions for enterprise device management licenses that, theoretically, let them disable ad tracking. Meanwhile, a $300-a-month subscription to a data broker in Cyprus buys the same location data on the open market. The disconnect isn't a gap — it's a goddamn canyon. You shut off the tap at the phone, but the data is already in the pipes, sloshing through a dozen reseller databases with no expiration date. The only winning move? Don't let the phone on base at all. But that'd inconvenience the generals. So here we are.

Meanwhile, the State Department posted a $10M reward for IRGC-CEC official Amir Yariab. Good luck finding him while commercial data brokers sell the coordinates for pocket change. And in a fitting coda, a July 2026 assurance industry breach exposed 6.99 million driver identification records — same data type brokers use to enrich location profiles — because an employee reused a compromised credential. The pattern writes itself.

Bottom line: If your threat model includes state actors with location-intel budgets, disabling the MAID was never the solution. It was the placebo. 🎯