US personnel faced phone-tracking campaign during Iran war

US military personnel and contractors in the Middle East were targeted in a coordinated phone-tracking campaign before and during the Iran war, the Financial Times reported on Tuesday, citing telecom data, cybersecurity experts and officials familiar with the matter.

“Iran absolutely has capabilities to get real-time, immediate, and continuous location information,” Gary Miller, a senior research fellow at cybersecurity watchdog Citizen Lab, told the FT.

“It would surprise me very much if Iran were not using SS7, or mobile network access in the region, to track US users.”

Middle Eastern telecom networks, according to the report, blocked repeated requests known as SS7 pings, which can reveal the approximate location of phones roaming outside their home networks.

Two cybersecurity experts who reviewed the data told the FT the activity appeared to be part of a coordinated effort to locate specific devices.

The tracking attempts came in the build-up to the US-Israeli attack on Iran in late February and continued during the early days of the conflict, when Iran launched missile and drone attacks on US forces and military installations across the region.

A person familiar with the matter told the FT that Persian Gulf officials suspected Iran or allied groups had exploited roaming agreements with regional mobile operators to track US personnel.

Separately, a US official speaking anonymously said actors linked to Iran were also believed to have used commercial advertising databases to locate phones in Iraqi Kurdistan.

US Central Command told Congress in April that it had received multiple threat reports about adversaries exploiting commercial location data to monitor or target US personnel deployed in the region.

However, Centcom said it had taken force-protection measures to safeguard its forces, while a US official told the FT there was no evidence that data tracking had played a significant role in attacks.

At least some blocked tracking attempts could be linked to an Iranian mobile operator based on a shared technical fingerprint.

“This appears to be very specific user targeting,” Miller told the FT. “They are targeting specific devices.”

The Iranian embassy in London did not immediately respond to the newspaper's request for comment.

The report also said Iran was suspected of using commercially available advertising technology to identify hotels housing US government employees and contractors.

Advertising identifiers assigned to smartphones can enable devices to be tracked without directly compromising the phones themselves.

US lawmakers cited by the FT said the findings underscored longstanding concerns about the military's exposure through commercial location data.

Ron Wyden, a Democratic senator, said he had warned successive administrations for years about the national security risks, while Republican Representative Pat Harrigan said legislation was needed to prevent technology companies from selling location data linked to government employees.

We already got this about six weeks ago (from a slightly less prejudiced source):

Troops’ phones gave away location data to foreign adversaries
The Register (UK) ^ | 28 May 2026 | Brandon Vigliarolo

Posted on 5/31/2026, 1:47:24 PM by Salman

https://freerepublic.com/focus/f-news/4381727/posts

And before anybody goes there, the commercial cell phone system is built around being able to identify each individual device because that’s how your provider knows you’ve paid your bill.

If it’s switched on, it’s constantly ‘pinging’ to keep track of which tower is offering the best reception at that instant so you get the fastest possible connection each time you try to make or receive a call.

Your phone’s attempts to connect to WiFi hotspots and Bluetooth devices also can be used to determine your location, so the more secure variants of the Android OS (LineageOS, iodeOS, CalyxOS, et Al) make it easy to disable WiFi and Bluetooth but they also spoof the device’s MAC addresses. But your service provider recognizes your device by its IMEI, which means the IMEI/MEID can’t be spoofed else your provider won’t be able to recognize it. The people who make these privacy-oriented ROMs for your phone refer to this as the “geolocation problem.”

From the CalyxOS website:

“How do you deal with the issue of geolocation tracking?

This is one of the hardest issues to address because of the nature of the cellular phone network. It is an ongoing problem that we hope to have better solutions for in the future, however we partially address it in several ways....”

https://calyxos.org/docs/guide/faq/#how-do-you-deal-with-the-issue-of-geolocation-tracking

Bottom line, there’s no way at present to prevent being tracked and your phone still be of use. Even if you turn it off, remove the battery (not possible with most high-end phones), put it inside a Faraday bag, put that in a Pringles can inside of a steel vault, you’re still going to be “trackable” every time you use it to make a call. The only way you can be untrackable is to make the phone unusable.

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.