The Department of War failed to fully secure unclassified wireless communications, leaving sensitive information vulnerable to exposure, according to findings from the Pentagon’s watchdog. The exposed metadata could reveal the locations of troops, command facilities and other sensitive sites.

A new report from the Department of War Office of Inspector General found that officials had taken some steps to protect communications covered by a major wireless telecommunications contract. However, the department did not properly evaluate the security measures used by wireless carriers.

That failure left metadata intact, including information showing when messages were transmitted and where they originated. Investigators warned that such information could allow malicious actors to identify sensitive locations and map communication activity.

The Office of Inspector General opened its investigation after a late 2024 letter from Sens. Ron Wyden and Eric Schmitt. The lawmakers warned that vulnerabilities affecting Department of War devices created risks involving foreign espionage groups.

Investigators sought to determine whether the War Department “had capabilities to secure its unclassified wireless communications” purchased through the Wireless Mobility Services contract, also known as Spiral 4. The review focused on how the department protected communications and evaluated carrier security.

Spiral 4 is a massive Pentagon telecommunications contract that had more than 568,000 service lines as of January 2026, according to the inspector general. Those lines supported phones, tablets and other devices used across the military.

The military established security measures for voice and email communications but did not provide the same protections for text messages using short message service, commonly known as SMS messaging. Those messages could therefore remain unencrypted.

The department’s chief information officer “accepted the operational risks from mobile device users sending unencrypted text messages using SMS messaging to meet mission needs by exception.” Those exceptions included communications with potential recruits and journalists outside the department.

Government findings had already shown that malicious actors were using tools to hijack devices, breach communication lines and read unencrypted SMS messages. The chief information officer’s office acknowledged awareness that known vulnerabilities could be exploited to intercept messages sent to and from department devices.

Despite that awareness, the report found that the office had not issued a policy specifically protecting text messages. Investigators also found that officials had not examined what mobile carriers were doing to secure military data and communications.

The department also failed to determine whether additional carrier security measures were necessary. According to the report, those gaps meant “malicious actors could map entire communication networks within the DoW, pinpoint sensitive locations like safe houses or command posts, and expose operational vulnerabilities, significantly compromising national security.”

The findings followed several military security restrictions imposed after metadata and location tracking technologies were exposed or found to be easily accessible. This summer, Wyden and Rep. Pat Harrigan shared confirmation from military branches that advertising tracking tools had been disabled on government devices and phones.

That action followed reports showing Iran and other groups using commercially available location information to track and even target American personnel at bases in the Middle East. Some tracking tools were only disabled after the war had started, according to the source material cited in the report.

An investigation this summer also found that data from applications such as Strava exposed the locations of service members and contractors in the region. Some of those exposed locations were later attacked.

The inspector general said its recommendations remain unresolved. The Office of Inspector General called for the chief information officer to assess security measures needed to protect military metadata and review third party security assessments connected to Spiral 4 contracts.

In a statement to Task & Purpose, Wyden said he was “glad that the Inspector General spurred the DoW to change its contracts with the wireless carriers and receive third-party security assessments.”

Wyden also made clear that the watchdog’s findings had not erased his concerns about military communications. “I remain concerned that our service members remain at risk from the military’s insecure communications and look forward to seeing what else the Inspector General finds,” he added.