'Digital exhaust': How smartphone data allegedly helped Iran track US troops during the conflict

Moving beyond conventional forms of cyberattacks, a covert surveillance campaign linked to Iran reportedly tracked US troops and contractors through Middle Eastern mobile networks and smartphone data, according to a report by the Financial Times, which cited telecommunications data. The surveillance campaign unfolded in the weeks leading up to the US-Israeli military operation against Iran in late February and continued after Tehran launched a barrage of drones and missiles targeting American military bases.

US lawmakers have repeatedly warned that vulnerabilities in global mobile phone networks and commercial location-tracking systems may have exposed American troops to surveillance during an active conflict.

SS7 pings and cyber campaign targeting US personnel

Telecommunications data from the Mobile Surveillance Monitor research project showed a sharp rise in suspicious SS7 pings. SS7 (Signalling System No. 7) is an ageing telecommunications protocol that allows mobile phones to remain connected while roaming outside their home networks. If exploited, the protocol can reveal the approximate location of a phone without the user's knowledge.

More from Tech

According to cybersecurity experts who reviewed the data, the requests were not random. The volume and pattern of the SS7 pings pointed to a coordinated campaign aimed at identifying specific devices. Gulf nations suspect that groups aligned with Tehran exploited roaming agreements with regional telecom providers to locate US military personnel.

Iran-linked actors are also suspected of abusing commercially available smartphone advertising databases to pinpoint the locations of devices in Iraq's semi-autonomous Kurdistan region. The fact that several of the attacks targeted areas in Gulf countries where US military personnel were stationed has further strengthened those suspicions.

Although investigators have not established a direct link between the digital surveillance campaign and any individual drone or missile strike, the timing and scope of the activity have raised significant security concerns.

CENTCOM warns of location data exploitation

The US Central Command (CENTCOM) has acknowledged the threat and said it is treating the issue seriously. In testimony before the US Congress in April, CENTCOM said it had "received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil US personnel in theatre."

The command added that it "took unprecedented force-protection measures that we are unable to discuss in order to ensure that our forces remain safe."

The Financial Times report noted that concerns surrounding digital surveillance are not new. A 2024 review by the US Department of Defense's Office of the Inspector General found that security vulnerabilities affecting smartphones issued to service members had yet to be fully addressed.

Former CIA official Michael Stokes said the issue has troubled the US intelligence community for more than a decade.

He explained that modern smartphones continuously generate what he described as a "digital exhaust"—a stream of data that includes location information, contacts, movement patterns, and other sensitive details.

According to Stokes, even if a smartphone itself is never hacked, the data it produces can still reveal valuable information about its owner.