US Military Smartphones Targeted via Roaming and Ad Tech

Citizen Lab documents SS7 roaming exploitation and ad tech surveillance against US military personnel. Here's what the attack surface actually demands from security teams.

US Military Smartphones Targeted via Roaming and Ad Tech

Citizen Lab’s Gary Miller told the Financial Times that US military personnel are being tracked through two parallel attack surfaces: mobile roaming infrastructure and the commercial advertising ecosystem. The full report is at citizenlab.ca. What makes this worth examining beyond the headline is the deliberate pairing of those two vectors—and what that pairing demands from anyone doing offensive or defensive security work against high-value targets.

This isn’t a summary of what Citizen Lab published. It’s an analysis of what the campaign’s architecture reveals, and what you should actually do about it.

What the Attack Surface Actually Tells Us

SS7 and ad tech are not an accidental combination. They create redundant tracking pipelines: block or detect one, and the other keeps running.

Mobile roaming relies on SS7 and its successor Diameter—protocols built when trust between telecom operators was assumed, not verified. When a device roams, it transmits location and identity signals that any operator with interconnect access can intercept or redirect. US military personnel are globally deployed. Their devices roam constantly. This is the baseline operational reality, not an edge case.

Ad tech adds a civilian-grade surveillance layer that requires no malware and no exploit. Mobile advertising identifiers—Apple’s IDFA, Google’s GAID, and the probabilistic fingerprint ecosystem built around them—were designed for conversion tracking. But bid-stream data from real-time ad auctions allows passive geolocation at meaningful precision without touching the device. Research out of Trinity College Dublin documented the volume of behavioral data iOS and Android transmit to Apple and Google under normal operation. Nation-state actors with budget and a relationship with a data broker or demand-side platform can skip the exploit entirely and buy the tracking data the phone is already broadcasting.

SS7 attacks require telecom-level access and generate some forensic trail. Ad tech surveillance requires money. That asymmetry is the point.

Implications for Offensive Security Researchers

If you work in red teaming or adversarial research, three things about this campaign should change how you model advanced threats.

The physical-digital boundary is more porous than most engagements model. A realistic APT simulation against a military or government target now has to account for passive location harvesting through ad tech before any active exploitation begins. Bid-stream reconnaissance leaves no logs on the target’s infrastructure. It is pre-access intelligence gathering that the blue team cannot see, because it happens entirely outside their visibility perimeter.

The mobile device is not an endpoint—it is a sensor array. Standard engagements focus on network penetration, phishing, and endpoint compromise. But a device radiating IMSI, advertising ID, and behavioral telemetry to commercial third parties while sitting in someone’s pocket is an ongoing exfiltration channel that no EDR will flag. Before designing an active attack chain, model what the target device is already transmitting.

Roaming is a trust-boundary vulnerability, not a configuration error. The SS7/Diameter attack surface exists because the global telecom system requires operators to extend trust to each other. Adversaries with access to a compliant or compromised operator—state-owned telcos are the obvious vehicle—can exploit that trust relationship against any roaming device without touching the target organization’s infrastructure at all. The GSMA FS.11 documentation on SS7 and SIGTRAN network security provides a usable taxonomy for these attack classes if you’re building them into threat libraries.

Implications for Defensive Practitioners

The Citizen Lab report makes one thing hard to defer: you cannot defend a perimeter that the mobile device never respects.

Enterprise MDM and MTD tooling has gotten reasonably good at on-device threats—malicious apps, jailbreaks, network anomalies. What it cannot do is prevent a roaming device from exposing its IMSI to a hostile network, or stop the advertising ecosystem from monetizing telemetry that the operating system is permitted to share.

For teams protecting high-risk personnel—executives, government contractors, military-adjacent organizations—the mobile security posture needs to map to three concentric threat rings:

1. On-device threats (malware, spyware, misconfiguration) — addressable with current MTD tooling
2. Network-layer threats (SS7/Diameter exploitation, IMSI catchers, rogue base stations) — addressable through carrier-level controls, private network deployments, and policies restricting international roaming on unclassified devices
3. Ecosystem-layer threats (ad tech surveillance, data broker aggregation, bid-stream tracking) — addressable only through advertising identifier reset policies, OS privacy controls, and organizational bans on certain app categories on sensitive devices

Most enterprise programs have mature responses to ring one. Very few have operationalized anything for rings two and three.

What to Actually Do

For Individual Security Professionals

• Treat your device as a sensor under surveillance. Reset your advertising identifier regularly. On iOS, use the current App Tracking Transparency controls. On Android, opt out of ads personalization. These raise the cost of persistent correlation; they don’t eliminate it.
• Audit your apps against their data-sharing disclosures. Many legitimate apps transmit location to ad networks as a commercial arrangement. Exodus Privacy analyzes Android APKs for embedded tracking SDKs and is worth running against anything you use regularly.
• Apply skepticism to roaming in high-risk travel contexts. Security conferences, government meetings, and countries with state-owned telcos are all environments where your device’s roaming activity may be observable to hostile infrastructure.

For Security Teams

• Deploy advertising identifier management policies in your MDM. Most platforms support it. Few organizations have done it systematically. It’s a low-friction control with meaningful impact on passive correlation attacks.
• Formalize international roaming policy for sensitive personnel. The policy doesn’t need to prohibit travel. It needs to establish which devices roam, on which networks, and what compensating controls apply—VPN enforcement, roaming data restrictions, dedicated travel devices.
• Add SS7/Diameter threat modeling to your TI program. You probably can’t directly monitor for SS7 attacks, but your carrier relationships and MTD vendor may have some telemetry. Ask explicitly whether your MTD solution has visibility into network-layer signaling anomalies. Most haven’t been asked.
• Commission mobile-specific red team exercises that model passive surveillance through ad tech and network-layer reconnaissance, not just phishing and endpoint exploitation. If your red team has never attempted to geolocate a target device through open ad ecosystem sources, you don’t have a full picture of your exposure.

For OSINT Practitioners

The same ad tech infrastructure documented here is also a legitimate OSINT source for investigators working within legal and ethical boundaries. Bid-stream data, mobile location data, and advertising telemetry are commercially available and have been used by journalists and researchers to document the physical movements of persons of interest. Understanding how mobile advertising identifiers are assigned, how they persist across app sessions, and what data brokers aggregate around them is no longer esoteric—it’s a core competency for anyone doing mobile surveillance work, whether offensively or advising clients on their own exposure.

The Structural Problem

SS7 was not designed for the adversarial environment it now operates in. The commercial advertising ecosystem was not designed as a surveillance tool, but functions as one at scale. Neither problem is fixable by a patch or a policy document at the organizational level. Both require industry coordination: accelerated SS7 deprecation, meaningful enforcement of mobile privacy regulations, carrier-level controls on signaling abuse. The GSMA has published guidance. Regulators have acknowledged the problem. Progress has been slow relative to the exploitation tempo.

In the interim, security teams do what they always do: reduce attack surface, raise attacker cost, build detection where possible, and make the internal and external argument for structural changes that actually matter.

The Citizen Lab report is a concrete artifact for that argument. Use it.

Primary source: Gary Miller / Citizen Lab, “US Military Smartphones Targeted Through Roaming and Ad Tech”, Citizen Lab, University of Toronto.

Additional sources: GSMA FS.11, “SS7 and SIGTRAN Network Security”; Doug Leith, “Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google,” Trinity College Dublin, 2021.