Pentagon Audit Finds Security Oversight Gaps Across 568,000 Military Phone Lines

More than 568,000 military wireless lines were covered by a $2.67 billion contracting program whose security protections were not adequately verified, according to an October inspector general audit. The Pentagon also extended contracts without a sufficient process for reviewing carrier security assessments. Investigators found no evidence that foreign intelligence services had compromised the accounts.

The scale makes this more than an administrative shortcoming. The Spiral 4 program supplies commercial wireless service to Defense Department organizations and service members. Information associated with those phones could reveal users’ locations and communication relationships, allowing an adversary to identify networks of people or sensitive sites even without reading the underlying content.

Independent testing did not complete the assurance chain

The Pentagon revised its contracts in May to require independent security testing of the carriers. That was a concrete control, but the audit found that officials still lacked an adequate process for evaluating the results before extending the agreements.

This exposes a basic systems-integration problem: commissioning a test is not the same as making a security decision. An effective assurance process must define who receives the findings, what standards are used to judge them, which deficiencies prevent an extension and who verifies corrective action. Without that review structure, testing can generate reports without providing the government a dependable acceptance gate.

The distinction is especially important in a commercial-service contract. The carriers operate the underlying networks, while the Pentagon remains responsible for deciding whether their protections satisfy military requirements. Independent assessors can supply technical findings, but they cannot substitute for an accountable government authority that interprets those findings and decides whether residual risk is acceptable.

The department’s written response proposed that the under secretary for intelligence and security oversee evaluations of military phone-data protections. Central oversight could reduce ambiguity over ownership, but its effectiveness would depend on a repeatable review process connected to contract decisions. All three recommendations from the audit remained unresolved because officials either disputed responsibility or did not adequately explain how they would address the findings.

Unclassified phones still carry sensitive patterns

The audit concerned unclassified wireless communications, but that label does not make every associated data point harmless. Location history and communication metadata can become sensitive when aggregated across a workforce. The risk arises from patterns: where devices appear, which users communicate and how those relationships change over time.

Investigators warned that exploitation could expose military communication networks, sensitive locations and operational vulnerabilities. The audit also found that officials knew established weaknesses could be used to intercept SMS messages, yet the department had not issued a policy for protecting texts sent to and from military phones.

That policy gap illustrates why mobile security cannot be treated solely as a carrier-performance issue. Enterprise protection also depends on how an organization configures devices, manages their life cycle and governs the services employees are permitted to use. The National Institute of Standards and Technology’s mobile-device guidance similarly treats security as a combination of device management, endpoint protection and operating policy rather than one isolated technical safeguard.

Scale raises the cost of an unclear acceptance process

For service members and Defense Department organizations, stronger review can impose tradeoffs. More rigorous acceptance criteria may require remediation, delay an extension or narrow available services. Those costs are real, but they are also the mechanism by which independent test findings gain practical force. Extending service without resolving who evaluates the results transfers uncertainty from the contracting process to the users and missions relying on the phones.

The public-cost issue is therefore not limited to whether $2.67 billion purchased wireless access. It is whether the contracting system also produced documented assurance that carrier protections met the government’s requirements. At this scale, inconsistent review can affect hundreds of thousands of lines at once rather than one office or device fleet.

The audit followed broader warnings about telecommunications security after Chinese state-linked hackers associated with Salt Typhoon infiltrated major U.S. phone networks. That context explains the urgency of carrier scrutiny, but the Pentagon audit reached a narrower finding: it identified inadequate verification and review, not a confirmed compromise of military accounts.

The next measure of progress will be whether the Pentagon assigns clear review authority and connects security-assessment results to contract-extension decisions. Until the three recommendations are resolved, independent testing remains an input to the system rather than a completed security control.

By Thomas Caldwell — AMI’s senior editor for mechanical and mobility engineering, covering vehicle electronics, systems integration, electrification, chassis systems, propulsion, and safety policy.