Senators question Pentagon over workforce's use of data

A bipartisan group of Senators have called on the Defense Department to answer for how a popular fitness app apparently used by some U.S. soldiers, intelligence analysts and Pentagon officials led to the disclosure of secret bases and facilities around the world.

A bipartisan group of senators wants the Defense Department to explain how a popular fitness app apparently used by some U.S. military personnel, intelligence analysts and Pentagon officials led to the disclosure of secret bases and facilities around the world.

Tom Cotton, R-Ark., and Richard Blumenthal, D-Conn., wrote a letter to Defense Secretary James Mattis, questioning the department’s policy for employees using wireless networks and devices on military sites after.

The app, Strava, inadvertently shared a heat map that recently detailed its users’ activities, prompting a DoD-wide review of personal electronics at its installations. The heat map revealed the locations of several secret U.S. military bases when the data was dumped in November. Patrick Shanahan, deputy secretary of Defense, was wearing a Fitbit watch up until last week, potentially exposing himself to this breach.

If Android users using the fitness app don’t enable the “nomap” feature — which disables a Wi-Fi network from being mapped — they risk sharing personal information and location.

Cotton and Blumenthal want to know if the Pentagon regularly uses “nomap” for its Wi-Fi networks so that Google cannot use them in location tracking and if the tech giant has ever advised the department to enable the feature.

“In an era of increasingly contested cyber domains, we could be unknowingly allowing our adversaries to map DoD networks for cyber intelligence, surveillance, and reconnaissance and operational preparation of the environment,” the pair wrote in the letter.

In November, Quartz revealed that Google collects Android users’ locations even if the user has their location setting disabled. Google could be tracking your every move through its product called Location History, commonly used to predict traffic and restaurant recommendations.

Strava is commonly used on smartphones and Fitbit watches to track how far a person has ran, bicycled or swam.  The aforementioned heat map was released in November to show where people were running but globally, people discovered a different use for it.

Government

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure