Iran used social media, fitness apps and satellites to target U.S. bases

When Iran’s military planners prepared to hit American bases in the Middle East, they relied on intelligence from an unlikely source: U.S. service members themselves. According to security experts and even the U.S. military, Iran harvested data from social media accounts, fitness apps and even ads to establish patterns of life in U.S. bases across the region. Paired with imagery reportedly provided by Russian satellites, the Iranians selecting the targets constructed a surprisingly accurate picture of where U.S. troops assembled and where to strike.

The result, seen in fusillades of drones and missiles that — despite many interceptions — found their mark, leaving more than a dozen service members dead and hundreds of others wounded and causing billions in damage to facilities and equipment. The full scope of the carnage, and what it means for the viability of the United States' long-term presence in the Middle East, is still being assessed. As President Trump considers a new offensive and the specter of a widened Iranian retaliation looms over the region, the U.S. military is scrambling to move or hide assets while service members struggle to counter what experts call an era of ubiquitous technical surveillance (or UTS) and reduce digital footprints that have proved all too easy to track.

In recent months, congressional pressure on the military pushed several branches to disable mobile advertising IDs — the unique device identifiers used to track a person’s activity and location — on government-issued devices. The Navy also sent out a warning with “cyber threat hygiene recommendations,” advising that sailors limit social media activity and turn off location app access to phone cameras and location data on personal devices.

A later message from the acting secretary of the Navy called on personnel to “harden” their online profile and do the same for family members. Congressional scrutiny came when U.S. Central Command acknowledged to Congress in April the potential of "adversary exploitation of commercial location data to target or surveil U.S. personnel in theater.” At the time, Centcom also confirmed military personnel were allowed to use personal devices in active areas of operation.

Since then, some units in high-risk areas have instituted turn-in and lock-away procedures, and stationed personnel have been warned to expect device confiscations. Steps to limit information on government-issued devices are a good start, said Erik Wittreich, chief executive of Veilant, a secure-communications and private-network firm. But they are one part of what needs to become a “significant force protection mandate,” he said, rather than adjusting security after an attack.

“This has to be a part of mission planning, to be culturally adopted and shift the way we think about conducting operations in the future,” he said, noting that UTS involves “an assembly of sensors.” “It’s in our apps and our cellphones, but it’s not just our phone or our laptops," he said. "It’s the telematics in your vehicle, the smart thermostat in your condo, your house, your apartment. And those are just four of the millions of the sensors that are out there.”

It’s unclear how effective the messaging on security has been. In a September letter to the Pentagon, Sen. Ron Wyden (D-Ore.) and Rep. Pat Harrigan (R-N.C.) decried “the continued availability of commercial location data” from Pentagon facilities, citing the possibility that the information is coming from personal devices. Meanwhile, an August investigation by British broadcaster Sky News found more than 1,300 users of the fitness-tracking app Strava sharing routes and the timing of their workouts — more than seven years after the Pentagon flagged Strava as a potential security risk.

"You can’t get out of the UTS problem by telling thousands of military intelligence personnel or diplomats to never post that restaurant review or swipe on Tinder or call their family; it’s just not realistic," said Justin Sherman, an analyst with the Center for Strategic and International Studies. Experts say that data, much of which is sold by brokers online, can be used to reveal a military base’s rhythm, including shift rotations and meal times.

The Strava leaks could also be used to determine base layouts to a high degree of accuracy. “You no longer need to hack a system," Wittreich said. “You can go and buy the data. And that puts some of the responsibility back on us.” Part of the problem is that the U.S. military has operated some of its Middle Eastern bases for decades, confident that its adversaries were unable — or unwilling — to mount serious attacks. In Bahrain, for example, where the Navy has operated its main logistics hub since 1995, deployments for the some 9,000 people to what is known as Naval Support Activity (NSA) Bahrain have been uneventful.

“People didn’t think about being stationed in Bahrain any differently than how they would in Norfolk or San Diego, from a security standpoint,” said John Cordle, a retired Navy captain who spent time at NSA Bahrain during his naval career and later as a contractor. He added that personnel on two-year deployments often brought their families with them on the assumption it was safe. That attitude seems to be reflected in some of the information available online about NSA Bahrain.

On Google Maps, users can pinpoint the base’s bowling alley, basketball and racquetball courts, galley and pier-side gym. There are even reviews, with one user touting the gym's “tons of equipment for your workouts” and posting a picture of a poster with its operating hours; other reviewers commend the galley for its “salad and fruit bar and fresh OJ.” And it’s not NSA Bahrain alone. Similar posts can be found about other bases in the region, including Kuwait’s Camp Arifjan and Muwaffaq Al-Salti Air Base in Jordan.

It’s likely the information proved useful to Iran, which targeted 26 U.S. military sites during the first six months of the war, along with hotels where U.S. personnel had been evacuated. Satellite imagery of the bases shows no random craters, indicating precision in targeting, according to Mark Cancian, a security expert with the Center for Strategic and International Studies. Although the U.S. and its allies intercepted more than 90% of Iranian attacks, the barrages wreaked havoc on hundreds of structures, including runways, hangars, aircraft, advanced radar systems and living quarters.

Since the attacks, U.S. troops have become a more understated presence, while regional governments ramp up security around American facilities. In Manama, Americans who were once a regular sight in the Bahraini capital’s entertainment spots have become scarce. Those who do go out take steps to hide their comings and goings, getting dropped off by Ubers far from their destinations. Meanwhile, Bahrain authorities are cracking down on Shiite clerics they say are loyal to Iran and may have helped recruit agents to report on Americans’ movements.

On Friday, Iran said it had struck a radar system in Bahrain, but the U.S. denied the claim and said it had intercepted two Iranian drones. Repairing damage to regional bases, not including equipment and aircraft, would cost an estimated $9 billion. But given Iran's capabilities and inherent vulnerability of fixed infrastructure, questions are intensifying over whether U.S. bases should be built back at all. That’s especially true for facilities that are in closer proximity to Iran, like NSA Bahrain, and therefore with less time to detect and intercept projectiles.

The chief of naval operations, Adm. Daryl Caudle, said in August that because of extensive damage to NSA Bahrain, “we’re not getting back in there anytime soon. I just want to be completely honest with that." For now, the base appears all but abandoned, with no activity seen even in the guard towers ringing the site. Service members say only security personnel are allowed on the premises. Residents haven’t been allowed to return to base to collect personal items.

Cordle, the retired Navy captain, said losing NSA Bahrain and other regional bases would have a long-term effect. For now, ships are forced to resupply at the Indian Ocean atoll of Diego Garcia, more than 2,000 miles away, making the Navy’s already complicated logistics even more difficult and expensive. Still, any return to NSA Bahrain would have to take into account the new security environment, not to mention the pressure of living under constant threat.

“Certainly, the era of families going there is over,” Cordle said.