Death by a Thousand Cuts: Commercial Data Risks to the Army

Abstract

This report outlines the force protection challenges related to publicly available information (PAI), and specifically highlights commercial data exposed through data brokers. The rapid, widespread, and low-cost availability of data about personnel poses significant operations security (OPSEC) and force protection vulnerabilities for the Army. The recommendations for action included in this report emphasize organizational mitigation actions, as opposed to individual training or national-level policy changes. These are actions that the Army can implement with existing authorities – in absence of federal data privacy legislation or DoD directive – to protect the force while preserving the civil liberties and privacy of its members. While many of the analytic technologies outlined in this report are touted as the Industry standard for marketing, they are widely viewed as invasive by privacy and civil liberties experts – while granting users little transparency or control over what data is collected about them.