A Pentagon inspector general report finds major security holes in $2.67 billion worth of cell phone contracts that could reveal where U.S. troops are and who they contact, and Democrats are already aiming the blame at Defense Secretary Pete Hegseth.
The Defense Department’s Office of Inspector General warned that weak controls on unclassified wireless services left sensitive communications and location data exposed to serious risk. The findings describe a contracting and policy failure inside the building, not a completed foreign breach. Still, the political reaction was immediate.
Critical coverage framed the audit as a problem for Hegseth, even as the reported findings center on long-running gaps in how the Pentagon buys phone service, checks vendors, and protects basic message traffic.
Servicemembers are the ones who live with the consequences. Taxpayers are the ones paying for the contracts. The report says the department has not cleaned up the holes and has spent time arguing over who owns the fix.
Billions in phone contracts, thin security checks
The inspector general’s review hit the Pentagon’s cell phone contracts hard. The deals are valued at $2.67 billion. The audit found major security weaknesses across that portfolio.
Investigators concluded the department failed to protect sensitive communications and location information tied to those services. In plain terms, the government did not adequately verify that phone companies were guarding data that could show where soldiers are and whom they are calling or texting.
Officials also did not review the companies’ security checks before renewing the contracts. That is basic vendor oversight. It did not happen as it should have, the report found.
The inspector general laid out what a capable adversary could do with that kind of exposure. Hackers could “map entire communication networks within the [Department of Defense], pinpoint sensitive locations like safe houses or command posts, and expose operational vulnerabilities, significantly compromising national security.”
"map entire communication networks within the [Department of Defense], pinpoint sensitive locations like safe houses or command posts, and expose operational vulnerabilities, significantly compromising national security."
That language is about risk and capability. The package does not describe a confirmed foreign intercept or a finished mapping operation. It describes a security posture weak enough to make those outcomes possible.
Text messages sat in a policy blind spot
The audit also found that Defense officials already knew text messages on military phones could be intercepted. They understood the vulnerability. They still had not closed it.
The department “had not issued policy for protecting text messages.” No rule. No clear standard. Awareness without action.
At the time the findings became public, the department still had not addressed the security vulnerabilities. Internal debate continued over whose responsibility the problem was. Explanations about concrete fixes were lacking, the reporting states.
That is the opposite of how a warfighting bureaucracy should treat operational security. Troops do not get to pause a deployment while offices argue over a wiring diagram for phone policy.
Force protection is not a branding exercise. It is whether a safe house stays hard to find and whether a command post remains more than a pin on someone else’s map. Readers following Hegseth’s wider push to modernize how the force fights, including efforts such as an Army autonomous systems command after his directive, will recognize the gap: new concepts mean little if basic communications hygiene lags behind.
Wyden and Democrats move in on the politics
Democrats in Congress raised concerns about the Pentagon’s cell phone security problems after the report landed. Sen. Ron Wyden put his own marker down in comments to The Daily Beast.
Wyden said he remains worried about the risk to people in uniform and wants further inspector general work.
"I remain concerned that our servicemembers remain at risk from the military’s insecure communications and look forward to seeing what else the Inspector General finds,"
He also pledged continued pressure on follow-through.
"I’ll continue to watchdog DOD to make sure they follow through on the Inspector General’s findings and finally secure their communications."
Watchdogging insecure phones is fair game. Turning an institutional contracting failure into a personal indictment of the secretary is a different move. The reported audit describes department processes, renewals, vendor checks, and a missing text-message policy. It is not presented here as a finding that Hegseth personally designed the weak contracts or ordered officials not to review security.
That distinction matters. Conservative readers have watched this pattern before: a real bureaucracy problem appears, and the partisan machine reaches for the nearest Trump-aligned cabinet name.
Hegseth’s job is to run the building and fix what is broken. That includes vendor security, message policy, and clear ownership so the next audit does not read like a repeat. It also includes keeping the department focused on lethality and readiness, the same lane as recent moves to demand battlefield-style tests before officers pin on general stars.
Responsibility fights are not a security plan
The most damning operational detail in the package is not a dramatic courtroom scene. It is duller and worse. Officials knew texts could be grabbed. No protection policy went out. Contracts worth billions moved ahead without the security reviews the inspector general expected. Then the department argued with itself about who owns the remedy.
Adversaries do not wait for a memo chain to finish. Location data and call graphs are valuable whether the phone is “unclassified” or not. Unclassified does not mean harmless. It means the traffic still has to be guarded like it belongs to a military that has enemies.
Phone companies on the other end of those contracts are not named in the material. The failure mode is described on the government side: weak verification of data protections and weak review of company security checks at renewal.
That is solvable. It takes standards, enforcement, and a secretary who refuses the infinite internal stall. Hegseth has already shown a willingness to rebuild advisory and homeland-defense structures, including plans to chair a new Homeland Defense Board after purging a prior setup. Secure communications for troops belong in the same accountability bucket.
Foreign intelligence risk is the point of the warning
The inspector general’s warning was not written for a press shop. It describes how weak wireless security could help hostile actors chart Defense networks and locate sensitive sites. Safe houses and command posts are named as examples of what could be pinpointed.
If that risk is real, and the oversight agency says it is, then the remedy is not a cable-news blame cycle. The remedy is locking down contracts, forcing vendors to prove data protection, issuing the missing text policy, and ending the ownership dispute with a name on the line and a deadline on the wall.
Democrats will keep the heat on Hegseth because that is the politics of the moment. The secretary’s proper answer is performance: secure the phones, protect location and contact data, and make the next inspector general review boring.
The same standard applies across other personnel and standards fights inside the department, from screening policy whiplash to training expectations. When the Pentagon reversed course on a testosterone screening policy after internal confusion, the lesson was the same one this audit teaches. Confusion and delay are not neutral. People in uniform pay for them.
None of the material here documents a finished foreign intelligence coup against U.S. formations off these cell contracts. It documents something more familiar and still serious: a wealthy department that bought phone service at enormous scale, under-checked the security that matters, left text traffic under-protected, and then argued about the broom instead of sweeping.
Hegseth did not invent Pentagon process rot. He does own whether it continues. Troops should be able to use issued communications without handing a map to the other side. Lawmakers who claim to care about servicemembers can help by funding and overseeing fixes, not by treating every inspector general audit as a campaign flyer.
Secure the contracts, issue the policy, name the owner, and spare the force another year of avoidable exposure. That is the job. The rest is noise.
