Pentagon and soldiers let too many secrets slip on socials

"Take naval maneuvers, for example. In one case, GAO auditors cited public social network support groups for families of deployed sailors, and private social media groups that discussed promotions, assignments, and squadron compositions. Such data could be used to link sailors to their immediate family members, locations, and behaviors, creating an avenue for blackmail or other coercive tactics to extract info from servicemembers."

"In another case, a press release identified - with photographs - a service member who completed urban sniper training. GAO investigators were able to buy information about the individual on the dark web, linking them to a particular unit, their rank, and other details. Additional research gave them info about the member's family, too, again opening up the possibility of blackmail."

"The Government Accountability Office (GAO) on Monday made public a report finding that the DoD hasn't been properly training its civilian staff or military members, nor issuing proper guidance, on how to keep secrets secret. The info leaks include social media posts by military members and their families, but press releases and other information the Pentagon publishes itself were as part of the equation, too."

GAO found that the Department of Defense has not properly trained civilian staff or military members nor issued adequate guidance to protect sensitive information. Auditors posing as threat actors discovered ways to exploit publicly available data from social media, family support groups, private online groups, and DoD press releases. Exposed details included unit assignments, promotions, ranks, training photos, and family links, enabling dark‑web aggregation, potential blackmail, coercion, and threats to deployed units during maneuvers. The digital activity of service members, contractors, and family members generates traceable data that threatens privacy, safety, and national security. The vulnerability extends beyond the U.S. military.

Read at Theregister