Hegseth leaves troops exposed to spies as Pentagon ignores phone security warnings: report

Defense Secretary Pete Hegseth’s Pentagon has left American troops vulnerable to foreign surveillance by failing to fix security gaps in its $2.67 billion cellphone contracts, according to a new inspector general audit.

The watchdog found the department never verified whether wireless carriers were adequately safeguarding sensitive data that could reveal where service members are and who they’re talking to, and officials also renewed contracts without properly reviewing the carriers’ security assessments, according to The Daily Beast's PunchUp.

The military had more than 568,000 wireless lines as of January under its sprawling Spiral 4 contract.

Investigators warned that hackers exploiting the weaknesses could “map entire communication networks within the DoW (Department of Defense), pinpoint sensitive locations like safe houses or command posts, and expose operational vulnerabilities, significantly compromising national security.”

Pentagon officials “were aware that malicious actors could exploit known vulnerabilities to intercept and read SMS messages” sent to and from military phones. Even so, the department “had not issued policy for protecting text messages,” the audit found.

The warnings are not new. In December 2024, Sens. Ron Wyden (D-OR) and Eric Schmitt (R-MO) demanded action after Chinese state-linked hackers in the Salt Typhoon operation infiltrated major U.S. phone networks, gaining access to Americans’ call records and private conversations.

The Pentagon revised its contracts last May to require independent security testing of the carriers, but the inspector general found officials still had no real process for reviewing those results before extending the deals.

None of the watchdog’s three recommendations has been resolved. Pentagon officials either squabbled over whose job it was or failed to explain how they would fix the problems.

“I remain concerned that our servicemembers remain at risk from the military’s insecure communications and look forward to seeing what else the Inspector General finds,” Wyden told PunchUp.

The audit did not find evidence that foreign intelligence services had compromised the military accounts.

Hegseth has famously had his own brush with phone insecurity. In the Signalgate scandal, he shared details of imminent U.S. airstrikes in Yemen in a Signal group chat that accidentally included the editor of The Atlantic. A separate inspector general review concluded in December that he broke department rules by sending operational information from his personal phone, creating risks for American pilots. Hegseth hailed that report as a “total exoneration.”

A Pentagon spokesperson pointed PunchUp to the department’s written response, which said the under secretary for intelligence and security should take charge of checking how well troops’ phone data is protected. An official said the military was “committed to the safety and security of our service members.”