GAO: DoD fails to stop sensitive info leaks online

A new report from the Government Accountability Office has revealed significant vulnerabilities in the U.S. Department of Defense's ability to protect sensitive information from being exposed online, The Register reports.

The audit found that the DoD has failed to provide adequate training and consistent guidance to its military members and civilian staff on managing their digital footprints and safeguarding operational details. GAO investigators demonstrated the severity of the issue by posing as threat actors; they were able to use publicly available information from sources like family support groups on social media and official press releases to identify service members, link them to specific units, and even gather details about their families, creating potential blackmail risks.

The report criticized ten DoD components for having inconsistent training materials and for failing to conduct comprehensive threat assessments. In response to the findings, the GAO issued twelve recommendations, which the DoD largely agreed to implement. However, the Pentagon only partially concurred with a key suggestion to assess security policies department-wide, arguing its authority is limited over the personal activities of personnel and their families.