Washington, October 16 — A watchdog report released this week has exposed critical security gaps in the Pentagon’s $2.67 billion Spiral 4 wireless contract, revealing that more than 568,000 military wireless lines remain vulnerable to foreign surveillance despite known risks and prior warnings. The investigation, prompted by a December 2024 letter from Senators Ron Wyden and Eric Schmitt following the Salt Typhoon cyber intrusion, found that Defence Department officials failed to verify whether telecommunications providers were adequately safeguarding sensitive data that could expose troop locations, movements, and communications.
The report details how investigators discovered that Pentagon officials did not properly scrutinise the security assessments of phone companies before renewing contract options, even after the Salt Typhoon operation — in which Chinese state-linked hackers infiltrated AT&T, Verizon, and T-Mobile systems to access Americans’ call records and private conversations — was made public. Although the Pentagon updated its contracts in May to require independent security checks of vendors’ systems, including tests for exploitable weaknesses, the watchdog found no reliable process for reviewing those results before exercising contractual extensions.
As a result, all three core recommendations from the audit remain unaddressed: ensuring telecom providers protect troops from location tracking or communication interception, implementing stricter security evaluations prior to contract renewals, and establishing a clear, enforceable procedure for assessing and acting on third-party security findings. Pentagon officials either disputed responsibility for these shortcomings or offered no coherent plan to resolve them, according to the report. Senator Wyden, who co-signed the original 2024 letter demanding action, said he remains “deeply concerned” about the security of service members’ communications.
While he welcomed the Pentagon’s post-Salt Typhoon contract updates and the push for third-party assessments, he stressed that “more work is needed” to close the lingering gaps. Notably, the audit did not find evidence that foreign intelligence services had successfully compromised any military accounts covered by the Spiral 4 contract — but it warned that the existing vulnerabilities could allow attackers to map entire Defence Department networks, identify sensitive locations like safe houses or command posts, and intercept SMS messages to and from military devices.
The technical reality, as ever, lies in the detail that matters: without a mechanism to validate and act on security test outcomes, contractual requirements become box-ticking exercises. Under the hood, the Spiral 4 arrangement — designed to provide secure, scalable connectivity for troops — now stands as a cautionary example of how procurement rigor can erode even after a high-profile cyber intrusion exposes the stakes. For now, the lines remain live, the risks unmitigated, and the next step unclear.
Watch for whether the incoming administration directs the Defence Department to close these loops before further contract options are exercised.
