# DoD OIG Finds Spiral 4 Security Gaps

A Department of Defense Office of Inspector General review found that the Pentagon’s Spiral 4 Wireless Mobility Services contract did not adequately address carrier security practices or protect SMS metadata, potentially exposing message timing and location information associated with troops and command facilities. The contract covered more than 568,000 service lines as of January 2026, and the report’s recommendations remain unresolved. For contractors supporting DoD mobility services, the findings point to possible contract changes and closer scrutiny of carrier controls and third-party security assessments.

- Companies supporting Spiral 4 or similar DoD mobility services should evaluate how their carrier security controls address SMS metadata and location exposure.
- Procurement teams may need to account for third-party carrier assessments and strengthened mobile-service security provisions as the report’s recommendations are addressed.
- The unresolved recommendations create potential for changes to contract requirements; the signals do not specify a decision or implementation deadline.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Digital Infrastructure
**Published:** October 18, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- Department of Defense Office of Inspector General (DoD OIG)

### Key Quotes
> I remain concerned that our service members remain at risk from the military’s insecure communications and look forward to seeing what else the Inspector General finds.
> — Ron Wyden, U.S. Senator

### Sources
- [Pentagon’s wireless comms left data exposed, watchdog finds](https://taskandpurpose.com/news/pentagon-wireless-location-services-exposed) - Task & Purpose
- [A U.S. Department of Defense Inspector General report found security gaps in the Pentagon’s Spiral 4 wireless services contract, potentially exposing sensitive military metadata and troop locations. https://t.co/Xkpe6lDDYn](https://x.com/CyberPulse56/status/2111652187822809588) - twitter-defense