Defense Department service members, civilian employees, contractors and family members knowingly or unknowingly leave behind sensitive information via digital activity that can be used by malicious actors, as shown in this graphic. (Government Accountability Office)

The Pentagon’s missions and personnel are increasingly vulnerable to “malicious actors” who can disrupt operations by aggregating digital information from data brokers, websites and other sources, a government watchdog concluded in a report issued Monday.

An 18-month audit by the Government Accountability Office of 10 Defense Department components — all five military services, U.S. Cyber Command, U.S. Special Operations Command, National Security Agency, Defense Counterintelligence and Security Agency and Defense Intelligence Agency — found that all but one “did not consistently train personnel on risks of digital information in the public across all relevant security areas,” the report states.

U.S. Special Operations Command provided a digital force protection training course aimed at helping personnel manage their online identities, among other things, the report states.

“Eight of ten components did not conduct assessments of threats across the required security areas of force protection, insider threat, mission assurance, and operations security,” the report states.

“While the department has taken actions related to a wide field of traditional security areas, its actions to reduce safety, security, privacy, and operational risks posed by the digital profile are limited,” the report states.

The security risks posed by malicious actors — criminals, terrorists and adversarial nations — have increased with the proliferation of ubiquitous digital devices, social media and “big data” that can now be combed using artificial intelligence.

“The digital activity of DOD’s service members, contractors, and family members — from websites visited to emails sent to photos posted on social media — can generate volumes of traceable data that can threaten their privacy and safety, and ultimately our national security,” the report states.

“These digital footprints represent a piece of a larger puzzle that, when tied to other sources, can create a digital profile and adversely affect military functions and missions.”

A malicious actor can create a digital footprint for an individual by purchasing personal information from a data broker for just pennies and combining it with online posts and location “pings” from cellular towers from devices such as fitness trackers, the report states.

The report illustrates a hypothetical scenario in which the operations of an aircraft carrier could be disrupted or sabotaged by a malicious actor using Pentagon news releases, media reports, online activity, social media posts and ship coordinates routinely posted by maritime aficionados.

The DOD concurred with 11 of 12 recommendations made by the GAO and partially concurred with one.

Among the recommendations were that:

-The secretaries of the Air Force and Army and the Defense Counterintelligence and Security Agency conduct required assessments in the security areas of force protection, insider threats and mission assurance

-U.S. Cyber Command, Defense Intelligence Agency and National Security Agency conduct required assessments in the security areas of force protection, insider threats, operational security and mission assurance

-The Navy secretary ensure that the service is conducting required assessments in the security areas of force protection, insider threats, operational security and mission assurance