Mobile phones on the battlefield: SIM risks and OPSEC

Mobile phones on the battlefield have become one of the defining security problems of modern war. The device every soldier carries is at once a radio, a camera, a GPS unit, a diary and an address book. Switched on, it talks to the network; post a photo and it leaves coordinates; lose it or have it intercepted and it reveals who its owner is and who they talk to.

This long read brings together what is publicly known about those risks, the cases that exposed them and how armed forces and governments have responded. As elsewhere in the encyclopedia, the approach is historical and descriptive. It is not a guide to evading investigations or attacking networks, but an explanation of why the phone is now an operations security (OPSEC) issue.

Key points

• The SIM identifies the subscriber to the network; the handset identifies the device. Together they leave a trail of locations, times and contacts even if no call is ever overheard.
• That trail can come from the network, from apps, from social media or from the device itself.
• A 'burner' SIM is rarely anonymous: patterns of use tend to tie it to others.
• Armed forces respond with bans, geolocation rules, their own networks and training; governments issue security advice to the public.
• There is a genuine dilemma: phones also document war crimes, warn of attacks and keep troops' morale up.

What a SIM is, and the trail it leaves

The SIM (Subscriber Identity Module) is a small chip that holds the subscriber identifier, the IMSI, and the keys that let the network recognise it. Each card also has its own serial number, the ICCID. An eSIM does the same job but is built into the phone and provisioned remotely. The handset has a separate identifier, the IMEI.

The crucial point is that most sensitive information lies not in the content of conversations but in the metadata: which cell the phone was in, at what time, which other numbers it contacted, for how long and how often. Michael Hayden, a former director of both the NSA and the CIA, put it bluntly in a public debate in 2014.

We kill people based on metadata.

Michael Hayden, debate at Johns Hopkins University, 2014

The line was meant to provoke, but it describes a documented reality: analysing communication patterns can be enough to identify and locate a person.

The risks, layer by layer

It helps to separate the levels at which a phone can give information away. The table pairs each layer with a public example, without going into techniques.

The network: the phone as a transmitter

A switched-on phone keeps registering with nearby base stations. The operator knows which cell it is in and, with more precise methods, can narrow that down considerably. The data are retained and can reach courts and police under each country's legal safeguards. And any transmitter can be picked up by enemy electronic warfare, just like a military radio — as our piece on radio direction finding explains.

Identity: mandatory registration

According to the GSMA, the global operators' association, more than 150 countries required some form of ID-based registration to activate a SIM in 2021. That links a number to a person from day one, document fraud aside.

Signalling: SS7, a protocol from the 1970s

Networks run by different operators talk to each other through signalling protocols, the oldest being Signalling System No. 7 (SS7), designed when only a few trusted telephone companies were connected. At the 31C3 hacker congress in 2014, researchers including Tobias Engel and Karsten Nohl publicly showed that its weaknesses could allow phones to be located or messages redirected. In 2017 Germany's Süddeutsche Zeitung reported bank thefts in which criminals had exploited those weaknesses to intercept codes sent by text message.

The account: SIM swapping

In a SIM-swap scam, the criminal tricks or bribes a mobile operator into moving the victim's number to a SIM they control; from then on, verification texts go to the attacker. The FBI said it received 1,611 SIM-swapping complaints in 2021, with losses of more than $68 million, compared with 320 complaints between 2018 and 2020. It is mostly a civilian threat, but it makes an important point: a phone number is weak proof of identity.

Apps: the voluntary trail

Geotagged photos, workout routes, social media profiles and dating apps produce information nobody has to intercept, because the users publish it themselves. Several of the best-known cases of the past decade belong to this layer.

The device: what the phone holds

If a phone falls into enemy hands or is infected with spyware, everything on it is exposed: messages, photos, contacts and locations. Commercial spyware such as Pegasus has shown that even the phones of journalists and senior officials can be compromised.

Case studies: when the phone made the difference

2005–2020: the Hariri case and the phone 'networks'

On 14 February 2005 a huge truck bomb in Beirut killed former Lebanese prime minister Rafik Hariri and 21 others. The UN-backed Special Tribunal for Lebanon built much of its case on telecoms data: investigators identified groups of phones that only called each other and moved in coordination, and labelled them by colour.

In August 2020 the tribunal convicted Salim Ayyash, a Hezbollah member, in absentia, and acquitted three co-accused for lack of sufficient evidence. The public judgment is one of the most detailed examples of how seemingly anonymous phones can be tied to real people through co-location with their personal phones.

2011: Abbottabad and the courier

For years Osama bin Laden kept phones and internet connections out of his compound in Abbottabad, Pakistan. According to the official US account and Peter Bergen's reporting, tracking his trusted courier — who did use a phone — was one of the threads that led the CIA to the house. One person's discipline is not enough if those around them do not share it.

2014: the 'selfie soldiers' of the Donbas

During the 2014 war in eastern Ukraine, open-source investigators such as Bellingcat and journalists such as Vice News's Simon Ostrovsky used photos posted by Russian soldiers on social media to document their presence on Ukrainian soil, contradicting Moscow's official denials. In 2019 Russia passed a law banning on-duty service personnel from carrying devices that can record and transmit data, and from posting information about their service.

2018: Strava maps military bases

In January 2018 an Australian student, Nathan Ruser, drew attention to the global heatmap published by the fitness app Strava, which showed the aggregated routes of millions of users. In almost empty stretches of Syria, Iraq and Afghanistan, bright lines traced the perimeters of military bases and their patrol routes. That August the US Department of Defense banned the use of geolocation features on personal devices in operational areas.

2018: honeytrap apps aimed at Israeli soldiers

In July 2018 the Israel Defense Forces said Hamas had set up fake profiles, dating apps and a World Cup app to infect soldiers' phones with spyware, and that hundreds of troops had downloaded one of them. The risk is not always technical: often it starts with a con.

2022–2023: Ukraine, intercepted calls and Makiivka

Since the full-scale invasion in 2022, Ukraine's security service, the SBU, has released large numbers of recordings it presents as intercepted calls from Russian soldiers to their families, often made on civilian phones. Their authenticity cannot always be independently verified, but the sheer volume suggests unprotected phone use was widespread.

In the early hours of 1 January 2023, a Ukrainian rocket strike hit a building in Makiivka, in occupied Donetsk, housing newly mobilised Russian troops. Russia's defence ministry acknowledged 89 deaths and blamed the soldiers' widespread use of mobile phones for giving away the location. Many analysts and Russian military bloggers disagreed, pointing also to troops being billeted next to ammunition. Kyiv claimed a far higher toll. The exact cause remains disputed, but Makiivka became the most cited symbol of the danger of phones at the front.

Why a burner phone is rarely anonymous

A popular idea, fed by films, is that a cheap handset and a fresh SIM make you invisible. The cases above show why that is rarely true. The general reasons are all publicly documented:

• Registration: in many countries a SIM is tied to an ID document at the point of sale.
• Handset: put a new SIM in a phone that has been used before and the device identifier can link it to the old one.
• Co-location: two phones that always spend the night in the same place or travel together suggest a single owner, as in the Hariri case.
• Contact patterns: calling the same numbers as your personal phone leaves a recognisable footprint.
• Human error: one slip — switching it on at home, using it for something personal — breaks the separation.

That is why investigators and intelligence services talk less about anonymity and more about 'patterns of life': what matters is less the number than the behaviour around it.

Alternatives: how armed forces and governments respond

Rules and bans

The most visible responses are restrictions. Russia banned recording and data-transmitting devices for on-duty troops in 2019. The US restricted geolocation in operational areas in 2018 and, according to US military media, units such as the 82nd Airborne Division deployed to the Middle East in January 2020 under orders to leave personal phones behind. Measures like these are part of OPSEC: protecting seemingly harmless details that, taken together, reveal operations.

Military communications

The military alternative to civilian networks is dedicated systems: encrypted tactical radios, independent command networks and satellite links. They are not invisible — any emission can be detected — but they are designed to resist interception and jamming and do not depend on a civilian operator that may sit in enemy territory. Ukraine has also seen massive use of satellite internet terminals, with their own strengths and vulnerabilities.

Training and culture

RUSI's reports on Ukraine stress that technology is not enough without discipline: soldiers reach for their phones out of boredom, fear or the need to talk to family. Training in operations security and oversight by commanders matter as much as any piece of kit.

Advice for civilians

After the intrusions into US telecoms operators attributed to a China-linked group known as Salt Typhoon, the US Cybersecurity and Infrastructure Security Agency (CISA) published mobile communications best-practice guidance for senior officials in December 2024. Its broad recommendations match those of national cybersecurity agencies elsewhere:

• Prefer end-to-end encrypted messaging apps over conventional texts and calls.
• Avoid text messages as a second authentication factor where stronger options exist, such as hardware security keys or authenticator apps.
• Add a PIN or passcode to your mobile account to make SIM swapping harder.
• Keep the operating system updated and review apps' location permissions.

An eSIM is not inherently more or less secure: it removes the risk of a card being physically stolen, but control of the account and the number still depends on the operator.

The dilemma: phones also save lives

It would be wrong to conclude that the phone is purely a liability. In Ukraine, official apps have let civilians report incoming drones and missiles, and millions of phone videos have helped document war crimes before international courts. For soldiers, talking to family is a source of morale no commander can ignore entirely.

That is why real-world policies are rarely outright bans but trade-offs: when, where and how a phone may be used. The debate, live in every army, is how much risk to accept in return for those benefits.