The audit addresses data held outside Defense networks
The Department of War inspector general examined unclassified wireless telecommunications acquired through the Spiral 4 contract vehicle. Its public record identifies three open recommendations focused on mobile metadata retained by commercial carriers.
The first calls for the chief information officer to assess what protection that metadata requires. The finding concerns an incomplete control decision; it is not evidence that a hostile actor accessed the data.
| Recommendation | Required action |
|---|---|
| Risk | Assess protection needed for carrier-held metadata |
| Testing | Review current third-party assessments and penetration tests before options |
| Contract | Create bilateral carrier agreements based on the assessment |
Contract options create a recurring control point
The watchdog recommended review of the latest third-party security assessments and penetration tests before exercising contract options. That connects security evidence to the moment the government decides whether service continues.
A review is meaningful only if its criteria, exceptions and remediation decisions are documented. The public summary does not disclose carrier-specific weaknesses, appropriately limiting sensitive detail.
Agreements would convert expectations into obligations
The third recommendation calls for bilateral agreements with carriers to protect metadata according to the department’s risk assessment. Without that linkage, a policy expectation may not be an enforceable contract duty.
The record assigns no questioned costs or monetary savings. Its public value is preventive: clarifying responsibility before an incident rather than pricing a loss afterward.
Method and limits
The newsroom classified each recommendation by control type and reviewed its open status. It did not access carrier networks, classified annexes or nonpublic penetration-test results.
The article does not claim an actual breach, unlawful surveillance or contractor misconduct. It reports the safeguards the inspector general says the department has not yet completed.
Sources and further reading
Department of War OIG, Spiral 4 wireless security audit, October 14, 2026 ↗