Inspector general says Pentagon did not require carriers’ security assessments at award of $2.67 billion wireless contract

By Garrett Sloane

WASHINGTON — The Department of War’s inspector general says the Pentagon secured voice and email on the phones it buys through its department-wide wireless contract. The audit, released Oct. 9, also found that the department did not require carriers to hand over third-party security assessments as a condition of award, and has not assessed whether carrier-held metadata from those devices is adequately protected.

The report, DOWIG-2027-001, examines the Spiral 4 contract, an indefinite-delivery, indefinite-quantity vehicle the Naval Supply Systems Command (NAVSUP) awarded to seven carriers on May 8, 2024. It has a base year and nine option periods, with a maximum value of $2.67 billion. That figure is a ceiling, not money spent. In May 2024 the department’s chief information officer required all components to buy unclassified wireless devices and service in the United States and its territories through Spiral 4.

The inspector general said the department had procured more than 568,000 lines of service as of January 2026. As of April 2026, more than 150,000 devices from 43 components were enrolled in the Defense Information Systems Agency’s DoW Mobility Unclassified Capability.

Why the audit was done

The inspector general opened the audit in response to a Dec. 4, 2024, request from Sens. Ron Wyden, D-Ore., and Eric Schmitt, R-Mo. Their letter, reproduced in the report, said the carriers selected under Spiral 4 “include AT&T, Verizon, and T-Mobile, which were reportedly breached by China as part of the recently revealed ‘Salt Typhoon’ hack.” Parts of the public report are redacted as controlled unclassified information. The Inquisitor relied only on the unredacted portions.

What the inspector general found

Voice and email communications were protected in transit and at rest through mobility, email and collaboration platforms run by the components or DISA, the report said.

Text messaging was the exception. A September 2023 CIO memorandum requires users of government phones to use Microsoft Teams Chat for official texting. It also allows ordinary SMS when Teams is not available. The report’s examples include a recruiter texting a prospective recruit, and a public affairs officer texting a journalist. The inspector general noted that SMS messages “are transmitted in clear text” and said the CIO “accepted the operational risks” of that exception.

On the carriers’ own networks, the report said the department “did not require carriers to provide the results of third-party security assessments as a condition of contract award.” It said this was because CIO officials “did not believe they had the authority to do so.” According to the report, the carriers agreed to new conditions and NAVSUP’s Wireless Mobility Program Office modified the contract on May 8, 2026. The inspector general said the department still needs to review the results before exercising each option.

The audit also found the department had not engaged carriers on whether controls protecting carrier-held metadata were sufficient. The report gives the reason as a belief that doing so would not be cost-effective to the government. Metadata, the report noted, can reveal “individual behaviors of mobile device users.” The report cites the Salt Typhoon campaign and a breach at one Spiral 4 carrier that, it said, news outlets reported affected more than 100 million customer accounts.

Recommendations and responses

The inspector general made three recommendations and considers all three unresolved:

• The CIO should assess the protection carrier-held metadata requires and give the results to NAVSUP. The CIO partially agreed, saying the Under Secretary of War for Intelligence and Security should lead that assessment.
• NAVSUP’s contracting officer should set up a process to review the carriers’ latest third-party assessments and penetration tests before each option. NAVSUP agreed and pointed to the May 2026 modification. The inspector general said the response did not describe how the process would work.
• NAVSUP should negotiate a bilateral agreement with the carriers to protect metadata. NAVSUP disagreed, saying it lacks authority to create or enforce new cybersecurity requirements without guidance from an authoritative organization.

The report asks for management comments by Nov. 9, 2026. The audit makes no finding of wrongdoing by any carrier.

Request for comment

The Washington Inquisitor sought comment from the Naval Supply Systems Command, Pentagon press operations (for the Office of the CIO), AT&T, Verizon, T-Mobile, the Electronic Frontier Foundation and the Electronic Privacy Information Center. This story will be updated with any responses.

Featured image: A cell phone displays an application designed by U.S. Airmen supporting Joint Task Force-National Capital Region, Joint Base Andrews, Md., January 2013. U.S. Army photo by Sgt. Christopher M. Gaylord, public domain, via Wikimedia Commons.