Where the remedies land¶

Institutions turn up in these files constantly, and their responses have been remarkably uniform: brief the staff, advise on settings, remind people to think about their phones. The uniformity is not timidity. An institution has no edge in the graph, so the only actor it can instruct is a member of staff holding a consumer device, and that is where every remedy comes to rest.

What the files contain¶

The first German file put movement data at the Bundesnachrichtendienst site in Bad Aibling, the domestic intelligence service in Cologne, the special forces barracks at Calw, the counter-terrorism centre in Berlin, the defence and interior ministries, and the Grafenwöhr training area where Ukrainian soldiers were being taught. Büchel air base appears as well, reported as the only site in Germany where the United States stations nuclear weapons.

Later reporting with WIRED and Bayerischer Rundfunk counted thirteen sensitive installations. Among the counts, with the device figures as upper bounds:

The Brussels file held roughly 2,000 pings from 264 devices at the Commission headquarters, 5,800 from 756 at the Parliament and 9,600 from 543 inside NATO headquarters, out of 278 million Belgian records carrying 2.6 million identifiers. The French file ran to about a billion records from up to 16.4 million devices, with visits to the Élysée, the weekend residence at La Lanterne, the Villacoublay air base used for presidential flights and the barracks of the guard unit that protects the president.

Identification is clerical work¶

The step that turns a pseudonymous file into an institutional problem takes no special access. An identifier that rests overnight at one address and spends weekdays at a defence site has produced a pair of coordinates; public directories convert the first into a name, professional networking profiles confirm the second, and a telephone call to the person confirms both. Journalists did precisely this and then rang the people concerned.

Aggregation supplies the rest, and it supplies things nobody set out to collect. In the German file, 131 identifiers appeared at both military facilities and brothels, and 160 at both brothels and government buildings; of the devices repeatedly inside Ramstein air base during the week, at least four also gave off signals from four brothels nearby. That is a recruitment shortlist assembled by a market that has no interest in recruitment, which is the property that makes this different from an intelligence operation. No adversary had to select the targets; the sorting produced them anyway.

One control does appear to have worked, and it is visible as an absence: an employee of the domestic intelligence service showed a pattern consistent with devices being surrendered at the entrance. The data stops at the door. Note what that control does. It does not act on the market, the identifier or the auction. It removes the handset, which is to say it breaks edge 1 by hand, at one building, for the hours the person is inside it.

Everything else lands on the individual¶

Germany’s military counterintelligence service could offer that it can only sensitise people, warn again and again, and hope for the cooperation of the men and women concerned. NATO pointed to its recommendations on personal device use. The French defence ministry and the domestic intelligence service cited staff awareness work after the president’s entourage surfaced. The European Commission issued guidance to staff on ad tracking settings, for work and private devices alike. Roderich Kiesewetter, deputy chair of the German parliamentary oversight committee, held that private phones had to be switched off for the entire commute.

Read as a set, these are not weak answers to a hard problem so much as the answers available to an institution acting on its own side of the boundary. A personnel department can reach its staff. It cannot reach an SDK vendor in another jurisdiction, an auction that broadcasts to several hundred bidders, a broker that will not name its sources, or a marketplace whose supervisor has no mechanism against it. The institution has money, lawyers and a security policy, and no edge on the graph along which any of it can travel.

The advice also fails at the point where identification actually happens. Internal policies govern the building; the file identifies people by the correlation between the building and the home, and the home is where the weather app runs. A colleague two desks away who has not adjusted their settings produces the same commute pattern in the file, and one revealing handset can be enough to place a workplace, since the workplace is a place many devices visit together.

NATO’s response to the Brussels reporting is the most exact statement of the position anybody has made: it asked that no phone located at its headquarters be identified. The request was addressed to the journalists, because the journalists were the only party in the story who could be asked for anything.

The clerk’s brief¶

December 2025: The president’s entourage¶

On 10 December 2025 netzpolitik.org traced people around Emmanuel Macron through a French preview file of roughly a billion records from up to 16.4 million devices, with visits to the Élysée, La Lanterne, Villacoublay and a Republican Guard base, and one person identified, from a name on a letterbox and supporting documents, as working for the French gendarmerie. The Élysée did not reply to Le Monde. The defence ministry and the domestic intelligence service pointed to staff awareness work, on which the reporting’s verdict was that awareness is not enough. The clerks record that a protection detail is trackable by the same mechanism as the person protected, and on a more regular schedule.

November 2025: The Berlaymont, the Parliament and NATO¶

On 4 November 2025 netzpolitik.org, with Bayerischer Rundfunk, L’Echo, Le Monde and BNR, placed EU staff in commercial files: 278 million records from Belgium, 2,000 pings from 264 devices at the Commission headquarters, 5,800 from 756 at the Parliament, 9,600 from 543 inside NATO headquarters, and five identified officials, one commute reconstructed door to door. NATO asked that no phone at its headquarters be identified. The clerks read the request as an accurate inventory of the available remedies.

November 2024: Thirteen installations, counted¶

On 20 November 2024 netzpolitik.org, with WIRED and Bayerischer Rundfunk, counted the military sites: thirteen installations, with the heaviest concentrations around Grafenwöhr and Ramstein and the lightest at the American embassy in Berlin. Four devices near Ramstein showed weekday visits that regulations forbid. Germany’s military counterintelligence service said it could only sensitise, warn and hope. The clerks note that hope was accurately described.

July 2024: The first file, and the addresses in it¶

On 16 July 2024 netzpolitik.org and Bayerischer Rundfunk found intelligence and ministry staff in 3.6 billion German location points, including Bad Aibling, the domestic service in Cologne, the special forces barracks at Calw and Büchel air base at 38,000 points from 189 identifiers, with individuals traced from non-public home addresses to their workplaces. A member of the parliamentary oversight committee called the situation intolerable. The clerks observe that it has since been called intolerable more than once without becoming otherwise.

The muster roll¶

A nuclear-sharing air base, a foreign intelligence station, a special forces barracks, a counter-terrorism centre, thirteen counted military installations, three EU institutions, NATO headquarters and a presidential guard unit, all present in files sold as advertising inventory and handed out as samples. The identifications required directories and professional profiles rather than tradecraft. The responses, from national ministries, EU bodies and NATO alike, have been briefings, settings advice and requests to journalists, with one exception that works by taking phones away at a door. The clerks conclude that institutional security ends where the personal handset begins, that the market was built on the other side of that line, and that advising staff is not a weak remedy so much as the remedy available at the edge an institution controls.