When Iran’s military planners prepared to hit American bases in the Middle East, they relied on intelligence from an unlikely source: U.S. service members themselves. According to security experts and even the U.S. military, Iran harvested data from social media accounts, fitness apps and even ads to establish patterns of life in U.S. bases across the region.

Paired with imagery reportedly provided by Russian satellites, the Iranians selecting the targets constructed a surprisingly accurate picture of where U.S. troops assembled and where to strike.

The result, seen in fusillades of drones and missiles that — despite many interceptions — found their mark, leaving more than a dozen service members dead and hundreds of others wounded and causing billions in damage to facilities and equipment. The full scope of the carnage, and what it means for the viability of the United States' long-term presence in the Middle East, is still being assessed.

As President Trump considers a new offensive and the specter of a widened Iranian retaliation looms over the region, the U.S. military is scrambling to move or hide assets while service members struggle to counter what experts call an era of ubiquitous technical surveillance (or UTS) and reduce digital footprints that have proved all too easy to track.

In recent months, congressional pressure on the military pushed several branches to disable mobile advertising IDs — the unique device identifiers used to track a person’s activity and location — on government-issued devices.

The Navy also sent out a warning with “cyber threat hygiene recommendations,” advising that sailors limit social media activity and turn off location app access to phone cameras and location data on personal devices. A later message from the acting secretary of the Navy called on personnel to “harden” their online profile and do the same for family members. Congressional scrutiny came when U.S.

Central Command acknowledged to Congress in April the potential of "adversary exploitation of commercial location data to target or surveil U.S. personnel in theater.” At the time, Centcom also confirmed military personnel were allowed to use personal devices in active areas of operation.

Since then, some units in high-risk areas have instituted turn-in and lock-away procedures, and stationed personnel have been warned to expect device confiscations. Steps to limit information on government-issued devices are a good start, said Erik Wittreich, chief executive of Veilant, a secure-communications and private-network firm.

But they are one part of what needs to become a “significant force protection mandate,” he said, rather than adjusting security after an attack.

“This has to be a part of mission planning, to be culturally adopted and shift the way we think about conducting operations in the future,” he said, noting that UTS involves “an assembly of sensors.” “It’s in our apps and our cellphones, but it’s not just our phone or our laptops," he said. "It’s the telematics in your vehicle, the smart thermostat in your condo, your house, your apartment.

And those are just four of the millions of the sensors that are out there.” It’s unclear how effective the messaging on security has been. In a September letter to the Pentagon, Sen. Ron Wyden (D-Ore.) and Rep. Pat Harrigan (R-N.C.) decried “the continued availability of commercial location data” from Pentagon facilities, citing the possibility that the information is coming from personal devices.

Meanwhile, an August investigation by British broadcaster Sky News found more than 1,300 users of the fitness-tracking app Strava sharing routes and the timing of their workouts — more than seven years after the Pentagon flagged Strava as a potential security risk.

"You can’t get out of the UTS problem by telling thousands of military intelligence personnel or diplomats to never post that restaurant review or swipe on Tinder or call their family; it’s just not realistic," said Justin Sherman, an analyst with the Center for Strategic and International Studies.

Experts say that data, much of which is sold by brokers online, can be used to reveal a military base’s rhythm, including shift rotations and meal times. The Strava leaks could also be used to determine base layouts to a high degree of accuracy. “You no longer need to hack a system," Wittreich said. “You can go and buy the data.

And that puts some of the responsibility back on us.” Part of the problem is that the U.S. military has operated some of its Middle Eastern bases for decades, confident that its adversaries were unable — or unwilling — to mount serious attacks.

In Bahrain, for example, where the Navy has operated its main logistics hub since 1995, deployments for the some 9,000 people to what is known as Naval Support Activity (NSA) Bahrain have been uneventful.

“People didn’t think about being stationed in Bahrain any differently than how they would in Norfolk or San Diego, from a security standpoint,” said John Cordle, a retired Navy captain who spent time at NSA Bahrain during his naval career and later as a contractor. He added that personnel on two-year deployments often brought their families with them on the assumption it was safe.

That attitude seems to be reflected in some of the information available online about NSA Bahrain. On Google Maps, users can pinpoint the base’s bowling alley, basketball and racquetball courts, galley and pier-side gym. There are even reviews, with one user touting…