AUGUST 13, 2025 – Personal data has become a highly sought-after commodity, exploited by individuals, companies, and state-sponsored actors, according to security experts. The pervasive collection of data through everyday technologies – smartphones, vehicles, credit cards, and even public spaces – is referred to as ubiquitous technical surveillance, often abbreviated to “UTS.” This constant monitoring allows for the long-term storage and analysis of information, potentially reconstructing past events indefinitely.
UTS operates through five key collection pathways – online, financial, electronic, visual, and travel – making targeted individuals and organizations vulnerable to exposure via these threat vectors.
Recent discoveries highlight the growing threat. As early as March 2025, researchers identified Android applications, some available on Google Play, uploading sensitive user data to foreign intelligence agencies in North Korea. These apps, disguised as utilities, collected SMS messages, call logs, location data, audio recordings, installed app lists, keystrokes, and Wi-Fi network details. Google acknowledged the issue, stating its Play Store can detect some malicious apps, but urged users to carefully review app descriptions and requirements before installing.
The rise of artificial intelligence also presents new risks. In April 2025, a Polish researcher demonstrated the ability to generate a near-perfect fake passport using ChatGPT-4.0, successfully bypassing “Know Your Customer” (KYC) verification systems used by financial institutions. This vulnerability underscores the ease with which AI can be used to forge credentials for fraudulent activities. ChatGPT has since adjusted its policies to prevent such requests.
Even seemingly innocuous “smart” devices pose a privacy threat. The consumer group Which? recently warned that some Chinese-made air fryers were equipped with trackers and engaged in excessive surveillance, prompting a review of data protection laws by the Information Commissioner’s Office.
Amid these evolving threats, experts emphasize the importance of operational security (OPSEC). OPSEC is a systematic process for identifying and protecting critical information, adaptable to any plan or activity. Recent cases demonstrate the need for constant vigilance.
Former government employees with security clearances have been targeted by fake job postings on LinkedIn and Indeed, orchestrated by Chinese and North Korean operatives. Chinese intelligence agencies have used fake consulting firms to recruit personnel, while a North Korean intelligence officer infiltrated a U.S. cybersecurity firm using stolen credentials and an AI-enhanced photo.
Disgruntled current and former employees have also leaked classified information. Nathan Laatsch, a former Defense Intelligence Agency IT specialist, was arrested for attempting to transmit national defense information to Germany, motivated by disagreement with the Trump administration’s policies. Similarly, former Army intelligence analyst Sgt. Korbein Schultz pleaded guilty to conspiring to provide sensitive military documents to China and was sentenced to 84 months in prison.
These incidents underscore the need for continuous security training and a coordinated approach between OPSEC programs and law enforcement agencies to deter such actions.
Courtesy Story
Army Counterintelligence Command