Digital security for military families. The complete operational guide.

The threat model is the family, not the soldier

Most military OPSEC training is built around the service member. What to post. What not to post. How to handle classified information. The threat actors targeting military families are not waiting for the service member to make a mistake. They are working the easier targets: the spouse on Facebook, the teenager on TikTok, the parent who answers a phone call from a number that looks like the unit’s, the in-law who shares a birthday post that names the base.

The threat surface for a military family breaks into five overlapping layers. The first is foreign intelligence services interested in service members for recruitment, coercion, or operational intelligence. They are patient. They build profiles over years. A spouse’s LinkedIn that mentions the base, a child’s school yearbook that names the unit, a Bumble account that geo-tags the housing area, all of it feeds a single dossier.

The second is the commercial data broker ecosystem. The data broker industry specifically targets military families with veteran-themed services that aggregate addresses, financial data, family member details, and movement patterns. The January 2026 GAO report confirmed that standard OPSEC training does not address this layer. The data accumulates whether the family takes action or not.

The third is romance and financial scammers who target military spouses during deployment. The scripts are well-rehearsed. The patience is patient. We have seen a Coast Guard spouse lose $47,000 to a six-month relationship that started with a friend request from someone who claimed to know her husband’s unit from a prior deployment.

The fourth is doxxing campaigns targeting military families on the basis of the service member’s role. Recruiters. Drill instructors. Officers in visible commands. Family Readiness Group leaders. The harassment is rarely about the family. It is about the unit, transferred to whoever is reachable.

The fifth is the adversarial party in a custody dispute who knows that location data, financial records, and digital communications are now standard discovery in family court. The spouse going through a separation while the service member is deployed is in a different legal and operational situation than a civilian going through the same proceeding.

Home address protection

The home address is the single most consequential piece of information a military family generates. It anchors targeting for every other layer of the threat model. It is also the piece of information that is hardest to suppress, because it is generated by routine life: vehicle registration, voter rolls, property records, utility accounts, package deliveries, school enrolments.

The fastest single improvement a family can make is to enrol in their state’s address confidentiality program. Forty-three states maintain some version of one, originally designed for victims of domestic violence and adapted to cover military members in recent years. The programme provides a substitute address that receives mail and forwards it. Voter rolls, court filings, and most state agency records use the substitute. Specific eligibility varies by state.

Data brokers are the second layer. The state programmes do not reach commercial brokers. The way phone carriers themselves sell real-time location data compounds the problem: even an address that is suppressed from public records can be inferred from the household’s collective phone activity. Opt-out from major brokers is achievable. Maintaining it is the work.

Package deliveries are the layer most families overlook. An Amazon, FedEx, or UPS delivery to the home creates a record that flows through systems the family does not control. For sensitive deliveries, use a base or commercial mailbox. For routine deliveries, accept the trade-off but understand it exists.

Social media and the deployment cycle

The information that compromises operational security on social media is rarely the post that says “Bob deployed today.” The compromising information is the pattern. A spouse who posts every morning at 0600 stops posting on the morning of deployment. The followers see the gap. The followers include profiles that exist for exactly this purpose.

The deployment cycle creates predictable information windows. Pre-deployment leave. The going-away dinner photo with the unit shoulder patch visible. The post about “the last weekend together for a while.” The mid-tour visit. The R&R window. The countdown posts in the final month. The homecoming photo at the airport with the unit’s name visible on a banner. Each one tells a watching adversary something. Together, they reconstruct the deployment timeline with high confidence.

The practical discipline is not to delete social media. It is to break the pattern. Post about the homecoming three weeks after the actual homecoming. Mention the deployment after it is fully over. Post family photos that show the unit shoulder patch only when the unit is in the position the patch suggests. The audience the family is actually trying to reach, friends and extended family, can wait.

The Army wife whose Etsy shop bio mentioned her husband’s unit number. The Marine spouse whose welcome-home Facebook post included the airport, the time, and the unit’s banner. The Navy SOF family whose child’s school yearbook listed the unit affiliation in the parent activity description. Each of these is a specific case from the last two years. None of them was a single bad decision. Each was a default that accumulated.

Children and the school exposure

Military children generate a documentation trail that the service member’s institutional security does not cover. School enrolment forms with parent occupation. School photo directories with addresses. Sports league rosters with phone numbers. Yearbook entries that list the unit. PTA emails that go to every parent on the school list, which is often public.

The hardest part of this layer is that the family did not generate it. The school generated it, the league generated it, the after-school programme generated it. The mitigations require asking questions that most parents do not think to ask. Does the directory include the parent’s military rank? Is the yearbook publicly archived? Does the sports league sell its mailing list to a vendor? The answers are sometimes uncomfortable for the institutions to provide. They are also necessary.

Family tracking apps add another layer. Life360. Find My Kids. Bark Connect. Each one captures the child’s location continuously and shares it with the platform. Many of them share it further. For families with operational sensitivity, the alternative is a platform-native solution (Find My on iOS, Family Link on Android) that keeps the data inside the OS provider rather than passing it through an additional vendor.

Family Readiness Groups and the leak surface

The Family Readiness Group is one of the most valuable institutions in military life and one of the most consistent leak surfaces. The FRG roster contains addresses, phone numbers, family member names, and unit affiliation, by definition. The FRG Facebook group, the FRG WhatsApp group, the FRG email distribution list, all of these are operational data aggregations.

We have seen FRG WhatsApp groups with over a hundred members where the group photo was a banner with the unit insignia, the description listed the deployment location, and the member list was visible to anyone added. We have seen FRG email lists CC’d to every spouse on the unit, with full email addresses visible to all recipients. The institutions are not the problem. The defaults are.

The mitigations are at the FRG leadership level. BCC instead of CC. Restricted membership with manual approval. No unit insignia in group profile photos or descriptions. No deployment locations in any persistent communication. These are five-minute changes that close a category of exposure entirely. They require the leadership to have thought about it.

Communicating with the deployed service member

The communication tools available to a military family during deployment are constrained by what is allowed at the deployed end. WhatsApp is permitted in many environments. Signal in some. FaceTime where bandwidth allows. The constraint is rarely on the family’s side. The family adapts to what the service member can use.

The discipline that matters more than the tool is the content. Anything that places the service member in a specific location at a specific time should not exist in a communication channel that aggregates metadata. The text message that says “are you back at the base yet” generates a record at the carrier level. The Instagram DM that says the same generates a record at Meta. The Signal message generates significantly less. The choice is operational.

Location sharing between deployed and at-home family members is a specific topic that the deployment-day operational checklist for military spouses addresses in more detail. The default settings on most location-sharing apps are wrong for military families. Continuous sharing creates a continuous record. Family-only sharing in a closed app creates a smaller record. Ad-hoc sharing on request, with verification, creates the smallest.

The spouse’s own threat model

The military spouse is a target in their own right. The romance scammer who has identified the household as having a deployed service member sees a specific operational opportunity: a person on a routine, sometimes lonely, often with predictable financial visibility because of military pay schedules, generally not trained to recognise the signs of a developing manipulation.

The scripts are well-documented. The Federal Trade Commission maintains current advisories on military-targeted scams that the family is unlikely to encounter through routine OPSEC training. The attack patterns we see most often involve a relationship that begins on a dating app or social media, lasts long enough to establish trust, and then produces a financial emergency. The amounts requested are calibrated to what the household can plausibly send.

The verification step that breaks most of these is a short video call in which the scammer is asked to show a specific gesture in real time. The scripts and the AI-generated avatars cannot pass this. Most family members do not think to ask. The most important defence is a household norm that the request, regardless of who appears to make it, will be verified before it is honoured.

When custody or separation enters the picture

The intersection of military life and divorce or custody proceedings has its own operational requirements. Service member protections (SCRA, USERRA) provide some shield against adverse judgments while deployed. They do not provide a shield against the digital evidence that has accumulated over the years of marriage.

The shared accounts, shared devices, shared cloud storage, shared location history, and shared smart home infrastructure that any modern household generates become evidence in family court. The working assumption that devices have been compromised during separation proceedings is the safer baseline than the assumption that years of shared infrastructure can be untangled cleanly.

For service members and their spouses navigating this, the first conversation is not with the family lawyer. It is with the digital audit that determines what evidence currently exists, what is recoverable, and what has been preserved by the household’s normal backup behaviour. The discoverable record is larger than either party assumes.

Frequently asked questions

Do data brokers actually have my military family’s information?

Yes, almost certainly. Veteran-themed data broker products specifically aggregate military family addresses, family member information, and movement patterns from public records, app permissions, and commercial transactions. The 2026 GAO report confirmed that current OPSEC training does not address this layer. Opt-out is achievable through major brokers and through automated services that submit requests on a recurring basis. Maintaining the opt-out is the work, not the initial submission.

Can spouses use their real names on social media safely?

For most spouses, yes, with the discipline applied to the content rather than the identity. The compromising information is rarely the name. It is the combination of name, location, unit affiliation, and deployment timing. A locked-down account with a real name, no location tags, no unit references, and a delay between events and posts about events is operationally lower-risk than an anonymous account that posts unit details under the assumption that anonymity protects the content.

What is the single most important step a new military family should take?

Run a household audit of every account, every device, and every shared service before the first deployment. Most families do not realise how much shared infrastructure exists until they try to inventory it. Email accounts, cloud storage, streaming services, banking, location sharing, smart home devices, photo libraries. The audit takes a weekend. The clarity it produces lasts years.

Does the military provide digital security support for families?

Limited. Most services offer general OPSEC briefings as part of family readiness training. The 2026 GAO report confirmed that the training is largely focused on social media behaviour and does not address commercial data brokers, romance scams, custody-related digital evidence, or family member exposure. The institutional support exists; the scope is narrower than the threat surface. Families generally need to build the rest of it themselves.

What should change at homecoming?

The end of a deployment is the moment to rotate any credential that may have been shared during the deployment, revoke any account session that no longer needs to exist, audit linked devices on every messaging app, and review what was posted during the deployment for anything that needs to be quietly archived rather than left in a permanent timeline. The post-deployment period is the easiest time to do this. The next deployment is the threat model it should be cleaned up against.

---

Military families absorb a threat surface that no individual member of the household chose. The institutional response to that threat surface has not kept pace with the way the threat surface is generated. This guide describes the operational version of what the institutional version does not yet cover. The family that runs it produces a smaller footprint, a smaller exposure, and a smaller liability than the family that does not.

There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.