The staff briefing¶

Institutions turn up in these files constantly, and their responses have been remarkably uniform: brief the staff, advise on settings, remind people to think about their phones. The uniformity is not timidity. An institution has no edge in the graph, so the only actor it can instruct is a member of staff holding a consumer device, and that is where every remedy comes to rest.

The clerk’s brief¶

December 2025: The president’s entourage¶

On 10 December 2025 netzpolitik.org traced people around Emmanuel Macron through a French preview file of roughly a billion records from up to 16.4 million devices, with visits to the Élysée, La Lanterne, Villacoublay and a Republican Guard base, and one person identified, from a name on a letterbox and supporting documents, as working for the French gendarmerie. The Élysée did not reply to Le Monde. The defence ministry and the domestic intelligence service pointed to staff awareness work, on which the reporting’s verdict was that awareness is not enough. The clerks record that a protection detail is trackable by the same mechanism as the person protected, and on a more regular schedule.

November 2025: The Berlaymont, the Parliament and NATO¶

On 4 November 2025 netzpolitik.org, with Bayerischer Rundfunk, L’Echo, Le Monde and BNR, placed EU staff in commercial files: 278 million records from Belgium, 2,000 pings from 264 devices at the Commission headquarters, 5,800 from 756 at the Parliament, 9,600 from 543 inside NATO headquarters, and five identified officials, one commute reconstructed door to door. NATO asked that no phone at its headquarters be identified. The request was addressed to the journalists, because the journalists were the only party in the story who could be asked for anything. The clerks read the request as an accurate inventory of the available remedies.

The Commission issued guidance to staff on ad tracking settings, for work and private devices alike. A personnel department can reach its staff. It cannot reach an SDK vendor in another jurisdiction, an auction that broadcasts to several hundred bidders, a broker that will not name its sources, or a marketplace whose supervisor has no mechanism against it. The institution has money, lawyers and a security policy, and no edge on the graph along which any of it can travel.

The advice also fails at the point where identification actually happens. Internal policies govern the building; the file identifies people by the correlation between the building and the home, and the home is where the weather app runs. A colleague two desks away who has not adjusted their settings produces the same commute pattern in the file, and one revealing handset can be enough to place a workplace, since the workplace is a place many devices visit together.

November 2024: Thirteen installations, counted¶

On 20 November 2024 netzpolitik.org, with WIRED and Bayerischer Rundfunk, counted the military sites: thirteen installations, with the heaviest concentrations around Grafenwöhr and Ramstein and the lightest at the American embassy in Berlin. Four devices near Ramstein showed weekday visits that regulations forbid. Germany’s military counterintelligence service said it could only sensitise, warn and hope. The clerks note that hope was accurately described.

Among the counts, with the device figures as upper bounds:

Of the devices repeatedly inside Ramstein during the week, at least four also gave off signals from four brothels nearby. NATO pointed to its recommendations on personal device use.

July 2024: The first file, and the addresses in it¶

On 16 July 2024 netzpolitik.org and Bayerischer Rundfunk found intelligence and ministry staff in 3.6 billion German location points, including Bad Aibling, the domestic service in Cologne, the special forces barracks at Calw and Büchel air base at 38,000 points from 189 identifiers, with individuals traced from non-public home addresses to their workplaces. A member of the parliamentary oversight committee called the situation intolerable. The clerks observe that it has since been called intolerable more than once without becoming otherwise.

The file also held the counter-terrorism centre in Berlin, the defence and interior ministries, and the Grafenwöhr training area where Ukrainian soldiers were being taught. Büchel is reported as the only site in Germany where the United States stations nuclear weapons.

The identification took no special access. An identifier that rests overnight at one address and spends weekdays at a defence site has produced a pair of coordinates; public directories convert the first into a name, professional networking profiles confirm the second, and a telephone call to the person confirms both. Journalists did precisely this and then rang the people concerned.

Aggregation supplied the rest, including things nobody set out to collect. 131 identifiers appeared at both military facilities and brothels, and 160 at both brothels and government buildings. The clerks note that this is a recruitment shortlist assembled by a market with no interest in recruitment. No adversary had to select the targets; the sorting produced them anyway.

One control does appear to have worked, and it is visible as an absence: an employee of the domestic intelligence service showed a pattern consistent with devices being surrendered at the entrance. The data stops at the door. The control does not act on the market, the identifier or the auction. It removes the handset, which is to say it breaks edge 1 by hand, at one building, for the hours the person is inside it.

The muster roll¶

A nuclear-sharing air base, a foreign intelligence station, a special forces barracks, a counter-terrorism centre, thirteen counted military installations, three EU institutions, NATO headquarters and a presidential guard unit, all present in files sold as advertising inventory and handed out as samples. The identifications required directories and professional profiles rather than tradecraft. The responses, from national ministries, EU bodies and NATO alike, have been briefings, settings advice and requests to journalists, with one exception that works by taking phones away at a door. The clerks conclude that institutional security ends where the personal handset begins, that the market was built on the other side of that line, and that advising staff is not a weak remedy so much as the remedy available at the edge an institution controls.