Your Workforce Can Emit Program Signals Without Moving CUI

On August 4, 2026, the Senate Judiciary Committee's Subcommittee on Crime and Counterterrorism held a hearing titled "Your Data, Their Profit: The Consumer Cost of AI Surveillance Pricing." The hearing examined how ordinary personal and device signals are collected, combined across sources, used to generate inferences about a person, and then applied to commercial decisions. That is the mechanism worth carrying forward: collection, aggregation, inference, decision. The hearing record establishes congressional scrutiny of that pipeline. It does not establish any specific product-level causation, and this issue makes no such claim.

The same mechanism has a defense industrial base consequence that most compliance programs never inventory. An individual signal about one employee is usually low value. The same class of signal, gathered across a workforce and resolved over time, still describes individuals, but at workforce scale it can also support organizational inference. A contractor can scope its Controlled Unclassified Information environment correctly, pass the assessment its scope requires, and still have people whose personal devices, apps, carriers, and wearables generate commercially obtainable data that could support inferences about changes in activity, workforce concentration, or recurring relationships.

That exposure sits outside the CUI boundary by design. Nothing about it makes the boundary wrong. It is a different class of exposure, produced by different systems, governed by different agreements, and may have no documented owner in the security program.

Which signals generated by your workforce could an outside buyer acquire and use to infer what is happening inside the program without ever obtaining CUI?

Signals & Moves You Shouldn't Ignore

Congress is examining how personal data becomes an input to automated decisions.

The August 4, 2026 hearing before the Senate Judiciary Committee's Subcommittee on Crime and Counterterrorism addressed AI surveillance pricing and the use of personal data and derived inferences in commercial decision-making. What the hearing record supports is congressional scrutiny of the use of personal data and derived inferences in pricing decisions.

What it does not support is a claim that any named company priced a specific transaction from a specific device attribute. Mobile Security Guru is not asserting that. The operational value of the hearing for a security leader is narrower and more durable: personal device and app telemetry is an economically valuable input that third parties actively assemble, and the buyers of that data are not limited to advertisers.

Source note: hearing record and committee materials establish scrutiny of the mechanism. Product-specific causal claims are not made here.

SOURCE: U.S. Senate Committee on the Judiciary, Subcommittee on Crime and Counterterrorism, August 4, 2026

Duke researchers purchased individually identified data on military personnel for cents per record.

Duke University's Sanford School of Public Policy published "Data Brokers and the Sale of Data on U.S. Military Personnel" in November 2023. The study found that sensitive, individually identified data on active-duty service members, veterans, and their families could be purchased from data brokers, in some cases for as little as $0.12 per record. The team conducted purchases using both a .org identity and a .asia identity, and the authors' Lawfare account states that the .asia research site was hosted on a Singapore-based server.

The scoping matters. The Duke overview states that location data on military personnel was commercially available, and also states that the team did not purchase raw location data. What the researchers did obtain included datasets geofenced to Fort Liberty, Quantico, and the DC, Maryland, and Virginia area, with records individually identified by name, according to the authors' Lawfare account.

Mobile Security Guru operational inference, not a Duke finding: if records of that type can be acquired against a geofenced population and resolved to named individuals, then the same acquisition pattern applied across a contractor workforce could support inferences about population shifts, recurring travel relationships, and activity tempo. The Duke study establishes availability, identifiability, and price. The organizational inference layer is ours.

Source note: study findings and author commentary are stated separately from Mobile Security Guru inference.

SOURCE: Duke Sanford School of Public Policy, November 2023 | Lawfare, November 16, 2023

The CMMC reform period opens room to inspect exposure the assessment was never scoped to cover.

On July 13, 2026, the Department of War suspended the Phase II CMMC requirements that had been scheduled to take effect November 10, 2026. Phase I self-assessment requirements remain in place. The Department also established a CMMC reform task force and has stated that it will enforce NIST SP 800-171 Revision 2 during this period through self-assessments and select government-led assessments.

This is not evidence that CMMC is defective. The program does what it was designed to do: protect Federal Contract Information and Controlled Unclassified Information inside defined environments and assets. The reform period simply removes the third-party assessment scramble from the calendar for a while, and a security team that uses that time only to re-run the same self-assessment has spent it poorly.

The more useful use of the interval is to inventory a class of exposure that no CMMC assessment level was built to enumerate: commercially obtainable signals produced by the workforce outside the assessed environment.

Source note: dates and enforcement posture taken from Department of War CIO CMMC materials, July 2026.

SOURCE: Department of War CIO, CMMC About and Model pages, July 2026

The Purchasable Signal Gap

An accurate assessment boundary and an unmanaged signal surface can coexist.

CMMC governs FCI and CUI inside a defined environment: the systems, people, facilities, and assets brought into scope for the contract. A personal application, advertising identifier, carrier relationship, wearable, consumer location service, or household record can sit outside that environment when it does not process, store, or transmit the relevant FCI or CUI and otherwise remains outside the assessed environment. In those cases, excluding the signal source from the CMMC boundary may be correct scoping even though the data it generates can still create a separate exposure.

The commercial availability of those signals therefore does not make the assessment inaccurate. It creates a separate exposure class the assessment was never designed to inventory. CMMC does not create a dedicated requirement to inventory the commercial availability of workforce-generated telemetry as a separate exposure class. Existing security documentation may capture pieces of that exposure, but the assessment does not require a Purchasable Signal Register or equivalent view.

The categories worth examining are narrower than "everything mobile." Location and advertising identifiers generated by personal apps. Carrier and roaming associations. Device and application attributes exposed by personal-app SDKs. Wearable and route data from fitness or navigation services. Household and identity-linkage records assembled by brokers. Whether any specific item in those categories is actually purchasable depends on the provider, the service, the jurisdiction, and the broker involved. Treating every category as always available overstates the problem. Treating none of them as available understates it, and the Duke work shows why.

The gap the security team can close is documentary. For each category, the organization either knows who produces the signal, who could obtain it, and who owns the decision about it, or it does not.

My Take

The useful question is not whether the CMMC boundary is wrong. The question is what commercially available data generated outside that boundary can still describe activity inside the organization.

Compliance evidence and operational-intelligence exposure are different problems with different owners. The first asks whether the organization can prove a control operated on an in-scope asset. The second asks what an outside party can learn about the program without touching an in-scope asset at all. A program can be fully defensible on the first and completely blind on the second, and the required assessment does not necessarily inventory that second exposure.

The reform period creates room to inventory the second problem without waiting for a rule change to require it. A first pass can use existing inventories and governance records before the organization considers new tooling. The useful output is a register, a named owner per row, and a decision about which exposures the organization will reduce, compensate for, or accept.

I would also resist the instinct to make this a policy project first. Policy written before the inventory exists tends to prohibit things the organization cannot observe. Inventory first, then decide what is worth restricting, what is worth compensating for, and what is simply accepted risk with a name attached to it.

— William

One Thing Worth Doing This Week

Build a Purchasable Signal Register.

Work one row at a time. For each signal class, record what produces it, who could plausibly obtain it, what an outside party could infer from it at workforce scale, where that exposure is documented today, and which named person owns the decision. Leave the placeholders in place where the facts are not known. Record "Unknown" rather than filling the field by assumption. That gap can then be assigned for investigation.

Prioritize any row where the team can identify the signal or a plausible inference but cannot connect it to a documented owner, a control decision, or an accepted risk. That gives the security team a concrete exposure to investigate and assign.

Take the completed register to whoever owns mobile policy, contracts, and program security. The output of that conversation should be an owner per row and a decision per row, even where the decision is to accept the exposure as it stands.