Twelve cents. That’s the going rate for an American servicemember in the Commonwealth that builds the American military, and for that price you get the name, the home address, the spouse, the kids, the health problems, the politics and the church, sorted by whether they sleep near Quantico. Virginia is where this nation’s military lives. The Pentagon stands on the Potomac, the world’s largest naval base anchors Norfolk, the Marines are forged at Quantico, and more than 629,000 veterans call the Commonwealth home. Every one of those families, including the Army officer three doors down from you in Falls Church, can be bought, sold, resold and fed into artificial intelligence by people they will never meet, and on Wednesday a United States senator put it on the record.

Sen. Mark Warner sits atop the Senate Intelligence Committee’s Democratic side, cleared to see the nation’s darkest secrets, and when the News-Press asked him during a Zoom call with Virginia reporters whether military families’ records are exposed, he didn’t flinch. “It poses a grave risk to our country,” Warner said. Then he named who is cashing in: “There are private data brokers who get ahold of some of this information and not only sell it to American companies for marketing purposes, but I think records have shown they’ve sold it to foreigners as well. That loophole needs to be closed.”

Foreigners. Sit with that word, then think about who wants a list of American military homes, spouses and kids: the governments Congress itself has named as adversaries, China, Russia, Iran and North Korea. And this isn’t a tech-hater crying wolf. “I’m long-term pro-AI,” Warner said, “but I got to believe we need some safeguards.” The same day he said it, a decade-old hole in the code under most of the internet was pried open with the help of AI, and the companies that swore to police their own platforms are, in Warner’s words, failing miserably.

What twelve cents buys

That twelve-cent price tag isn’t a guess. In 2023, Duke University researchers went shopping and bought records on up to 45,000 servicemembers for 12 to 32 cents apiece, plus data on 5,000 of their friends and relatives, for barely $10,000 total. The files held home and email addresses, health and financial details, religious practices and political affiliation, and buyers could sort troops by whether they lived or worked near Quantico and Fort Bragg. Nobody demanded a clearance or a background check, many brokers barely asked who was buying, and one waved off its ID check the moment the researchers paid by wire.

Now picture what a buyer does with it. A Navy wife picks up the phone and hears her deployed husband’s voice, cloned by AI, begging her to wire money now. A teenager gets a friend request from a stranger who already knows his dad’s unit, his school and his practice schedule. A foreign intelligence officer maps which Northern Virginia households are drowning in debt and which ones have something to hide. Duke’s researchers warned of exactly that: a foreign adversary could get this data “in a heartbeat to profile, blackmail, or target military personnel.”

If you think it can’t happen here, it already did. Warner pointed back to China’s theft of federal personnel records from the Office of Personnel Management a decade ago, a breach that exposed millions of federal workers’ background files, many of them living within a few miles of this newspaper. “It could undermine the morale of the military if your personal information’s out there,” Warner said. “But this is nothing new.”

The laws are asleep

Warner says the protections on the books aren’t being used. “There are already laws that protect military families and military members, their privacy, but they’re not being enforced strictly enough,” he said. “We need a comprehensive privacy bill that deals in an era of AI and enhanced cyber. We don’t have that.”

Washington has acted, but only against foreign buyers. The Protecting Americans’ Data from Foreign Adversaries Act of 2024 bars data brokers from selling sensitive data, including military status, to China, Russia, Iran and North Korea. The FTC fired warning letters at 13 unnamed brokers in February over products that revealed Americans’ service in the armed forces. A Justice Department rule in effect since April 2025 walls off data linked to military personnel, plus location data around 738 government sites including military installations, from countries of concern.

Now read what those rules don’t touch. A domestic marketing firm can still sell a Falls Church military family’s profile to any American buyer, who can sell it again, and again. A buyer outside the four named countries gets a contract clause, not a wall. There is still no comprehensive federal privacy law, so families have no right to know who holds their data, no right to see it and no right to delete it. That is the loophole Warner named on Wednesday, and nobody in Washington has closed it.

Enforcement is the other hole. Warner said the Trump administration has “decimated” CISA, the federal Cybersecurity and Infrastructure Security Agency. He put the cut at more than half, though federal reporting and Warner’s own June release put the loss at roughly a third of the workforce, nearly 1,000 employees. “It is not up to doing the job that it needs to do,” he said, “and that is even before we see the advent of all these new AI tools that are making all of our systems much more vulnerable.” He offered to send his own bills to tighten the standards: “I got plenty of legislation, happy to send you, that would increase those standards. But we’ve seen no appetite from this administration on even enforcing existing laws.”

Asked on the same call about Flock license plate cameras, the system Arlington just canceled, Warner said the problem isn’t just capture but retention: “the idea that you can have this information be kept for, I think, almost an unlimited period of time when with very little oversight.” Swap license plates for military family profiles and the diagnosis is identical. Data that’s collected without limits and kept forever ends up anywhere.

“They have failed miserably”

The companies building the AI that can turn that data into a weapon swore two years ago they would police themselves. At the 2024 Munich Security Conference, about two dozen tech giants, including Google, Meta, X and TikTok, pledged to detect, label and remove deceptive election deepfakes. On Wednesday, Warner delivered the verdict. “All of these companies promised solemnly in 2024,” he said. “They have failed miserably.”

A day earlier, Warner, Sen. Alex Padilla and Reps. Jim Himes and Joe Morelle sent what he called “a fairly testy letter” to the CEOs of 25 companies, from Alphabet, Meta, Microsoft, OpenAI and Anthropic to TikTok, Telegram, Rumble and Truth Social. It accuses some firms of dragging their feet on Russian propaganda, letting AI tools churn out fake election material their own rules forbid, and shrinking the very trust-and-safety teams meant to stop it. “Refusing to grow and expand your election integrity teams — and even shrinking these teams — does not support your stated commitments,” the lawmakers wrote.

Warner said the companies are “not even honoring their own standards,” and that “some of my Republican friends are even bragging” about deepfakes of Senate candidates in Texas and Georgia. Many of those same platforms are AI companies, he noted, and “the president’s proposal is to basically let them self-regulate when it comes to safety issues around AI.” That leaves military members without the extra protection they need, Warner said: “I think it’s outrageous.”

Here’s why that matters to a military family on Park Avenue. The deepfake problem and the data broker problem are the same problem wearing two faces. A broker file tells a scammer, or a foreign intelligence service, who your spouse is, where they serve and what your kids are named, and AI fills in the rest with a cloned voice, a fake video or a perfectly tailored phishing email. Last week, OpenAI’s own policy counsel told a federal judicial panel she doesn’t expect any reliable scientific method to detect AI images going forward.

Warner pointed to France as a warning shot. Last week, hackers seized the refrigeration systems at hundreds of French supermarkets, including Intermarché, Carrefour and Monoprix stores, and drove fridges and freezers as high as 122 degrees Fahrenheit, spoiling food and sparking fires. Intermarché’s CEO put the losses at tens of millions of euros in a single day. Warner described it as a cyberattack “using AI tools,” though French investigators have publicly traced it to outdated refrigeration software and have not named who did it. “That’s just one small example,” Warner said. “If we don’t put some safety in place, what could happen?”

The day the web cracked open

On the same day Warner took the News-Press’s question, the internet got a live demonstration of exactly what he fears. Warner flagged it himself on the call, pointing to “a major report today on PHP, an old coding language that is involved in many websites around the world,” a “long known gap” that “these AI tools can help you exploit.” PHP is the code under roughly 70 percent of all websites. WordPress, which runs on PHP, alone powers more than 40 percent of the web, a list that stretches from neighborhood swim clubs to the White House, which has run on WordPress since 2017. Wednesday morning, PHP’s maintainers rushed out emergency patches for two critical flaws, dubbed “PHP2Shell,” that let an attacker seize a web server with a single request and no password.

Those flaws had been hiding in PHP for more than a decade, and AI dragged them into the light. Researchers at the security firm Wiz said frontier AI models helped them find the bugs and build a working exploit, and that “a single researcher completed in a week what previously would have taken a world-class team months of work.” OpenAI, which says its models also helped uncover the problem, called it “one of the most impactful vulnerabilities in recent memory” and warned that “the same capabilities can also help attackers rapidly develop offensive tools and exploits.”

The fallout hit within hours. Government services in the Netherlands, Finland, France and Australia went temporarily dark, and Japan’s prime minister issued “an urgent request for everyone to take action tonight.” The NSA told organizations that couldn’t patch right away to “take the system offline until it can be fully mitigated.” CISA said it had not seen exploitation when it issued its advisory, but the security firm Patchstack reported active attacks, and the scanning firm Censys counted nearly 55 million web properties running PHP. The News-Press has asked the White House and CISA whether federal websites, including WhiteHouse.gov, have been patched, and will update this story with any response.

Now bring it home. Think about every website that holds a piece of a Falls Church military family’s life: the youth sports registration page, the PTA sign-up, the church directory, the neighborhood swim club. Plenty of sites like those run on PHP, and plenty are run by volunteers who will never hear the word “patch.” That is Warner’s warning playing out in real time. The same AI that defenders used to find this hole in a week is available to anyone hunting for the next one, and the federal agency meant to sound the alarm has lost roughly a third of its people.

What Falls Church should demand

Warner has a track record of hounding agencies when he wants answers. He and Sen. Tim Kaine have hammered the VA over the elimination of more than 1,700 vacant positions at Virginia facilities, sending numbered questions, calling out every dodge and demanding a briefing. He has pushed the Pentagon on child care fee assistance, pressed for the new Military Spouse Commission to reach more Virginia families, and cosponsored bills to help military spouses get hired and keep kids on TRICARE until 26. Data privacy is the one fight missing from that list, and the Military Spouse Commission, chaired by Jennifer Hegseth, doesn’t have it on its agenda either.

The News-Press sent Warner’s office five questions this week. What is Congress doing to investigate the sale of data on servicemembers, spouses and children? Once that data lands in a commercial dataset or an AI system, what stops it from spreading? What oversight applies when federal agencies and contractors buy the same commercial data? What gaps remain in current law for adversaries to exploit? And should military families have the right to know who holds their data, demand its deletion and block its use in AI training?

Here’s what should keep you up tonight: most of this is perfectly legal. A broker can sell a Marine’s home address to any buyer in America, that buyer can sell it again, and nobody ever has to tell the family it happened. Warner named the loophole himself. Until Congress slams it shut, the family down your street isn’t just your neighbor. They’re inventory, and the checkout line is open to anyone with twelve cents and a reason.