Militaries around the world spend countless hours training, developing policies, and implementing best operational security practices, so imagine the size of the egg on the face of the Dutch navy when journalists managed to track one of its warships for less than the cost of some hagelslag and a coffee.

The security snafu was reported by Dutch regional broadcaster Omroep Gelderland. In a Thursday [1]report , Omroep Gelderland journalist Just Vervaart said the broadcaster was able to track HNLMS Evertsen, a Dutch air-defense frigate deployed to help protect France’s aircraft carrier Charles de Gaulle against missile threats, by mailing a Bluetooth tracker concealed in a postcard to the ship.

Per Vervaart, the Dutch Ministry of Defence makes it easy to send mail and packages to soldiers and sailors in the Dutch armed forces and posts full instructions online. It's that freely available open-source intelligence data that Vervaart was able to use to send the tracker to the Evertsen.

[2]

The report says the tracker remained active for about 24 hours, showing HNLMS Evertsen leaving port in Heraklion, Crete, and sailing first west along the island’s coast before turning east toward Cyprus. The tracker finally went offline a day later when the ship was near Cyprus, and hasn't come back online.

[3]

[4]

According to Dutch defence officials Vervaart spoke to for his story, the tracker was found during mail sorting and was disabled. Still, the Ministry is reportedly changing its mail policies in response to the incident and will now ban greeting cards containing batteries along with further reviewing mail guidelines.

The ban on greeting cards containing batteries appears to be a direct response to Vervaart's test, as he chose to conceal the Bluetooth tracker in a postcard after ministry videos and mailing guidance indicated envelopes were not X-rayed, unlike packages, making that route more likely to pass through undetected.

An opsec lesson for civvies, too

As a military veteran myself, I understand the delicate balance to be made between letting troops stay in touch with their families and protecting them from accidentally spilling crucial secrets.

Social media, for example, has been an [5]absolute opsec disaster for militaries, as even the most innocuous seeming post can accidentally include information that's incredibly valuable to the right person. Limits obviously have to be put in place to that end.

[6]Lovestruck US Air Force worker admits leaking secrets on dating app

[7]Tile trackers are a stalker's dream, say Georgia Tech researchers

[8]Top Trump officials text secret Yemen airstrike plans to journo in Signal SNAFU

[9]Google, Apple gear to raise tracking tag stalker alarm

Cut soldiers and sailors off from physical mail while on deployment, though, and you're likely to have a mutiny on your hands. Technology has changed, though, and something once as innocuous as posting instructions on how to send mail to military members has to be weighed in a new light.

"Nowadays, you can eliminate targets remotely and with great precision, but you do need to know where they are," retired Dutch lieutenant general Mart de Kruif told Omroep Gelderland in the original story. "So, as a frigate, you never want to reveal your location to other people."

[10]

This isn't just a military lesson, either: Technological evolution means things that were totally acceptable in the enterprise world before may now be critical security risks that have yet to enter into your OPSEC equation. ®

Get our [11]Tech Resources



[1] https://www.gld.nl/nieuws/8463135/oorlogsschip-van-500-miljoen-euro-gevonden-met-gadget-van-5-euro

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aeKthHJW0LcW_i3Mt7Tr2gAAAFg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aeKthHJW0LcW_i3Mt7Tr2gAAAFg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aeKthHJW0LcW_i3Mt7Tr2gAAAFg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://www.theregister.com/2025/11/17/pentagon_soldiers_secrets_socials_whoops/

[6] https://www.theregister.com/2025/07/10/airman_admits_dating_app_leaks/

[7] https://www.theregister.com/2025/09/30/tile_trackers_unencrypted_info/

[8] https://www.theregister.com/2025/03/24/signal_atlantic_security_disaster/

[9] https://www.theregister.com/2024/05/14/android_apple_devices_anti_stalking/

[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aeKthHJW0LcW_i3Mt7Tr2gAAAFg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[11] https://whitepapers.theregister.com/