Military Apps Leak Service Member Data?

Hundreds of mobile applications designed for US military personnel have been found to contain software developed by companies based in China, Russia, and other foreign nations. This discovery has intensified worries about potential data harvesting by adversary governments, which could reveal the operational whereabouts and personal details of service members.

A comprehensive examination by researchers from Purdue University, the US Military Academy, and Florida International University identified that over one in eight such apps incorporated code from foreign entities. Notably, one app used by service members to rate base living conditions included software from Huawei, a Chinese telecommunications firm previously flagged as a national security risk. Additionally, several apps contained code from Russian companies and utilized the Russian advertising service Yandex.

The study revealed that 64% of the examined apps included third-party software development kits (SDKs), often used for analytics and advertising, which can track user behavior, including location data. A significant 40% collected or shared more data than disclosed in app store listings. While Google and Facebook SDKs were most common, 76 different SDKs were identified in total, with some originating from countries considered adversarial by the Pentagon.

Researchers also surveyed military-affiliated individuals, with over 83% reporting discomfort with the data practices of at least one app on their phones. A substantial majority expressed extreme discomfort with apps containing code from China, Russia, Iran, or North Korea. However, current app store privacy labels do not disclose the country of origin for embedded software, leaving users with little transparency.