Military-focused apps contain foreign-sourced code, raising data security concerns

Hundreds of mobile applications marketed to U.S. military personnel have been found to contain software developed by companies in China, Russia, and other foreign nations, sparking concerns about potential data harvesting by adversary governments, according to a recent report by Ars Technica.

A study by researchers from Purdue University, the U.S. Military Academy at West Point, and Florida International University examined over 220 apps, finding that nearly two-thirds contained third-party software development kits (SDKs). These SDKs, often used for analytics and advertising, can track user behavior, including location, and share it with external companies. Notably, 7% of the apps included code from nations considered adversarial by the Pentagon, with 12 apps containing Huawei's HMS Core.

While researchers did not observe data being sent to Huawei servers, they noted that SDKs can be updated remotely. Forty percent of the apps collected or shared more data than disclosed in their app store listings. The findings highlight a significant privacy gap, as neither Google nor Apple disclose the country of origin for software components within apps. Service members expressed discomfort with data practices, particularly when code originated from adversarial nations, yet lacked clear guidance on app usage and no straightforward way to identify apps with foreign code.

Source: Ars Technica