US federal workers mandated to use app with Russian-founded vendor’s code

US federal workers are now required to install a White House application that contains code developed by Elfsight, a software vendor founded in Russia. Security researchers at Atomic Computer have discovered that external code within the application has the ability to control parts of the government software, raising concerns about potential vulnerabilities and data security, with further coverage provided by Tech Radar.

The application, costing $1.4 million, was mandated for use by the FAA and other federal employees. Elfsight, founded in Tula, Russia, in 2016, now markets itself as a European company but maintains an active Russian entity that saw significant revenue growth and continued hiring of Russian developers into 2026. Under Russian law, companies handling user data can be compelled to share it with state authorities, though Elfsight claims no such requests have been made. Security analysis by Atomic Computer revealed that Elfsight's servers control JavaScript files within the app.

Despite assurances from White House officials regarding the app's security and data practices, the founders' retained accounts at sanctioned Russian banks and continued travel to Russia, coupled with legal exposure, highlight persistent ties to Russia.

Source: Tech Radar