US military apps found with Chinese and Russian code raise data security concerns

Summary of Findings

A recent examination conducted by researchers from Purdue University, the US Military Academy at West Point, and Florida International University revealed that more than one in eight mobile applications marketed to US service members contain software developed by Chinese or Russian companies.

Among these apps, one notably used by military personnel to evaluate base living conditions includes code from Huawei, a telecommunications firm previously identified by US regulators as a national security risk. Two other apps were identified as having been created by Russian firms and utilizing the Yandex advertising service.

Implications of Foreign Code in Military Apps

The findings raise serious concerns about the security of sensitive data related to US military personnel, as the apps could potentially expose locations of service members, their homes, and deployment information. Researchers have pointed out that the largely unregulated advertising sector treats military personnel similarly to civilians, which increases the risk of location data being exploited for intelligence gathering by hostile entities.

Past investigations have indicated that this type of data harvesting could allow foreign spies to identify personnel with access to sensitive locations and determine optimal times for targeting these facilities.

Active Threats Acknowledged by Military Leadership

In April, US Central Command confirmed awareness of threats involving adversaries utilizing commercial location data to target American troops in the Middle East. This acknowledgment marked the first official recognition that US forces in an operational theater were being compromised by information accessible through the data broker market.

Concerns regarding the exposure of military personnel to threats from adversarial entities have been highlighted by Pentagon contractors and researchers for nearly a decade, emphasizing the urgency of addressing vulnerabilities in the digital landscape.