A recent examination of hundreds of mobile apps marketed toward US military personnel found more than one in eight contained software built by companies in China, Russia, or other foreign nations, raising fresh concerns that adversary governments could harvest data revealing where service members live, work, and deploy. According to researchers at Purdue University, the US Military Academy at West Point, and Florida International University, one popular app used by service members to rate living conditions on their own bases include code from Huawei, the Chinese telecom that US regulators flagged as a national security threat in 2020. Two others were built by Russian companies and incorporate the Russian ad service Yandex.
Study Methodology and Key Findings
The researchers examined more than 220 such apps—from uniform guides and promotion-exam prep to banking and dating apps—pulled from the Google Play store and military subreddits. Nearly two-thirds—or 64 percent—contained third-party code, known as SDKs: prebuilt software components, typically used for analytics and advertising, that can also track user behavior, including their locations, and share that information with outside companies. Forty percent of the apps collected or shared more data than they disclosed in their Google or Apple store listings, the researchers found. The most common SDKs came from Google and Facebook, the two companies that dominate US digital advertising. But 76 SDKs turned up in all, including code traced back to China, Russia, Israel, India, Germany, and others. Roughly 7 percent of the apps carried third-party code from a nation considered adversarial by the Pentagon.
Specific Threats: Huawei and Yandex
Twelve of the apps contained HMS Core, a Huawei software kit that advertises the ability to map user locations, deliver ads, and store images and video. Several were built for state National Guard organizations. The researchers observed no data actually going to Huawei servers. But an SDK can be updated remotely at any time. Code that is dormant today can still be spyware tomorrow. In at least one case, the app integrated code from a Russian company using Yandex's advertising services.
Real-World Consequences and Official Acknowledgment
The stakes are no longer hypothetical. In April, US Central Command acknowledged in a letter to Senator Ron Wyden that it had received multiple threat reports of adversaries exploiting commercial location data to target or surveil American personnel in the Middle East, where US forces remain locked in a standoff with the Iranian military over the Strait of Hormuz. Lawmakers called it the first official confirmation that troops in an active war zone were being hunted through the data-broker economy—a threat the Pentagon's own contractors and researchers had warned about for nearly a decade. WIRED investigations have previously shown location data harvested from ordinary apps tracing US service members to their homes, their children's schools, and off-base establishments where troops are prohibited from being seen. Experts have warned the same data could aid foreign spies in identifying personnel with access to sensitive sites, map when a facility is least guarded, or surface other compromising details.
Implications for Enterprise and Supply Chain Security
For technology procurement leaders and CTOs, this study underscores the risk of third-party code in mobile applications, particularly those used by defense-related personnel. The presence of SDKs from adversarial nations in apps built for military use highlights the need for rigorous software supply chain vetting. As the researchers suggest, the findings should encourage "more informed privacy decisions" and continued discussion among developers, platforms, and policymakers. Joshua Shinkle, a Purdue University PhD researcher and the study’s lead author, stated: "We are grateful for the opportunity to bring greater attention to these issues. We hope the research helps military-affiliated personnel, developers, and platforms make more informed privacy decisions and encourages continued discussion with developers, platforms, and policymakers about how to address these gaps."
Sources:
