Betrayal by Byte: The Hidden Risks Lurking Inside Military Apps

The US military’s reliance on commercial technology has created a double-edged sword. On one hand, apps and software have streamlined administrative tasks, freeing up troops for more pressing duties. However, they also pose significant security risks that are often invisible to users.

A recent study by researchers at Purdue University, the US Military Academy at West Point, and Florida International University examined hundreds of mobile apps marketed towards US military personnel. The results were alarming: over a quarter contained code built by companies in China, Russia, or other foreign nations. Huawei, a Chinese telecom deemed a national security threat by US regulators, was among those found to be involved.

The implications are stark. If an adversary government can harvest data revealing the location and routines of service members, it could be used to identify personnel with access to sensitive sites or map when a facility is least guarded. US Central Command has confirmed that multiple threat reports have been received of adversaries exploiting commercial location data to target American personnel in the Middle East.

The study’s lead author notes that researchers hope their findings will bring attention to these issues and encourage discussion among developers, platforms, and policymakers about addressing them. However, the onus should not be solely on developers or regulators; the Pentagon must take responsibility for ensuring that technology does not compromise national security.

One of the most disturbing aspects is the lack of transparency in app development. Even when an app’s developer is aware of third-party code being inserted, there may be no way to detect its presence without sophisticated technical expertise. The study found that nearly 40% of apps collected or shared more data than they disclosed in their store listings.

The Pentagon’s silence on this issue adds to the concern. A spokesperson declined to comment when asked, and this lack of accountability is particularly egregious given the stakes involved. As one participant noted, being tracked by an app can be just as intrusive as being surveilled by a human adversary.

Stricter regulations on foreign code in military-marketed apps are needed. Participants ranked in-phone warnings about foreign or unknown third-party code as the most effective mitigation. This could be achieved through legislation restricting data brokers from buying or selling information on military-affiliated personnel.

The issue also highlights the importance of institutional guidance on personal app use. Nearly two-thirds of participants said they had received little or no such guidance, and those who did reported it was inadequate. The Pentagon must take steps to educate its personnel about the risks associated with commercial technology and provide clear guidelines for responsible app use.

This story is a wake-up call for policymakers and regulators at all levels. It’s time to examine the apps and software underpinning military operations and ensure they are not putting national security at risk. The stakes are too high to ignore.