Apps Marketed to US Troops Are Shipping Chinese and Russian Code
A study by researchers at Purdue University, the US Military Academy at West Point and Florida International University has found that more than one in eight mobile apps marketed to US troops contain software built by companies in China, Russia and other foreign nations, fuelling concerns that adversary governments could gather data on where service members live, work and deploy. The findings matter because such data has previously been shown to reveal troop movements, unit locations and personnel routines at sensitive sites, including facilities where nuclear weapons are believed to be stored, and US Central Command confirmed in April that adversaries had already used commercial location data to target American personnel in the Middle East.
The researchers examined more than 220 military-focused apps, from uniform guides to banking and dating apps, and found 64% contained third-party tracking code, or SDKs, with 40% collecting or sharing more data than they disclosed. While Google and Facebook supplied the most common SDKs, 76 different providers were identified in total, including firms from China, Russia, Israel, India and Germany, with around 7% of apps containing code from nations considered adversarial by the Pentagon. Twelve apps, some built for state National Guard organisations, contained Huawei's HMS Core kit, which can map user locations, while others used the Russian ad service Yandex.
In short
- Over 1 in 8 military-marketed apps contain Chinese, Russian or foreign-built code
- 64% of 220+ apps studied had tracking SDKs; 40% over-collected data
- Researchers warn this data could expose troop locations to adversaries
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
This research reveals a genuine national security threat. Military personnel's location data and routines are inherently sensitive, and the Pentagon has confirmed that adversaries have already weaponised commercial location data to target US personnel. Allowing military-focused apps to contain code from designated adversary nations like China and Russia represents an unacceptable vulnerability requiring immediate restrictions on military app use and stricter security vetting of applications marketed to troops.
The case against
Whilst foreign code presence warrants attention, the study conflates SDK presence with actual national security threats without establishing that adversary governments are actively exfiltrating data from these apps. International software development is standard practice with most SDKs serving legitimate functions; the real solution is rigorous vetting of approved military applications and mandatory disclosure requirements rather than broad restrictions based on developer nationality, which could protect security without unnecessarily limiting military personnel's access to useful services.
Explained simply
Researchers at three American universities have examined hundreds of mobile applications marketed to service members in the United States military and found that many contain software components created by companies based in countries considered adversarial, including China and Russia. These components are often integrated into apps to provide features such as advertising or location tracking, but can potentially be accessed by foreign governments.
The concern is significant because location data from military personnel can reveal where troops are stationed, where they live, and how they move between locations. Intelligence agencies from hostile nations have previously used commercially available location information to identify and target American military personnel in overseas conflict zones, and US Central Command confirmed this occurred in the Middle East earlier this year.
The study identified code from foreign companies in roughly one in eight of the 220 military-focused apps examined, ranging from uniform guides to banking services. A larger proportion of apps—nearly two-thirds—contained tracking code from major technology companies, and many collected or shared more personal information than they disclosed to users, raising broader privacy concerns beyond the foreign code issue.