Apps for US troops found shipping code from Chinese and Russian firms

A new analysis reveals that more than one in eight mobile applications marketed to U.S. service members contain code developed by companies based in China or Russia, nations the Pentagon classifies as adversaries. The study, conducted by the cybersecurity firm Lookout and the nonprofit Defense Tech and Privacy Institute, examined 1,000 apps specifically designed for military personnel. It found that 13% of these apps included software development kits (SDKs) from firms in China or Russia, potentially exposing sensitive user data to foreign entities.

The affected apps range from fitness trackers and mental health tools to communication platforms, many of which are used on personal smartphones that may also access military networks. The presence of foreign code raises concerns about data privacy and national security, as these SDKs can collect location information, contacts, and other personal data. The Pentagon has long warned about the risks of using apps with Chinese or Russian ties, but this is the first comprehensive audit of the military-focused app ecosystem.

The analysis, released on March 28, 2025, identified specific SDKs from companies such as Baidu, Tencent, and Yandex embedded in the apps. While the study did not find evidence of active data exfiltration, the researchers noted that the potential for surveillance or espionage exists. The findings come amid broader U.S. government efforts to ban TikTok and other Chinese-linked apps from government devices.

Lookout and the Defense Tech and Privacy Institute are now calling for stricter vetting of apps on official military app stores and for service members to be educated about the risks. The Pentagon has not yet commented on the report, but it is expected to review its app approval processes. This development underscores the ongoing challenge of balancing convenience and security in the digital age, especially for those in uniform.