Military apps laced with Chinese and Russian code pose surveillance risk to US troops

A collaborative study by academics at Purdue University, West Point, and Florida International University uncovered a troubling pattern: over one in eight mobile applications marketed to US military personnel incorporate software components developed by entities based in China, Russia, or other foreign adversaries. The discovery raises alarms about potential surveillance capabilities that could expose sensitive information about where troops are stationed, deployed, and living.

Foreign Code Embedded in Popular Military Apps#

The investigation identified specific vulnerabilities within apps designed for servicemembers. One widely used application that allows troops to evaluate conditions at their own military bases includes code from Huawei, the Chinese telecommunications company that US regulators designated as a national security concern in 2020. Separately, two additional apps contain Russian-developed components, including integration with Yandex, a prominent Russian advertising service.

The Broader Data Vulnerability#

The advertising technology ecosystem operating across the US remains largely unregulated and typically tracks civilians and military personnel using identical methods—unless there is commercial incentive to distinguish between them. However, security researchers have documented repeated instances where location data extracted from ordinary consumer applications has been traced to service members at their homes, their families' schools, and off-base locations where military regulations prohibit personnel from being present.

Experts caution that adversarial nations could weaponize this data in multiple ways: to identify troops with access to critical installations, to map security gaps when facilities are minimally staffed, or to uncover other compromising personal details that could facilitate recruitment or blackmail.

Real-World Threats Confirmed#

The risk is no longer theoretical. In April, US Central Command formally acknowledged receiving multiple intelligence reports indicating that foreign adversaries have actively leveraged commercially available location data to track and surveil American military personnel stationed in the Middle East, where the US maintains a tense military posture against Iran near the Strait of Hormuz. This marked the first official Pentagon admission that troops operating in active conflict zones were being targeted through the data-broker marketplace—a danger that the Department of Defense's own research teams and contractors had warned about for years.