US Military Apps Contain Chinese and Russian Code: Purdue Study Reveals

Unprecedented analysis of over 220 apps designed for US service members uncovers code from China and Russia

According to a recent study by researchers from Purdue University, the US Military Academy at West Point, and Florida International University, a popular app used by service members to rate living conditions on their own bases includes code from Huawei, the Chinese telecom that US regulators flagged as a national security threat in 2020. Two other apps were built by Russian companies and incorporate the Russian ad service Yandex. The largely unregulated advertising industry that tracks Americans online treats civilians and service members mostly the same, despite evidence that exposure can reveal troop deployments, unit movements, and the routines of personnel within intelligence facilities and hardened shelters where nuclear weapons are believed to be stored. WIRED investigations have previously shown location data harvested from ordinary apps tracing US service members to their homes, their children's schools, and off-base establishments. Experts warn the same data could aid foreign spies in identifying personnel with access to sensitive sites, map when a facility is least guarded, or surface other compromising details.

Pentagon confirms commercial data is being exploited by adversaries to target troops

In April 2026, US Central Command acknowledged in a letter to Senator Ron Wyden that it had received multiple threat reports of adversaries exploiting commercial location data to target or surveil American personnel in the Middle East, where US forces remain locked in a standoff with the Iranian military over the Strait of Hormuz. Lawmakers called it the first official confirmation that troops in an active war zone were being hunted through the data-broker economy, a threat the Pentagon's own contractors and researchers had warned about for nearly a decade. The new study takes a first look at one piece of that exposure: what actually sits inside the apps built and marketed specifically for the military. Joshua Shinkle, a Purdue University PhD researcher and the study's lead author, said: "We are grateful for the opportunity to bring greater attention to these issues. We hope the research helps military-affiliated personnel, developers, and platforms make more informed privacy decisions and encourages continued discussion with developers, platforms, and policymakers about how to address these gaps." This scenario is part of a broader context of increasing Chinese technological influence, as highlighted in our article on China overtaking the West in AI.

64% of military apps contain third-party SDKs, many from adversarial nations

The researchers examined more than 220 such apps, from uniform guides and promotion-exam prep to banking and dating apps, pulled from the Google Play store and military subreddits. Nearly two-thirds, or 64 percent, contained third-party code, known as SDKs: prebuilt software components typically used for analytics and advertising that can also track user behavior, including their locations, and share that information with outside companies. Forty percent of the apps collected or shared more data than they disclosed in their Google or Apple store listings. The most common SDKs came from Google and Facebook, but 76 turned up in all, including code traced back to China, Russia, Israel, India, Germany, and others. Roughly 7 percent of the apps carried third-party code from a nation considered adversarial by the Pentagon. Twelve of the apps contained HMS Core, a Huawei software kit that advertises the ability to map user locations, deliver ads, and store images and video. Several were built for state National Guard organizations. The researchers observed no data actually going to Huawei servers, but an SDK can be updated remotely at any time. Code that is dormant today can still be spyware tomorrow. In at least one case, the Huawei code arrived without the app's developer's knowledge, smuggled in as a dependency in a commercial notification tool.

Service members unaware of risks, demand in-phone warnings for unknown code

The researchers also surveyed 103 military-affiliated Americans about the data practices they encountered on their own phones. More than 83 percent used at least one app engaging in data practices they said made them uncomfortable. On average, those participants used more than three such apps. Between 76 and 83 percent of participants said they were extremely uncomfortable with apps containing code from China, Russia, Iran, or North Korea, the four nations the Pentagon designates as cyber adversaries. But no user has a straightforward way to know which apps carry such code. Neither Google's Play Store Data Safety section nor Apple's App Store Privacy Labels disclose the country of origin of the software running inside an app. Participants reported being more comfortable with data collection when an app was branded for military use. Meanwhile, nearly two-thirds said they had received little or no institutional guidance on personal app use. Of those who had received some, nearly three-quarters called it inadequate. The Pentagon declined to comment. Asked to weigh potential mitigations, participants ranked in-phone warnings, alerts when foreign or unknown third-party code is present in an installed app, as both the most effective and the most likely for them to support. A federal law restricting data brokers from buying or selling data on military-affiliated personnel, independent audits of app privacy disclosures, and stricter bans on foreign code in military-marketed apps drew nearly identical support.

Source: https://www.wired.com/story/apps-marketed-to-us-troops-are-shipping-chinese-and-russian-code