Third-Party SDKs Raise Privacy Questions for Apps Marketed to U.S. Military

Researchers from Purdue, West Point, and Florida International University analyzed over 220 Android apps marketed to U.S. military personnel and found that more than one in eight contained third-party SDKs from companies based in China or Russia. While the study found no evidence these SDKs were currently exfiltrating data, it discovered that 40% of apps collected or shared more user data than their developers disclosed and warned that SDKs can be updated post-release, creating a software supply-chain and privacy risk that organizations and users may not fully appreciate.