Apps targeted at US troops contain Chinese and Russian code
Apps targeted at US troops contain Chinese and Russian code
针对美军的应用程序包含中国和俄罗斯代码
A recent examination of hundreds of mobile apps marketed toward US military personnel found more than one in eight contained software built by companies in China, Russia, or other foreign nations, raising fresh concerns that adversary governments could harvest data revealing where service members live, work, and deploy.
最近一项针对数百款面向美军人员营销的移动应用程序的调查发现，超过八分之一的应用程序包含由中国、俄罗斯或其他外国公司开发的软件，这引发了人们的新担忧：敌对国家政府可能会收集数据，从而暴露军人的居住地、工作地点和部署位置。
According to researchers at Purdue University, the US Military Academy at West Point, and Florida International University, one popular app used by service members to rate living conditions on their own bases include code from Huawei, the Chinese telecom that US regulators flagged as a national security threat in 2020. Two others were built by Russian companies and incorporate the Russian ad service Yandex.
据普渡大学、西点军校和佛罗里达国际大学的研究人员称，一款受军人欢迎、用于评估基地生活条件的应用程序中，包含了华为的代码。华为这家中国电信公司曾在2020年被美国监管机构列为国家安全威胁。另外两款应用程序由俄罗斯公司开发，并集成了俄罗斯广告服务商 Yandex 的代码。
The largely unregulated advertising industry that tracks Americans online treats civilians and service members mostly the same—unless there is profit in telling them apart—despite evidence that exposure can reveal troop deployments, unit movements, and the routines of personnel within intelligence facilities and hardened shelters where nuclear weapons are believed to be stored.
尽管有证据表明，数据泄露可能暴露部队部署、单位调动以及情报设施和据信存放核武器的加固掩体中人员的日常活动，但在线追踪美国人的广告行业在很大程度上仍处于监管真空状态。除非区分平民和军人有利可图，否则该行业对两者的处理方式基本相同。
WIRED investigations have previously shown location data harvested from ordinary apps tracing US service members to their homes, their children’s schools, and off-base establishments where troops are prohibited from being seen. Experts have warned the same data could aid foreign spies in identifying personnel with access to sensitive sites, map when a facility is least guarded, or surface other compromising details.
《连线》（WIRED）此前的调查显示，从普通应用程序中收集的位置数据可以追踪到美军人员的住所、子女学校以及禁止军人出入的基地外场所。专家警告称，同样的数据可能帮助外国间谍识别能够进入敏感地点的人员，绘制设施防守最薄弱的时间点，或挖掘其他可能造成损害的细节。
The stakes are no longer hypothetical. In April, US Central Command acknowledged in a letter to Senator Ron Wyden that it had received multiple threat reports of adversaries exploiting commercial location data to target or surveil American personnel in the Middle East, where US forces remain locked in a standoff with the Iranian military over the Strait of Hormuz.
风险已不再是假设。今年4月，美国中央司令部在致参议员罗恩·怀登（Ron Wyden）的一封信中承认，已收到多份威胁报告，称敌对势力正在利用商业位置数据，在中东地区针对或监视美国人员。目前，美军在中东地区因霍尔木兹海峡问题与伊朗军队处于对峙状态。
Lawmakers called it the first official confirmation that troops in an active war zone were being hunted through the data-broker economy—a threat the Pentagon’s own contractors and researchers had warned about for nearly a decade. The new study takes a first look at one piece of that exposure: what actually sits inside the apps built and marketed specifically for the military.
立法者称这是首次官方确认：处于活跃战区的部队正通过数据经纪人经济被“猎杀”——五角大楼自己的承包商和研究人员近十年来一直对此发出警告。这项新研究首次审视了这种风险的一个侧面：专门为军队开发和营销的应用程序内部究竟隐藏着什么。
“We are grateful for the opportunity to bring greater attention to these issues,” says Joshua Shinkle, a Purdue University PhD researcher and the study’s lead author. “We hope the research helps military-affiliated personnel, developers, and platforms make more informed privacy decisions and encourages continued discussion with developers, platforms, and policymakers about how to address these gaps.”
“我们很感激有机会让人们更加关注这些问题，”普渡大学博士研究员、该研究的主要作者约书亚·辛克尔（Joshua Shinkle）表示，“我们希望这项研究能帮助军方相关人员、开发者和平台做出更明智的隐私决策，并鼓励与开发者、平台和政策制定者持续讨论如何弥补这些漏洞。”
The researchers examined more than 220 such apps—from uniform guides and promotion-exam prep to banking and dating apps—pulled from the Google Play store and military subreddits. Nearly two-thirds—or 64 percent—contained third-party code, known as SDKs: prebuilt software components, typically used for analytics and advertising, that can also track user behavior, including their locations, and share that information with outside companies.
研究人员从谷歌应用商店（Google Play）和军事相关的 Reddit 子版块中提取了超过220款此类应用程序进行检查，涵盖了制服指南、晋升考试准备、银行和约会软件等。近三分之二（即64%）的应用程序包含第三方代码，即 SDK（软件开发工具包）：这是一种预构建的软件组件，通常用于分析和广告，但也能够追踪用户行为（包括位置信息）并与外部公司共享这些信息。
Forty percent of the apps collected or shared more data than they disclosed in their Google or Apple store listings, the researchers found. The most common SDKs came from Google and Facebook, the two companies that dominate US digital advertising. But 76 turned up in all, including code traced back to China, Russia, Israel, India, Germany, and others.
研究人员发现，40%的应用程序收集或共享的数据超出了它们在谷歌或苹果应用商店列表中的披露范围。最常见的 SDK 来自谷歌和 Facebook，这两家公司主导了美国的数字广告市场。但总共发现了76种 SDK，其中包括可追溯到中国、俄罗斯、以色列、印度、德国等地的代码。
Roughly 7 percent of the apps carried third-party code from a nation considered adversarial by the Pentagon. Twelve of the apps contained HMS Core, a Huawei software kit that advertises the ability to map user locations, deliver ads, and store images and video. Several were built for state National Guard organizations.
约7%的应用程序携带了来自五角大楼视为敌对国家的第三方代码。其中12款应用程序包含华为的 HMS Core 软件套件，该套件宣称具备定位用户、投放广告以及存储图像和视频的功能。其中几款应用程序是为州国民警卫队组织开发的。
The researchers observed no data actually going to Huawei servers. But an SDK can be updated remotely at any time. Code that is dormant today can still be spyware tomorrow. In at least one case, noted by the study, the Huawei code arrived without the app’s developer’s knowledge, smuggled in as a dependency in a commercial notification tool.
研究人员并未观察到数据实际流向华为服务器。但 SDK 可以随时远程更新。今天处于休眠状态的代码明天可能就会变成间谍软件。研究指出，至少有一个案例显示，华为代码是在应用程序开发者不知情的情况下，作为商业通知工具的依赖项被“偷运”进来的。
The researchers also surveyed 103 military-affiliated Americans—active-duty service members, reservists, veterans, DoD civilians, and their families—about the data practices they encountered on their own phones. More than 83 percent used at least one app engaging in data practices they said made them uncomfortable. On average, those participants used more than three such apps.
研究人员还调查了103名与军队有关的美国人（包括现役军人、预备役人员、退伍军人、国防部文职人员及其家属），了解他们在手机上遇到的数据处理行为。超过83%的人至少使用过一款让他们感到不安的应用程序。平均而言，这些参与者使用了超过三款此类应用程序。
Between 76 and 83 percent of participants said they were extremely uncomfortable with apps containing code from China, Russia, Iran, or North Korea—the four nations the Pentagon designates as cyber adversaries. But no user has a straightforward way to know which apps carry such code. Neither Google’s Play Store Data Safety section nor Apple’s App Store Privacy Labels disclose the country of origin of the software running inside an app.
76%到83%的参与者表示，对于包含来自中国、俄罗斯、伊朗或朝鲜（五角大楼指定的四个网络敌对国家）代码的应用程序，他们感到极度不安。但用户没有直接的方法来判断哪些应用程序携带此类代码。无论是谷歌应用商店的“数据安全”部分，还是苹果应用商店的“隐私标签”，都不会披露应用程序内部运行软件的来源国。
Participants reported being more comfortable with data collection when an app was branded for military use. Meanwhile, nearly two-thirds said they had received little or no institutional guidance on personal app use. Of those who had received some, nearly three-quarters called it inadequate. The Pentagon declined to comment.
参与者表示，如果应用程序标明为军事用途，他们对数据收集的接受度会更高。与此同时，近三分之二的人表示，他们几乎没有收到关于个人使用应用程序的机构指导。在收到过指导的人中，近四分之三的人认为指导力度不足。五角大楼拒绝置评。
Asked to weigh potential mitigations, participants ranked in-phone warnings—alerts when foreign or unknown third-party code is present in an installed app—as both the most effective and the most likely for them to support. A federal law restricting data brokers from buying or selling data on military-affiliated personnel, independent audits of app privacy disclosures, and stricter bans on foreign code in military-marketed apps drew nearly identical support.
在被问及潜在的缓解措施时，参与者认为“手机内警告”（即当已安装的应用程序中存在外国或未知的第三方代码时发出提醒）既最有效，也是他们最支持的方案。限制数据经纪人买卖军方相关人员数据的联邦法律、对应用程序隐私披露进行独立审计，以及对军事营销应用程序中外国代码的更严格禁令，也获得了几乎相同的支持。