Soldiers with top-secret clearances say they were forced to use an app that could endanger them

Daily News Article   —   Posted on November 14, 2019

(by Alex Horton, The Washington Post) — Soldiers in an intelligence unit with top-secret clearances were ordered by their commander to download an information app, triggering fear their secretive work could be harnessed and exploited by adversary governments, soldiers in the unit told The Washington Post.

Army Col. Deitra Trotter, the commander of Fort Hood’s 504th Military Intelligence Brigade, told her soldiers in late October a new app developed for the unit could provide weather updates, training changes and other logistics. She then told the soldiers to download it onto their personal smartphones, according to the Texas-based soldiers in the unit.

But the soldiers — many of whom have jobs in interrogation, human intelligence and counterintelligence — soon noticed that the app’s terms of service said it could collect substantial amounts of personal data and that the developer has a presence overseas.

That caused widespread concern that a hack could put individuals and missions worldwide at risk, soldiers in the unit said.

“We do top-secret work,” said one noncommissioned officer, who like others spoke on the condition of anonymity out of fear of retribution by their chain of command. “If our personal information is being put out there to a foreign power, what can they get from our brigade?”

Intelligence soldiers specialize in siphoning enemy communications and groom sources to deliver information about their foes, like their location and what weapons or capabilities they may have.

When they deploy, some soldiers grow their hair out and wear civilian clothes to obscure their military roles and don’t disclose their work outside of close family, another noncommissioned officer in the 504th said.

The app’s permissions — which suggested it could pull GPS location data, photos, contacts and even rewrite memory cards — frustrated soldiers who have taken extreme precautions they felt were glossed over by Trotter and other senior leaders.

“Just being in intelligence, we are trained to be extremely paranoid of everything,” the soldier said. “This is serious operational security not being considered.”

The worst-case scenario, he said, was “our cover might be blown.” While the app said permissions could be disabled, the soldiers said there was a failure of confidence it was secure.

Senior leaders checked the phones of subordinates to ensure they had the app installed, soldiers in the unit said. …

The app developer, Straxis LLC, is based in Tulsa but has a subsidiary in southern India. User data wasn’t stored on foreign servers and third parties do not have access to data, a company spokesperson claimed.

Reporters’ questions about security reviews during development, what user data was collected and development costs were referred to the 504th Military Intelligence Brigade, which did not address them or make Colonel Trotter available.

The concern among service members circulated on Reddit and an Army Facebook page…. Soldiers deleted the app in revolt. Trotter called another formation Wednesday to address the controversy, admonishing whomever talked about the issue online, soldiers in the unit said.

The app was later removed from both Apple’s App Store and the Google Play Store.

“We are confident that the appropriate security protocols are in place to protect our Soldiers’ personally identifiable information,” the unit said, calling the app an unclassified communications tool. Straxis, the brigade said, had developed similar apps for other units.

The app was removed for a “preplanned maintenance update” and will return to the app stores, the unit said, although it did not explain the timing of the removal right after the outcry within the unit.

On Wednesday, the brigade said the soldiers had no “formal obligation” to download the app.

A day later, it reversed course, conceding the app was originally “mandatory,” but following “further discussion and feedback” from unit soldiers, the brigade decided it would only “highly encourage” use of the app.

The soldiers also were frustrated over the legal review of an order to install an app on personal smartphones. Trotter told the soldiers it was approved by Army attorneys, they said, but it was unclear to soldiers if Trotter could mandate an app on their privately owned devices. …

The military has recently blundered in cyberspace, including an issue where troops with fitness apps unwittingly broadcast location data at secret bases worldwide.

And between July 2017 and January 2018, the Army accidentally emailed spreadsheets containing sensitive information about immigrant recruits from China and Russia to some recruits themselves.

Published at washingtonpost .com on November, 2019. Reprinted here for educational purposes only. May not be reproduced on other websites without permission from The Washington Post.