GoKawiilBrady Snyder / Android Authority
TL;DR The Department of Homeland Security has told employees that The White House app will be automatically installed on official devices.
The app has several security and privacy issues, and uses third-party code.
It was also automatically installed on FAA-issued devices last month.
When The White House launched its eponymous app a few months ago, it was clear that there was barely any reason to install it at all. It’s a simple wrapper for The White House website, and most of the displayed information is already available from other sources. However, the US government clearly considers it useful enough to automatically install it on government devices.
According to an email sent to Department of Homeland Security (DHS) employees and seen by Politico, The White House app will be automatically installed on all government devices (via Gizmodo).
The app itself may not offer much in the way of exclusive features, but the email reportedly called it “a convenient way to access official White House communications, including announcements, executive actions, speeches, livestreams, videos, and other updates.”
If you’re wondering why it’s a big deal that the device will be installed on DHS employees’ official smartphones, the answer lies in security and privacy. There are well-documented problems with the app’s security practices, including code being loaded from third-party repositories.
It’s also reportedly using code from Elfsight, a Russia-founded software kit company. Sure, the White House claims that “Elfsight went through a full security review by White House IT and was approved for use,” but it’s still a surprising choice for an official US government app. In fact, it was reported that Elfsight made some White House staffers’ personal information public. The White House called it a “vulnerability on Elfsight’s side.”
The problems with the app don’t end here, either. Aside from the security implications of using an app that foregoes certified cloud services on government employee devices, the app is also a data and privacy nightmare for regular users. The app reportedly shares data such as a user’s time zone, IP address, phone model, and more, with third-party services.
... continue reading