Pentagon employees are using banned and unauthorised apps to find hookups, watch TikToks, and buy crypto on government phones and devices, according to a new Department of Defence investigation launched over fears surrounding TikTok. The list of what DoD employees are downloading in spite of bans includes dating apps, Chinese drone apps, third-party virtual private networks, cryptocurrency apps, games, and apps related to multi-level marketing schemes.
The Defence Department’s office of the inspector general audited government-issued devices, as well as the policies meant to protect the DoD from unauthorised and potentially dangerous apps. The investigation examined the DoD’s own special app store and found an undisclosed number of unapproved apps, and determined that employees are able to access any apps they want on government devices through the regular app stores available to consumers.
Some of the apps found on employees’ work phones have “known cybersecurity risks, operational security risks, potentially inappropriate content,” according to the inspector general’s report on the investigation released Thursday. In a move that may jeopardize national security more than a lacklustre Tinder date, employees are also using unapproved messaging apps to discuss Controlled Unauthorised Information, the government’s term for sensitive information that’s supposed to be safeguarded with special precautions and shared only in official channels, the report says.
“Personnel are conducting official business on their DoD mobile devices using mobile applications in violation of Federal and DoD electronic messaging and records retention policies,” according to the report. “DoD employees are downloading apps that could pose operational and cybersecurity risks to DoD information and information systems.” The inspector general warns that employees have downloaded apps that “require access to a user’s contact list, location data, and photo library.” All that delicious data could reveal sensitive military information.
The Department of Defence did not immediately respond to a request for comment on how it plans to rectify the problem.
The report is redacted and doesn’t mention the names of any particular apps or the number of apps in question. But the references are easy to interpret.
For example, in a seemingly obvious reference to TikTok, the inspector general writes, “Examples of applications with potentially inappropriate content include applications for the creation of short-form videos.” The military explicitly banned TikTok from government devices in January of 2020.
The report likewise describes two apps from a “Chinese commercial off-the-shelf drone manufacturer,” which is almost certainly DJI, the world leader in commercial drones. The DoD prohibits the use of commercial drones, and DJI’s devices and apps are specifically banned government-wide due to potential security risks and for the company’s alleged support of the Uyghur genocide.
Using Chinese drone apps “appears to be counter to DoD policy and could pose cybersecurity concerns,” the report said.
The use of unapproved third-party VPNs is particularly alarming. Virtual Private Networks are meant to establish a secure connection between your device and the internet by routing all your traffic through an external server which masks the data. However, the company operating the VPN can theoretically intercept all of the information coming to or from your device, which poses a significant risk for federal employees handling sensitive information. The report mentions the use of unauthorised VPNs but doesn’t go into detail about the problem or potential solutions.