Thousands of mobile applications in the online stores of Apple and Google contain computer code developed by a technology company, Pushwoosh, which claims to be based in the United States, but is actually russianaccording to an investigation by the agency Reuters.
The Centers for Disease Control and Prevention (CDC), the lead US agency for combating major health threats, said that they had been misled into believing that Pushwoosh was based in the US capital. After learning about his Russian roots through Reutersremoved Pushwoosh’s software from seven publicly available apps, citing security issues.
The US military said it had removed an app containing Pushwoosh code in March for the same reasons. That app was used by soldiers at one of the country’s main combat training bases..
According to company documents publicly registered in Russia and reviewed by ReutersPushwoosh has his headquarters in the Siberian city of Novosibirsk, where it is registered as a software company that is also engaged in data processing. It employs about 40 people and reported revenue of 143,270,000 rubles ($2.4 million) last year. Pushwoosh is registered with the Russian government to pay taxes in Russia.
However, on social media and in US regulatory documents, presents itself as an American companyat various times based in California, Maryland and Washington, D.C., it discovered Reuters.
Pushwoosh provides code and data processing support for software developers, allowing them to profile the internet activity of smartphone app users and send tailored push notifications from Pushwoosh’s servers.
On its website, Pushwoosh states that it does not collect sensitive information, and Reuters has found no evidence that Pushwoosh mishandled user data. Nevertheless, Russian authorities have forced local companies to hand over user data to national security agencies.
Pushwoosh founder Max Konev told Reuters in a September email that the company had not tried to hide its Russian origin. “I am proud to be Russian and I would never hide it.”
He stated that the company “has no relationship with the Russian government” and that it stores its data in the United States and Germany.
However, cybersecurity experts said that storing the data abroad would not stop Russian intelligence agencies from forcing a Russian company to cede access to that data.
Russia, whose ties with the West have soured since its seizure of the Crimean peninsula in 2014 and its invasion of Ukraine this year, is world leader in computer hacking and cyber espionagespying on foreign governments and industries to seek competitive advantages, according to Western authorities.
After what Reuters Raised Pushwoosh’s Russian links to the CDC, the health agency removed the code from its apps because “the company presents a potential security issue,” spokeswoman Kristen Nordlund said.
(With information from Reuters/By James Pearson and Marisa Taylor)