Purdue research earns 2026 Andreas Pfitzmann Best Student Paper Award at PETS

09-16-2026

Joshua Shinkle, Ph.D. student in the Department of Computer Science

Mobile apps marketed specifically to military-affiliated users can create privacy and security risks that extend beyond individual users, according to a study led by Purdue Ph.D. student Joshua Shinkle.

The research received the Andreas Pfitzmann Best Student Paper Award at the Privacy Enhancing Technologies Symposium (PETS), a leading conference in privacy research. The award recognizes research judged to be both scientifically rigorous and significant to the privacy field.

The study was led by Purdue Ph.D. student Joshua Shinkle. The team included Purdue Ph.D. student Chandrika Mukherjee; Purdue professors Abdullah Imran, Antonio Bianchi and Z. Berkay Celik from Purdue University; Arjun Arunasalam of Florida International University; Donna Artusy of the Army Cyber Institute; and Professor Alexander Master of the United States Military Academy. The research was conducted in part through Purdue’s PurSec Lab.

The researchers examined the data practices and third-party software used by mobile apps marketed to military-affiliated users and surveyed 103 military-affiliated participants to understand their perceptions of privacy and security.

According to the study, 64% of the military-marketed apps studied contained at least one third-party software library, primarily for analytics and advertising. These libraries can introduce additional code and data-sharing relationships that may not be apparent to users.

In one instance, a third-party library used to enable push notifications introduced foreign-developed code into an app without the developer’s knowledge. The case illustrates how software supply-chain risks can go undetected, even when developers act in good faith. After the research team responsibly disclosed the finding, the developer re-engineered the app’s notification system to remove the code.

Uncovering broader security concerns

The user study revealed a gap between military-affiliated users’ expectations and the technical practices researchers observed.

83.5% of participants were already using at least one military-marketed app whose data practices they considered inappropriate, with participants using an average of more than three such apps.

Participants were also significantly less comfortable when their data was collected by a foreign or third party than when it was collected by a military-marketed app. Researchers said the findings suggest that an app’s military-oriented branding may create a level of trust that is not always supported by its underlying technology.

Participants identified risks extending beyond individual privacy. Among those surveyed:

• 91% identified personal safety as a potential risk.
• 77% identified operational and unit security.
• 67% identified national security.

The team said the findings demonstrate that mobile app data can have particularly serious consequences for military-affiliated users.

The study was motivated in part by the 2018 Strava incident, when a public heatmap of user activity revealed patterns that could expose the locations and patrol routes of service members at forward operating bases.

Identifying potential protections

The team also proposed seven potential mitigations based on the technical findings and asked participants to rate their effectiveness.

The four highest-rated measures were an in-phone warning when an app contains foreign or unknown third-party code; federal restrictions on data brokers buying and selling military-affiliated data; federal requirements for independent audits of privacy disclosures; and stricter restrictions on foreign code in military-marketed apps.

The findings indicate that military-affiliated users favor systemic protections rather than relying solely on individuals to identify and manage privacy and security risks.

Next steps

The team has proposed future work to investigate how aware mobile app developers are of the third-party code incorporated into their applications and the development of tools to help developers better understand their software supply chains.

One potential direction is a software bill of materials (SBOM) for mobile apps, which could provide developers with a clearer record of the components and third-party code included in their applications.

The research underscores the importance of looking beyond an app’s intended purpose to understand how it handles the data entrusted to it.