Security and Privacy Analysis of the White House Android App
A recent technical analysis of the official White House Android app reveals extensive tracking, third-party dependencies, and potential security risks. The app, built with React Native and Expo, uses a Hermes JavaScript engine to execute its core logic. While it primarily serves as a news and content portal, it injects JavaScript into all WebView pages to bypass cookie banners, GDPR consent prompts, login walls, and paywalls. Additionally, the app contains a full GPS tracking system that can poll location data every 4.5 minutes in the foreground and 9.5 minutes in the background, syncing user coordinates and activity to OneSignal’s servers. It also loads third-party scripts from GitHub Pages and Elfsight for video and social media embeds, along with Mailchimp and Uploadcare for email and image handling, none of which are government-controlled infrastructure. The analysis highlights leftover development artifacts, including localhost URLs, developer IPs, and an Expo dev client, indicating production builds were not fully cleaned. Users’ interactions, notifications, and other metadata are extensively tracked via OneSignal, raising privacy concerns. While not necessarily illegal, the app’s design and behavior are unusual for an official government application.