# The BAD APPS Act: What It Actually Does

The BAD APPS Act is about protecting military personnel and operations from foreign mobile apps that could pose security risks. The Department of Defense would create a system to identify and evaluate smartphone and tablet applications from countries considered threats to the United States—particularly apps that could collect sensitive information about military personnel or operations, spread propaganda, or contain malicious software.

Here's what this means in practical terms: The Defense Department would categorize foreign apps by type (social media, shopping, entertainment, health apps, etc.) and then assess each one for potential dangers. They'd look at things like how much personal data the app collects, whether a foreign government has control over it, whether it could be used to influence military personnel in harmful ways, and whether it contains hidden malicious code. The focus is on apps from countries the government considers hostile or engaged in activities that threaten U.S. national security—think apps from China, Russia, Iran, and similar nations that are already restricted under U.S. export rules.

The practical impact would mainly affect active-duty military members and Defense Department employees. The department would issue guidance telling personnel which apps are risky and how to protect themselves. For apps on military-issued devices or apps used near sensitive military facilities, the Defense Department could impose restrictions or bans. However, this wouldn't necessarily mean the apps disappear from the app store or that civilians can't use them—it's specifically about protecting military operations and personnel. The department would update this risk assessment at least once a year as new threats emerge and new apps are created.

BAD APPS Act

Bolstering America's Defenses Against Potentially Perilous Software Act or the BAD APPS ActThis bill requires the Department of Defense (DOD) to create (1) categorical definitions of foreign mobile applications of concern, and (2) a risk framework to assess certain foreign mobile applications for any potential impact on DOD personnel and operations. Generally, the framework must include mobile applications from countries that DOD determines to be engaged in consistent, unauthorized conduct that is detrimental to the national security or foreign policy of the United States.Such framework must incorporate specified considerations, such as the manner and extent of data collection by the application.DOD must issue guidance to all of its personnel incorporating the categories of foreign mobile applications of concern and advising how to mitigate the risks identified by the risk framework with respect to the applications. DOD must also update the categorical definitions and risk framework at least annually.