Staff Reports
The fuss over the White House app has been loud, messy, and, frankly, predictable. Left‑wing commentators were quick to call it “spyware” and claim the app secretly tracks your every move. But a top mobile security firm’s hands‑on testing tells a different story. The real news is not the clicks and shrieks from the media choir — it’s the technical finding that the app, as tested, did not transmit users’ GPS location.
NowSecure’s dynamic test undercuts the “spyware” claim
Independent firm NowSecure ran the app on real devices and watched its network traffic. Their report found no evidence the White House app collected or sent location data. That matters. Static code scans can show what an app could do. Dynamic testing shows what the app actually did. NowSecure’s hands‑on work showed the app behaved like most modern apps and did not secretly beam your location to third parties.
Static code vs. real behavior: the OneSignal wrinkle
Yes, decompilers and watchdogs did find location code bundled in a third‑party SDK called OneSignal. That’s a real technical point and not something to wave away. But “code exists” is not the same as “code is running.” The OneSignal SDK can be configured remotely, which explains why security folks flagged it. The practical reality, though, is that testers who watched the app run did not see GPS coordinates being sent. The app was updated after the scrutiny, and some permission strings were changed — sensible fixes, not proof of a conspiracy.
Politics, panic, and the rush to smear
It’s also impossible to ignore the political theater. President Donald Trump’s administration rolled out its own streaming and pushed downloads, and critics from Governor Gavin Newsom to the cable punditry leapt straight to alarmist headlines. The result was an online witch hunt that mixed real technical warnings with exaggeration. Call out shoddy tech design when it exists, by all means. But calling a federal app “spyware” without proof is exactly the kind of panic the left specializes in when it wants to score clicks.
Here’s the bottom line: people should be skeptical of apps that include third‑party SDKs and remote flags. Developers — especially government ones — should keep dependencies minimal and make permissions crystal clear. But until someone produces a repeatable, public test showing live GPS data being transmitted, the “spyware” label is wrong. The NowSecure test matters and should calm the hyperbole. Still, the administration would do well to prove transparency by publishing a clear privacy manifest and making OneSignal’s configuration public. That would end the circus and restore confidence — which, after all, is the point of an official app meant to reach millions of Americans.
