The White House App Has Huawei Spyware and an ICE Tip Line

Closeup of a hand holding a smartphone with a dark screen — Photo via Unsplash

TL;DR: The official White House app, launched in late March 2026 and downloaded 700,000 times in its first week, contains a sanctioned Huawei SDK that phones home to Chinese servers, six widgets from Russian-founded Elfsight with live JavaScript injection capability, an anonymous ICE tip line, and a "Text the President" feature that harvests phone numbers. The app's Apple privacy manifest declares zero data collection while actually transmitting nine distinct data categories. It was built by 45Press, an Ohio WordPress development company, for $1.4 million, with no code obfuscation, no certificate pinning, and no jailbreak detection. The same government that banned Huawei from federal networks put Huawei inside its own app.

The Government That Banned Huawei Is Running Huawei Code

Let's start with the part that should make your jaw hit the floor.

The Trump administration's White House app contains the Huawei Mobile Services Core SDK. Confirmed by Exodus Privacy analysis and independently verified by security researcher Sam Bent ^[1][2]. Huawei: the Chinese telecom giant that the U.S. government has sanctioned, banned from federal networks, and spent years warning allies is a national security threat.

The Huawei analytics kit collects device information, app usage data, and behavioral metrics. It maintains a persistent connection to Huawei servers ^[1]. Every time someone opens the White House app, data flows back to infrastructure controlled by a company the U.S. government itself designated as a threat to national security.

700,000 people downloaded this app in its first week. It ranked #3 among iOS news apps ^[3]. That's 700,000 Americans whose device data is being collected by a sanctioned Chinese company through an app with the presidential seal on it.

OneSignal: 10 Tracking Frameworks, Every Single Launch

Huawei is the headline, but OneSignal is the workhorse. The app ships with 10 OneSignal frameworks totaling roughly 2.4 megabytes of tracking code ^[4].

Every time you open the app, OneSignal transmits your full IP address, timezone, country, device model, OS version, session count and duration, a persistent unique identifier, network type, carrier info, jailbreak status, and your APNS push token. That's on every single launch ^[4].

It gets worse. The OneSignal integration includes OneSignalLocation.framework with GPS capabilities. The system fires 24+ distinct server request types. And here's the part that kills any argument about user consent: OneSignal's remote parameter control can override local privacy settings without pushing an app update ^[4]. They can flip switches on the server side, and your phone obeys.

Version 47.0.0 of the app requested always-on background location access. Version 47.0.4 downgraded this and added text reading "This app does not use your location," but the GPS infrastructure remains compiled into the binary ^[4][5]. They removed the permission prompt. They didn't remove the code.

Russian Widgets Running Live JavaScript on a Government App

Six Elfsight widgets are embedded in the White House app. Elfsight is a Russia-founded company ^[4].

Each widget uses a two-stage loader that pulls and executes JavaScript from Elfsight's servers in real time. No Subresource Integrity validation. That means Elfsight (or anyone who compromises Elfsight) can inject arbitrary scripts into the White House app at any time, without any code review or approval process ^[4].

The Elfsight integration also exposed personal information of White House staffers through the app ^[4]. So it's not just a theoretical attack surface. It already leaked data.

Oh, and version 47.0.0 contained JavaScript code that actively stripped consent banners and GDPR notices. That code was removed in 47.0.4 ^[4]. Someone wrote code to hide privacy controls. Then someone else quietly deleted it.

The ICE Snitch Button

Built right into the White House app: an anonymous tip line for reporting people to Immigration and Customs Enforcement ^[1][2].

This isn't buried in settings. It's a feature. Download the president's app, report your neighbor. The same app that harvests your device data, tracks your location, and sends analytics to Huawei also wants you to turn in immigrants.

There's also a "Text the President" feature that collects user names and phone numbers. It auto-populates the message field with "Greatest President Ever!" ^[2][3]. They built a surveillance sandwich and told you it was a news app.

A Blank Privacy Manifest While Collecting Everything

Apple requires apps to declare what data they collect through a privacy manifest. The White House app's manifest reads: NSPrivacyCollectedDataTypes: []. An empty array. Nothing. Zero ^[4].

The app actually transmits nine distinct data categories ^[4]. That's not an oversight. That's a false declaration submitted to Apple's App Store.

The app also isn't using FedRAMP or GovCloud certified services ^[4]. For an application representing the White House, handling data from hundreds of thousands of American citizens, none of the standard federal security certifications apply.

$1.4 Million to a WordPress Shop

Who built this? 45Press, an Ohio-based WordPress development company. They received a $1.4 million contract awarded on February 6, 2026 ^[3][5].

Security researcher analysis found: no code obfuscation, no certificate pinning, no jailbreak detection, no anti-tampering measures, and no app attestation ^[4]. These are basic security practices for any consumer app. For a government app handling citizen data, their absence is negligent.

One version of the app loaded a YouTube player from a personal GitHub Pages site ^[4]. Not a government server. Not a CDN. Someone's personal GitHub. (This was fixed in v47.0.4.)

Philip Fields, a former FBI intelligence analyst, put it plainly: "An amateur WordPress developer running the White House's public presence puts everybody who visits it at risk" ^[5].

What You Should Do Right Now

Delete the App

If you downloaded the White House app, delete it. The GPS infrastructure is compiled into the binary regardless of what the permissions screen says. Uninstalling is the only way to stop data collection.

Check Your Data Exposure

If you used the "Text the President" feature, your name and phone number are in a database with zero federal security certification. Consider that information compromised.

Review App Permissions

Go to Settings > Privacy on your phone. Check which apps have location access, especially "Always" permission. No news app needs your GPS coordinates at 3 AM.

Use Official .gov Websites Instead

If you need White House information, use whitehouse.gov in a browser with an ad blocker. At least your browser extensions can block some tracking. The app gives you no such option.

The Pattern Is the Point

This isn't an isolated screw-up. It's part of a pattern: an administration that treats citizen data as a resource to be harvested, not a right to be protected.

DOGE has been accessing Social Security records on thumb drives and building a cross-agency master database of Americans' records. ICE is monitoring 8 billion social media posts daily. DHS is subpoenaing social media platforms for the names of ICE critics. And now the official White House app sends your data to a sanctioned Chinese company, runs JavaScript from a Russian-founded firm, and includes a button to report people to immigration enforcement.

The same government that spent years telling you Huawei was too dangerous for American networks put Huawei inside the app with the presidential seal. Either they didn't check, or they didn't care. Both answers are damning.