The Centers for Disease Control and Prevention , the United States’ main agency for fighting major health threats, said it had been deceived into believing Pushwoosh was based in the US capital. After learning about its Russian roots from Reuters, it removed Pushwoosh software from seven public-facing apps, citing security concerns.
Pushwoosh provides code and data processing support for software developers, enabling them to profile the online activity of smartphone app users and send tailor-made push notifications from Pushwoosh servers. Cybersecurity experts said storing data overseas would not prevent Russian intelligence agencies from compelling a Russian firm to cede access to that data, however.
Washington could choose to impose sanctions on Pushwoosh and has broad authority to do so, sanctions experts said, including possibly through a 2021 executive order that gives the United States the ability to target Russia’s technology sector over malicious cyber activity. Google said privacy was a “huge focus” for the company but did not respond to requests for comment about Pushwoosh. Apple said it takes user trust and safety seriously but similarly declined to answer questions.
The CDC apps that contained Pushwoosh code included the agency’s main app and others set up to share information on a wide range of health concerns. One was for doctors treating sexually transmitted diseases. While the CDC also used the company’s notifications for health matters such as COVID, the agency said it “did not share user data with Pushwoosh.”
Some large companies and organizations including UEFA and Unilever said third parties set up the apps for them, or they thought they were hiring a US company. Roskomnadzor, Russia’s state communications regulator, did not respond to a request from Reuters for comment.In US regulatory filings and on social media, Pushwoosh never mentions its Russian links. The company lists “Washington, DC” as its location on Twitter and claims its office address as a house in the suburb of Kensington, Maryland, according to its latest US corporation filings submitted to Delaware’s secretary of state.