FBI calls FaceApp a 'potential counterintelligence threat' from Russia

FaceApp might have been all fun and games for celebrities, but for the FBI, it's considering the Russia-based app as a potential national security threat. 

In a Nov. 25 letter to Sen. Chuck Schumer, a Democrat from New York, FBI assistant director Jill Tyson said that the agency is investigating FaceApp over its ties to Russia. The app, which takes photos and adds effects that can make people look older or add a smile to their pictures, is based in Russia. 

"The FBI considers any mobile application or similar product developed in Russia, such as FaceApp, to be a potential counterintelligence threat, based on the data the product collects, its privacy and terms of use policies, and the legal mechanisms available to the Government of Russia that permit access to data within Russia's borders," Tyson wrote in the letter.

The FBI's answers came as a response to a letter Schumer sent July 17, when FaceApp was at its height of popularity. FaceApp became part of a viral challenge as celebrities like the Jonas Brothers and LeBron James were using its filters to digitally age themselves.

Skeptics raised concerns with FaceApp after looking closely at its terms of service and finding that the privacy policy allowed for the app's developers to get permanent rights to people's images, as well as provide the data to advertisers. 

Will Strafach, CEO of Guardian, a mobile security company, first analyzed the app in July and raised concerns with the FBI's assessment. 

"We have observed no evidence of malicious behavior in FaceApp, only sloppy development practices which have been somewhat addressed with a pop up dialog," Strafach said. "There is no evidence of a foreign intelligence threat, and claims like this from the FBI are quite unfair to overseas developers."

The FBI declined to comment. 

While security researchers didn't find nefarious activities going on with FaceApp, the FBI has more concerns about the app's origins than the software itself. In its letter, the FBI didn't cite or provide any evidence of spying or election tampering from FaceApp.   

Russia's data retention laws allow the nation's government to request data on Russian citizens from companies operating within its borders. The FBI noted Russia's System of Operative Search Measures, which allows for its intelligence agencies to get records of communications from internet service providers. 

It also raised potential concerns of disinformation from FaceApp, as the app collected people's images, which could be used for manipulation. Russia played a major role in the 2016 US presidential election for its disinformation campaign, and US officials worry that it will ramp up during the election in 2020.  

FaceApp didn't immediately respond to a request for comment. 

The company has denied its ties to the Russian government on multiple occasions, writing that it deletes images from its servers in 48 hours and that its users' data is not stored in the country.  

"If the FBI assesses that elected officials, candidates, political campaigns, or political parties are targets of foreign influence operations involving FaceApp, the FBI would coordinate notifications, investigation and engage the Foreign Influence Task Force, as appropriate," Tyson said in the letter.

Originally published at 1:45 p.m. PT. 
Updated at 4:08 p.m. PT: To include a response from the FBI and security expert's comment.