Every day, companies like Google and Apple wage a constant battle to keep malicious apps out of their marketplaces and off people's phones. And while they do catch a lot of malware before it does any damage, there are always a few nasty infiltrators that manage to sneak by and end up getting downloaded by thousands of consumers. No one wants these mistakes to happen, but when you're a crucial app store for the Department of Defense, these mistakes can't happen.

That was the problem facing the National Geospatial-Intelligence Agency as it set about creating a flexible yet ultrasecure app store in 2012. NGA is a combat support organization that primarily assesses and distributes geospatial intelligence. The agency wanted to provide sensitive and mission-critical apps to groups across the DOD through a platform that had the security and resilience of a government defense product, while also offering a streamlined, up-to-date user experience similar to ubiquitous commercial app stores.

"We recognized that we did not know everything when it came to apps, and we wanted to be using the innovation that was happening in the commercial sector," says Joedy Saffel, division chief and source director of NGA who has worked on the GEOINT App Store from the beginning. "But how do we do that in a safe, secure manner? How do we do that from a contractual perspective? And how do we do that in a way that nontraditional vendors will trust doing business with the government? It was a great challenge."

The key, Saffel says, is getting developers to agree to hand over the source code of their apps for in-depth analysis and review. Whether an app is a simple time/speed/distance calculator for a pilot or a hyper-specialized classified tool, sharing source code is a big risk for developers, because it means trusting third parties with the core intellectual property they have built their businesses on. But NGA soon realized that full access was the only way its project could work.

So NGA's GEOINT App Store runs its security protections and screening processes in a way a commercial platform never could.

Need To Know

You can browse through the GEOINT App Store yourself today and see many of the mapping, aeronautical, weather-forecasting, location-sharing, and travel-alert services that it hosts for Android, iOS, desktop, and web. But that's just the public unclassified section—one crucial aspect of designing the platform was building segmentation controls so DOD employees with different levels of clearance, or simply different needs, could have gated access to different apps.

"We built the App Store to be a completely unclassified environment that's open to the public," says Ben Foster, a technical director at NGA who is the product manager for the app store. "But it also has identity management that uses a federated approach to authentication. It's even flexible enough to integrate with other identity-management platforms across DOD. If a user is a helicopter pilot, they might see and get different apps then someone who is a tactical operator in the Army."

This system also works with the platform's pricing variations: Some apps are free to everyone, some downloads come with a fee that needs to be taken out of a particular department's budget, and some apps are licensed by NGA or another agency.

The most radical part of the GEOINT App Store from a government perspective is the speed with which NGA can process apps and get them live in the store. In general, government acquisition processes take many months or years, a clear problem when it comes to constantly evolving software. So NGA worked with its chief information officer, IT Directorate, legal team, international affairs division, and contracting office to establish a streamlined app-vetting process that would be acceptable under federal acquisition regulations. The agency also contracted with a private firm called Engility to directly manage the outreach, acquisition, and development environment for customizing prospective apps to NGA's requirements. The process, known as the Innovative GEOINT Application Provider Program, or IGAPP, minimizes bureaucratic hurdles and guides developers who want to submit an app through a pipeline that vets, modifies, and generally grooms apps for NGA's store.