The FBI is treating any mobile app that comes out of Russia as a “potential counterintelligence threat,” the U.S.’s top law enforcement agency said in a letter to Senate Democratic leader Chuck Schumer.
The Federal Bureau of Investigation’s concern arises in part from “the legal mechanisms available to the Government of Russia that permit access to data” in the country, according to the letter, which Schumer’s office released Monday.
The FBI said its concerns extend to FaceApp, which grew popular earlier this year by allowing users to change ages and genders in photographic portraits. In July, Schumer had asked the FBI and Federal Trade Commission to look into the national security and privacy implications of the app, which was developed by Russian-based Wireless Lab.
This year, Russia passed a law backed by President Vladimir Putin calling for a “sovereign internet” that routes traffic through domestic servers.
Russia has also required internet firms since 2015 to store the personal data of Russian users inside the country, and its security services have the power to demand social media companies provide access to users’ online data.
Remote Access
“Russia’s intelligence services maintain robust cyber exploitation capabilities,” the FBI said, adding that authorities there “can remotely access all communications and servers on Russian networks” without requests to internet providers.
FaceApp didn’t immediately respond to a request for comment sent to a general inbox. The app said it uploads users’ photos to servers in the U.S., Singapore, Ireland and Australia and “removes most photos from its servers 48 hours after submission,” according to the FBI.
When using services like FaceApp, people reveal a lot about themselves, including biometric data, said Jim Baker, a former general counsel to the FBI.
People “are giving up a lot of information that could be useful to a foreign government if they want to target you or someone in the social network around you,” said Baker, who is now director of national security and cybersecurity at the Washington-based R Street Institute.
More must-read stories from Fortune:
—These are the jobs artificial intelligence will eliminate by 2030
—2020 Crystal Ball: Predictions for the economy, politics, technology, and more
—Separated by 15 minutes and a great firewall: Hong Kong and Shenzhen are drifting apart
—How robots are changing the construction industry
—What makes people choose Waze over Google Maps? Its army of unpaid human editors
Catch up withData Sheet, Fortune’s daily digest on the business of tech.