Just what the Navy needs, more hyper bureaucracy for some weak attempt at security.
Then they use Google Chrome and hit a phishing-hole site and get their phone owned. But don't worry, they weren't allowed to install Netflix!
The problem here is open-source intelligence because TikTok is very popular among young members who spend all their free time in their bunk on their phone. Limiting the apps might help with that, but I'm highly skeptical. There's already plenty of restrictions on social media use for armed-forces members. I believe that path is the way to go - create restrictions on posting personal information.
Having some paper pusher unit pre-approving millions of potential apps sounds like a giant waste of time. It makes a lot more sense to react to bad stuff (like one-off reactions for a massively popular video sharing app with sketchy Chinese ownership) than pre-emptively ban everything, simply because it won't do much for security beyond what Apple and Google are already doing in the app store.
There's millions of apps and tons come out every year. This nation-wide 'unit' will have to be constantly 'measuring them for security'. This isn't going to accomplish much of anything.
Either have a secure phone with pre-installed apps (ie, just a browser plus encrypted phone/messenger, military mapping tools, etc) and let them install nothing (which means they'll just use their private phone any way for the OPSEC fail stuff). Or let them do whatever and selectively ban the ones like TikTok which are massive surveillance potential just based on its popularity alone. These one-off or watching for bad-stuff and react approach makes far more sense to me.
It doesn't matter if it's a laptop or a phone, you should only be using it for work.
Technology is much cheaper than it was 20 years ago. If you're not willing to purchase your own phone or laptop to do what you personally want to do with a device, you're likely not good at budgeting or decision making.
The question then becomes, which error state is more acceptable for the organization? A system that occasionally misses malicious apps? Or a system that occasionally blocks a non-malicious app?
The meta[1] is more real than most probably realize.