Experts in Washington said on Oct 27 that an Israeli ad tech company, Discover-Tech, heavily targeted Starlink users to spy on them. The firm became the top bidder for ads in over 100 countries. Many companies got rid of the firm after reports showed it used ads to track people.
WASHINGTON, Oct 27 (Reuters) - Experts at a digital defense firm recently found that an Israeli ad tech company was heavily targeting users of Starlink's satellite internet service in a likely effort to spy on them, according to six people familiar with the matter.
Sign up here.
The researchers, who drew on digital advertising data in TrendAI's telemetry for their conclusions, found that Discover-Tech had become one of the world’s leading bidders for ads aimed at Starlink users and that it was the No. 1 bidder on Starlink traffic in more than 100 countries, including several where Starlink itself was banned or restricted. Bidding refers to the complex auction system by which advertisers secure space inside people's browsers and apps.
Finding ways to track Starlink users has become a cottage industry as governments around the world try to get a grip on the spread of satellite internet terminals. Because they route data through SpaceX-operated satellites rather than nationally regulated telecommunications firms, the terminals can sidestep local internet restrictions, communicate in hostile areas or coordinate action across battlefields. Starlink has become a particularly important resource in Ukraine, whose military relies on the service for frontline communications and directing drone strikes.
DISCOVER-TECH ACCUSED OF WIDER SPY EFFORT
The same day that TrendAI published its report on Shadow-Earth-79, Canadian cyber watchdog Citizen Lab and New York advertising technology firm Confiant outed Discover-Tech by name.
Both groups said the Israeli company abused the ad bidding process, which can leak data about internet users back to the bidder.
Over time, bidders can collect that leaked data, collate it and merge it with other information to de-anonymize users, follow them around the web and, in some cases, set them up for targeting with surveillance software.
In response to the investigations, Google, Comcast and other companies said they had removed Discover-Tech from their ad platforms.
At least one big US tech company and one international organization recently launched internal inquiries into whether Discover-Tech's ads targeted their employees, according to one of the people and a seventh person familiar with the matter.
TOP ADVERTISER IN YEMEN, SOUTH SUDAN
TrendAI's report cited suspicious bidding patterns that suggested Shadow-Earth-79 was running "targeting and tracking infrastructure rather than a commercial advertising operation."
In addition to noting the "obvious skew" towards buying ads aimed at Starlink users, the report said that Shadow-Earth-79 was the top buyer of ads in Syria, Libya, Yemen and South Sudan and was the No. 2 ad buyer in Afghanistan even though "the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero." It said the entity won "an implausibly dominant share" of bids in several countries including Hungary, Israel, Egypt, Azerbaijan and Venezuela.
TrendAI researchers were convinced Discover-Tech was behind the suspicious bidding activity and discussed naming the company in TrendAI's report, according to the six people familiar with the matter. But they eventually dropped the idea of publicly attributing the activity to a named company after TrendAI executives raised legal concerns, five of the sources said.
Self-censorship is common in the cybersecurity industry, especially when executives fear that exposing surveillance operations could draw retribution, industry experts say.
Earlier this year, US cybersecurity company Palo Alto stripped explicit references to China from a report on a global cyberespionage campaign even though its researchers were confident the hacking could be pinned on Beijing, Reuters reported at the time. Reuters said the report was watered down over fears that calling out China would cause problems for Palo Alto's operations there, which were already under scrutiny following a Beijing directive ordering domestic companies not to use its products. Palo Alto said the lack of attribution in its report was not correlated with "procurement regulations in China" and that any suggestion otherwise was "speculative and false."
Reporting by Raphael Satter; editing by Chris Sanders and Rod Nickel
Our Standards: The Thomson Reuters Trust Principles., opens new tab
Reporter covering cybersecurity, surveillance, and disinformation for Reuters. Work has included investigations into state-sponsored espionage, deepfake-driven propaganda, and mercenary hacking.