Israeli ad tech firm Discover-Tech heavily targeted Starlink users, researchers say

Right · 2Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, concluded that the Israeli ad tech company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX's Starlink satellite internet service, and that the ads were likely used to geolocate or otherwise surveil them, according to six people familiar with the matter cited by Reuters. 1 2 Right · 2Drawing on digital advertising data in TrendAI's telemetry, the researchers found Discover-Tech had become one of the world's leading bidders for ads aimed at Starlink users, and was the No. 1 bidder on Starlink traffic in more than 100 countries, including several where Starlink itself was banned or restricted. 1 2 Right · 2SpaceX did not respond to requests for comment, and Discover-Tech and its chief executive did not respond over the past two weeks. 1 2

Right · 2TrendAI published a report on 15 October about the targeting of Starlink users but did not name Discover-Tech, referring instead to "an ad tech entity" it called "Shadow-Earth-79", which the six sources said is its codename for Discover-Tech. 1 2 Right · 2The report cited bidding patterns suggesting "targeting and tracking infrastructure rather than a commercial advertising operation", noted an "obvious skew" towards Starlink users, and said Shadow-Earth-79 was the top buyer of ads in Syria, Libya, Yemen and South Sudan and No. 2 in Afghanistan, though "the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero". 1 2 Right · 2It also said the entity won "an implausibly dominant share" of bids in several countries including Hungary, Israel, Egypt, Azerbaijan and Venezuela. 1 2

Right · 2On the same day, Canadian cyber watchdog Citizen Lab and New York ad tech firm Confiant named Discover-Tech, saying it abused the ad-bidding process, which can leak user data to the bidder; collected over time and merged with other information, such data can de-anonymise users, track them across the web and in some cases set them up for targeting with surveillance software. 1 2 Right · 2Citizen Lab and Confiant said the ads were shown inside dozens of sensitive networks belonging to media organisations, governments and tech firms; Google, Comcast and other companies said they removed Discover-Tech from their ad platforms. 1 2 Right · 2According to one of the six people and a seventh, at least one big US tech company and one international organisation have launched internal inquiries into whether Discover-Tech's ads targeted their employees. 1 2

Right · 2Five of the sources said TrendAI researchers were convinced Discover-Tech was behind the activity and discussed naming it, but dropped the idea after TrendAI executives raised legal concerns. TrendAI did not directly address why it did not name the company, saying its attribution approach aims to reduce mistakes and avoid "hype-driven labels" and "unstable actor names". 1 2 Right · 2Context: tracking Starlink users has become a "cottage industry" as governments try to control satellite terminals, which bypass national telecoms and are vital to Ukraine's military. In May, Haaretz and Intelligence Online separately reported that Israeli-owned businesses were pitching clients ways to track Starlink users, with Haaretz saying ad data appeared to play a key role. 1 2 Right · 2Reuters noted that self-censorship is common in cybersecurity, citing industry experts, and recalled that Palo Alto earlier this year removed explicit references to China from a report; Palo Alto said any link to Chinese procurement rules was "speculative and false". 1 2