Researchers at TrendAI, a unit of Tokyo-based Trend Micro, concluded that Israeli advertising technology company Discover-Tech was one of the largest sources of ads shown to users of SpaceX's Starlink satellite internet service, and that the ads were probably used to locate or otherwise surveil those users, Reuters reported Tuesday, citing six people familiar with the matter. If the identification holds, it means the automated auctions that decide which ad appears on a screen are being used to single out people on a specific network, including in war zones, a risk most organizations do not monitor.
What Happened
According to Reuters' sources, Discover-Tech was the No. 1 bidder on Starlink traffic in more than 100 countries, including several where Starlink is banned or restricted. TrendAI's Oct. 15 report did not name the company. It described an ad-tech actor codenamed "Shadow-Earth-79," which the six people said is TrendAI's name for Discover-Tech.
Reuters said the report found the actor was the top ad buyer on Starlink connections in Syria, Libya, Yemen and South Sudan and second in Afghanistan, with an outsized share of winning bids in countries including Hungary, Israel, Egypt, Azerbaijan and Venezuela. TrendAI concluded the pattern looked like targeting and tracking infrastructure rather than a commercial ad business.
Five people told Reuters that TrendAI researchers discussed naming Discover-Tech but dropped the idea after executives raised legal concerns. TrendAI did not directly address the omission; in a statement, it said its approach to attribution is meant to reduce the risk of mistakes and avoid "hype-driven labels." Discover-Tech and its chief executive did not respond to Reuters' requests for comment over two weeks, and SpaceX did not respond.
How Ads Become a Tracking Tool
Each time a website or app with ad space loads, an exchange runs an instant auction, and the request sent to bidders can carry details about the device and connection. Citizen Lab, a research group at the University of Toronto, and New York ad-security firm Confiant have said this process leaks data that bidders can collect and combine to identify users and follow them across the web, Reuters reported. A bidder that wins much of the traffic from one network in one country can build a picture of who uses that network there.
On Oct. 15, the same day as TrendAI's report, Citizen Lab and Confiant publicly named Discover-Tech. The Primary Wire reported, citing Reuters, that Citizen Lab tied the company's ad platform to zero-click spyware attacks on Al Jazeera devices linked to Candiru, an Israeli spyware vendor blacklisted by the U.S. Commerce Department. Google, Comcast and other companies said they had removed Discover-Tech from their ad platforms, according to Reuters.
Why It Matters
Starlink is central to frontline communications and drone operations in Ukraine, and Reuters said tracking its users has become a business of its own as governments try to regulate satellite terminals. In May, Haaretz and Intelligence Online separately reported that Israeli-owned businesses were marketing ways to identify and track Starlink users, according to Reuters. Neither Reuters nor TrendAI has said who, if anyone, bought intelligence about Starlink users from Discover-Tech.
The exposure reaches beyond conflict zones. At least one large U.S. technology company and one international organization have opened internal inquiries into whether the ads targeted their employees, Reuters reported, citing one of its sources and a seventh person. For security chiefs and boards, that makes ad blocking and limits on advertising identifiers on work devices a defensive measure, particularly for staff who travel to or work from sensitive regions.
The episode also bears on how much leaders can rely on vendor threat reports. Reuters noted that Palo Alto Networks earlier this year reportedly removed explicit references to China from a cyberespionage report, a change the company denied was tied to Chinese procurement rules. An unnamed actor in a vendor report can leave customers unable to act on the finding.
What to Watch
- Whether TrendAI or Trend Micro confirms the attribution, or Discover-Tech responds publicly.
- Whether SpaceX, U.S. agencies or additional ad exchanges take action against the company.
- What the U.S. technology company's and international organization's internal inquiries find about targeting of their staff.
