An Israeli advertising technology company is suspected of exploiting the online advertising system to locate and track users of SpaceX's Starlink satellite internet service, according to a Reuters investigation published Tuesday that cites six people familiar with the matter.
According to Reuters, researchers at TrendAI, a unit of the Tokyo-based cybersecurity company Trend Micro, found that the firm, Discover-Tech, was one of the largest buyers of ads shown to Starlink users worldwide. On Starlink traffic, it was the top bidder in more than 100 countries, including countries where the service is banned or restricted. The researchers concluded that the ads were likely used not to sell products but to geolocate users or otherwise monitor them.
Discover-Tech and its chief executive did not respond to Reuters' requests for comment over a two-week period. SpaceX also did not respond.
How an ad can become a tracking tool
The suspicion centers on real-time bidding, the automated process behind most online advertising. Each time a user opens a website or app that carries ads, advertisers compete in an instant auction for the chance to display one. To help them decide how much to bid, the auction shares data about the user, which can include the device, the network and an approximate location.
Every bidder receives that data, not only the winner. A company that bids at large scale can collect it over time, combine it with other sources, and use it to identify individual users, follow their movements and online activity, and in some cases prepare them as targets for surveillance software.
Activity where commercial demand barely exists
TrendAI's report, released on October 15, did not name the company. It referred instead to an entity code-named Shadow-Earth-79, which the six sources told Reuters was the researchers' name for Discover-Tech.
The report found that Shadow-Earth-79 was the largest advertising buyer in Syria, Libya, Yemen and South Sudan, and the second largest in Afghanistan. According to the researchers, demand for legitimate Western advertising in sanctioned or active-conflict countries is effectively zero, which is why they assessed the activity as targeting and tracking infrastructure rather than a genuine advertising business.
The entity also won an unusually large share of ad auctions in Hungary, Israel, Egypt, Azerbaijan and Venezuela.
According to five of the sources, TrendAI's researchers considered naming the company in the report but dropped the plan after TrendAI's own executives raised legal concerns. TrendAI said its attribution policy is designed to avoid misleading labels.
Named elsewhere, removed from ad platforms
On the same day as TrendAI's report, the Canadian digital rights watchdog Citizen Lab and the New York ad tech firm Confiant publicly named Discover-Tech. They said it had abused the ad auction process and that its ads appeared on networks belonging to media organizations, governments and technology companies.
Google, Comcast and other companies said they removed Discover-Tech from their advertising platforms following the findings. According to Reuters, at least one major US technology company and one international organization have since opened internal inquiries into whether the company's ads targeted their employees.
Why Starlink users are a sensitive target
Starlink connects users to the internet through SpaceX satellites rather than local telecommunications networks. That allows it to operate where governments restrict internet access or where infrastructure has been destroyed, and it makes the identity and location of its users valuable to intelligence services.
The service has become especially important in the war between Russia and Ukraine, where Ukraine's military relies on it for frontline communications and to direct drone strikes.
The Reuters report is not the first to raise these concerns. In May, Haaretz and the French publication Intelligence Online separately reported that Israeli-owned businesses were offering clients ways to identify and track Starlink users, and Haaretz said that exploiting advertising data appeared to play a central role.
