Israeli Ad Tech Firm Accused of Tracking Starlink Users via Online Ads
Researchers link Israeli ad tech firm Discover-Tech to an operation that allegedly used online advertising auctions to track Starlink satellite internet users, raising privacy concerns.
An Israeli advertising technology firm, Discover-Tech, stands accused of leveraging online advertising auctions to track users of SpaceX's Starlink satellite internet service. According to research shared by TrendAI, the firm allegedly dominated ad bids for Starlink traffic, collecting device and IP data to profile users, particularly those in sensitive geopolitical regions. This operation, codenamed SHADOW-EARTH-79 by TrendAI, is described as going beyond typical advertising practices and has led to Discover-Tech's removal from major advertising platforms.
The alleged tracking mechanism relies on real-time bidding (RTB), the automated process where advertisers bid for ad space on websites and apps. During these auctions, significant amounts of user data, including IP addresses, advertising IDs, and network identifiers, can be accessed by bidders. Researchers observed that the operation, identified as SHADOW-EARTH-79, was a leading bidder for advertising traffic associated with Starlink's network identifier (AS14593) in 105 countries. This focus on Starlink users was significantly higher than its overall ad impression share, indicating a deliberate targeting strategy.
TrendAI's analysis revealed that SHADOW-EARTH-79 was the top winning bidder for observed Starlink advertising traffic across a substantial number of countries. In one comparison, the operation secured 12.9% of Starlink ad impressions, a stark contrast to its 2.6% share across all internet traffic. While these figures are based on data from a single advertising buying platform and country estimates derived from IP addresses carry inherent uncertainties, the pattern strongly suggests a focused effort to monitor Starlink users.
The operation's reach was particularly pronounced in regions experiencing conflict or instability. The study highlighted that the operation ranked first among observed ad buyers in Syria, Libya, Yemen, and South Sudan. TrendAI stated that these patterns, combined with reconstructed software features from publicly available JavaScript bundles, pointed towards intelligence-gathering infrastructure rather than standard commercial advertising activities.
Further investigation by Citizen Lab and Confiant, which also named Discover-Tech, corroborated the findings. These separate inquiries focused on how spyware could be delivered through online advertisements. It is important to note that merely receiving an advertisement from Discover-Tech does not confirm a device was compromised or that tracking occurred.
In response to the revelations, major technology companies including Google and Comcast have reportedly removed Discover-Tech from their advertising platforms. SpaceX and Discover-Tech itself have not yet responded to requests for comment. The findings underscore the potential for misuse of the vast data collected through online advertising ecosystems, especially when targeting users in vulnerable locations.
TrendAI has recommended several protective measures for users, including restricting advertising traffic on sensitive devices, limiting app permissions, disabling ad personalization, and reducing reliance on ad-supported applications. The firm emphasizes that simple ad blockers may not be sufficient, as tracking requests can persist. Users should prioritize controls that prevent sensitive data from being transmitted to advertising systems.
This incident highlights a broader concern about the privacy implications of ubiquitous online advertising and the potential for sophisticated actors to exploit these systems for surveillance purposes. The use of RTB data for profiling individuals, especially in sensitive contexts, raises significant ethical and security questions.