Israeli Firm Allegedly Targeted Starlink Users in More Than 100 Countries Through Online Advertising

An Israeli advertising technology company has been linked to an extensive operation targeting users of SpaceX's Starlink satellite internet service, raising concerns that online advertising systems are being exploited to identify and monitor people across more than 100 countries.

The findings emerged in a Reuters investigation published on Tuesday, October 27, citing six people familiar with research conducted by TrendAI, the cybersecurity division of Japan-based Trend Micro.

According to those sources, researchers identified Israeli company Discover-Tech as the operator behind suspicious advertising activity directed at Starlink users.

The research found that the entity was the leading bidder for advertising traffic associated with Starlink in 105 countries, including several where the satellite internet service faces restrictions or bans.

The activity has raised concerns because digital advertising auctions can expose information about internet users, potentially including IP addresses, approximate locations, device characteristics and identifiers.

Such information can be combined to build profiles of individuals, follow their online activity and potentially support more intrusive surveillance.

TrendAI published its technical findings on October 15, identifying the suspected operation under the name Shadow-Earth-79 without publicly naming the company believed to be responsible.

The researchers found that the entity accounted for approximately 13% of winning advertising bids involving Starlink traffic in their dataset, substantially above the typical share of other bidders.

They also observed unusually high advertising activity in countries affected by conflict or international restrictions.

According to TrendAI, the entity was the leading advertising bidder across all observed traffic in Syria, Libya, Yemen and South Sudan, and ranked second in Afghanistan.

Researchers considered the pattern suspicious because conventional commercial advertising demand would not ordinarily explain such extensive activity in those markets.

Reuters reported that TrendAI researchers believed Discover-Tech was responsible for the operation but that the company's name was omitted from the public technical report following internal concerns about attribution.

The identification remains an investigative finding reported by Reuters, rather than a determination by a court or regulator.

Separate research published earlier this month by Citizen Lab at the University of Toronto and advertising security company Confiant identified Discover-Tech in a wider surveillance operation involving digital advertising infrastructure.

Those researchers documented techniques capable of identifying internet users and facilitating the delivery of sophisticated surveillance software.

Their findings included evidence involving journalists and other individuals using sensitive communications networks.

However, the available research does not establish that every Starlink user exposed to the suspicious advertising activity was hacked, or that the Starlink service itself was compromised.

The distinction is important because the alleged surveillance method exploits information exchanged through advertising systems rather than necessarily breaking into Starlink's satellite network.

Starlink has become particularly important in areas where conventional communications infrastructure is unreliable, damaged or subject to government restrictions.

Its services are used by households, businesses, humanitarian organisations and, in some conflict zones, military forces.

The potential ability to identify or locate users therefore carries significant security implications.

Reuters said SpaceX did not respond to its request for comment. Discover-Tech and its chief executive also did not respond to requests for comment made over the preceding two weeks.

Following the earlier investigations, Google, Comcast and other companies said they had removed Discover-Tech from their advertising platforms.

The latest findings add to growing scrutiny of the international advertising industry, where vast amounts of user information can be exchanged between companies during automated auctions.

For governments, technology providers and internet users, the investigation raises questions about whether existing safeguards adequately prevent advertising infrastructure from becoming a tool for intelligence gathering.

The full extent of the alleged Starlink-focused operation, including who may have commissioned it and whether particular users were subsequently compromised, has not been independently established.