An Israeli advertising technology company was the leading bidder for digital advertising space targeting users of SpaceX’s Starlink satellite internet service in more than 100 countries, in activity researchers believe may have been designed to identify or surveil users, according to six people familiar with the findings.
Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro, analysed digital advertising data and concluded that Discover-Tech was among the largest sources of advertisements shown to Starlink users worldwide. The company was the leading bidder on Starlink-related advertising traffic in more than 100 countries, including several where the satellite internet service is banned or restricted, the sources said.
The findings raise concerns about the potential use of the digital advertising industry’s auction systems to gather information about people using satellite internet, including in politically sensitive or conflict-affected regions.
SpaceX did not respond to requests for comment. Discover-Tech and its chief executive also did not respond to requests for comment over the past two weeks.
TrendAI published a report on October 15 describing the suspicious activity but did not publicly identify Discover-Tech. Instead, it referred to the responsible party as an “ad tech entity” under the codename “Shadow-Earth-79”. The six sources said that codename referred to Discover-Tech.
TrendAI said its approach to identifying potential threat actors was intended to minimise mistakes and avoid labels that could mislead cybersecurity defenders, distort assessments of risk or trigger inappropriate responses. The company did not directly address questions about why its report did not identify the entity by name.
The advertising bidding process allows companies to compete for space within websites and applications. Researchers have warned that the process can also expose information about internet users to bidders. By collecting and combining such data over time, an operator may be able to identify otherwise anonymous users, track their online activity and, in some cases, facilitate the deployment of surveillance software.
Discover-Tech had already come under scrutiny following separate investigations into allegations that it used online advertising infrastructure to conduct a wider surveillance operation.
On the same day TrendAI released its report, Canada’s Citizen Lab and New York-based advertising technology company Confiant publicly identified Discover-Tech. They said the Israeli company had abused the advertising bidding process to obtain data that could be used to identify and track internet users.
Their investigations found that advertisements linked to the operation had appeared within dozens of sensitive networks associated with media organisations, governments and technology companies. Google, Comcast and other companies subsequently said they had removed Discover-Tech from their advertising platforms.
At least one major US technology company and an international organisation have also launched internal inquiries into whether Discover-Tech advertisements targeted their employees, according to two people familiar with the matter.
TrendAI’s report described bidding patterns that it said suggested the operation was running “targeting and tracking infrastructure rather than a commercial advertising operation”. The entity was identified as the leading buyer of advertisements in Syria, Libya, Yemen and South Sudan, and the second-largest buyer in Afghanistan.
The report also described an unusually dominant share of advertising bids in countries including Hungary, Israel, Egypt, Azerbaijan and Venezuela. Researchers questioned the commercial rationale for such activity in sanctioned or conflict-affected countries, where demand for legitimate Western advertising could be extremely limited.
The six sources said TrendAI researchers had discussed publicly naming Discover-Tech but abandoned the plan after executives raised legal concerns. Five sources said those concerns influenced the decision not to attribute the activity publicly to a specific company.
The case highlights the difficulties cybersecurity researchers can face when deciding whether to identify suspected surveillance operations. Industry experts say companies may avoid explicit attribution because of concerns about legal action or retaliation.
Starlink’s role in this debate reflects the strategic significance of satellite internet services. By routing communications through SpaceX-operated satellites rather than nationally regulated telecommunications networks, Starlink terminals can bypass some local internet restrictions and provide connectivity in hostile environments. Ukraine’s military, in particular, relies on the service for frontline communications and directing drone strikes.
Earlier reports by Israeli newspaper Haaretz and the website Intelligence Online had described Israeli-owned businesses offering ways to identify and track Starlink users, with advertising data reportedly playing a role in those efforts.
The allegations surrounding Discover-Tech add to concerns that advertising systems designed for commercial targeting can also become tools for surveillance, particularly when they reach users in countries where access to independent communications is restricted.
