Elon Musk’s Starlink provides internet access through satellites operated by SpaceX.
An Israeli advertising technology company, Discover-Tech, is facing scrutiny over suspicions that its digital advertising activity could be used to track people using SpaceX ‘s Starlink satellite internet service, according to six people familiar with the findings of cybersecurity researchers.
At least one major US technology company and one international organisation have also launched internal investigations into whether the company’s advertisements targeted their employees, according to two people familiar with the matter.
Citizen Lab and Confiant said Discover-Tech’s advertisements had appeared within dozens of sensitive networks associated with media organisations, government bodies and technology companies. Following the investigations, Google, Comcast and other companies said they had removed Discover-Tech from their advertising platforms. By collecting such information across multiple transactions and combining it with other data, an operator could potentially identify people who would otherwise remain anonymous, track their activity across websites and, in some cases, target them with surveillance software.
The company reportedly ranked first in bidding for Starlink-related advertising traffic in more than 100 countries, including several where the service is banned or restricted. TrendAI published a report on October 15 detailing suspicious activity involving advertisements shown to Starlink users. The possibility of identifying or tracking users could therefore raise security concerns in active conflict zones. Because they fear legal action or retaliation, industry experts say some cybersecurity companies avoid making direct accusations.
Researchers at Canadian cybersecurity watchdog Citizen Lab and New York-based advertising technology firm Confiant named Discover-Tech in separate findings released on the same day as TrendAI’s report. In May, Israeli newspaper Haaretz and the website Intelligence Online separately reported that Israeli-owned businesses were offering clients ways to identify and track Starlink users. Haaretz reported that the use of digital advertising data appeared to be central to these efforts. A similar issue arose earlier this year when US cybersecurity company Palo Alto removed explicit references to China from a report on a global cyber-espionage campaign, despite its researchers believing the activity could be attributed to Beijing, Reuters reported.
However, it did not name Discover-Tech, referring instead to an unnamed advertising technology entity under the codename “Shadow-Earth-79”. Six people familiar with the research said the codename referred to Discover-Tech. Asked why it had not publicly identified the company, TrendAI said its approach to attribution was intended to minimise errors and avoid “hype-driven labels” or “unstable actor names that can mislead defenders, distort risk prioritization, and trigger inappropriate response actions. It also said the entity secured “an implausibly dominant share” of advertising bids in several countries, including Hungary, Israel, Egypt, Azerbaijan and Venezuela. TrendAI investigators believed Discover-Tech was responsible for the suspicious bidding activity and discussed identifying the company in their report, according to the six people familiar with the research. Five of the sources said the researchers ultimately abandoned that plan after senior executives raised legal concerns. Reuters said the report was toned down amid concerns that directly naming China could create problems for Palo Alto’s business operations there. Palo Alto rejected the suggestion that commercial considerations had influenced its decision, saying the lack of attribution was not linked to “procurement regulations in China” and describing any suggestion otherwise as “speculative and false.
The investigation by TrendAI, a unit of Tokyo-based cybersecurity firm Trend Micro, found that Discover-Tech was among the biggest bidders for advertisements reaching Starlink users. Researchers believe the unusual pattern could point to an attempt to identify users’ locations or monitor them through data collected during online advertising transactions. SpaceX did not respond to requests for comment by news agency Reuters. Discover-Tech and its chief executive also did not respond to requests for comment over the past two weeks. Online advertising operates through auctions in which advertisers compete for space on websites and apps. During this process, information about internet users can be shared with bidders. Both organisations accused the Israeli company of abusing the advertising bidding system, which can expose information about users to advertisers. The concerns extend beyond ordinary internet users. Identifying the location or activity of people using satellite internet could be particularly sensitive when they include government officials, journalists or personnel operating in conflict zones. Starlink provides internet access through satellites operated by SpaceX, allowing people to connect without depending entirely on conventional telecommunications networks within their countries. This can make the service useful in areas where internet access is restricted, communications infrastructure is damaged or conventional networks are unavailable. Ukraine’s military has become particularly reliant on Starlink for communications near the front lines and for directing drone strikes. TrendAI’s report also pointed to unusual advertising patterns across several countries. It described the suspected operator as running “targeting and tracking infrastructure rather than a commercial advertising operation. The entity was identified as the largest buyer of digital advertisements in Syria, Libya, Yemen and South Sudan, and the second-largest in Afghanistan. The report questioned the commercial rationale for such activity, noting that “the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero. These patterns raised suspicions that the activity might serve a purpose beyond ordinary advertising. However, the findings do not by themselves establish the extent of any surveillance or prove that specific Starlink users were tracked. The case highlights a challenge for cybersecurity firms investigating suspected surveillance operations. Publicly naming a company or government as responsible for suspicious activity can carry legal and commercial risks, particularly when the evidence is disputed or difficult to verify independently. Those operations were already under scrutiny after Beijing directed domestic companies not to use its products. You use AI every day. Now get your AI Quotient. Take the AIQ test.