An Israeli company, Discover-Tech, allegedly used the online advertising system to collect location data on users of Elon Musk’s Starlink satellite internet service in more than 100 countries, according to a Reuters report published on Wednesday.
Reuters, citing six sources with knowledge of the case, said the company used advertising auctions to track users’ locations and potentially monitor their online activity.
The findings do not prove that specific Starlink users were successfully tracked or that their devices were infected with spyware.
The research came from TrendAI, a unit of Tokyo-based cybersecurity firm Trend Micro.
Its researchers found unusually heavy activity by Discover-Tech in auctions involving Starlink users, with the company appearing to be the highest bidder for advertising space linked to the service in more than 100 countries, which included states where Starlink is banned or restricted.
Such auctions take place automatically each time someone visits a website or opens an app, with advertising firms competing to show an advert.
Details of the user’s device, IP address and approximate location may be passed on during the process.
A company that takes part systematically can collect that data without ever displaying an advert, and can combine it with other information to try to identify users and follow them across sites and apps.
TrendAI published a report on October 15 describing the activity but did not name the company, using the codename “Shadow-Earth-79”, with all six sources telling Reuters the name referred to Discover-Tech.
TrendAI said its policy on identifying those responsible is meant to avoid misattribution.
Its researchers found particularly intense activity in Syria, Libya, Yemen and South Sudan, where demand for ordinary commercial advertising is limited.
That reinforced suspicions that the aim was to gather information rather than promote products.
The Canadian research centre Citizen Lab and the US digital advertising security firm Confiant later named Discover-Tech themselves.
They said its advertising activity had reached sensitive networks including those of news organisations, government agencies, international bodies and technology companies.
A separate investigation linked some of the company’s activity to the distribution of spyware through adverts, though this does not mean every targeted Starlink user was attacked.
Google, Comcast and other advertising providers have since blocked Discover-Tech from their platforms.
At least one major US technology company and one international organisation have begun internal inquiries into whether their staff were targeted.
Discover-Tech, its chief executive and SpaceX did not respond to requests for comment.
Starlink can provide internet access by satellite, in some cases bypassing local telecoms networks, which makes it important in conflict zones and in countries with tight state control of information.
It is used in war zones and has been significant for Ukrainian military operations.
Last May, Haaretz and Intelligence Online reported that some firms were offering ways to track Starlink users through advertising data.
Click here to change your cookie preferences