Researchers say an Israeli ad agency turned programmatic advertising into a tracking system

Reuters correspondent Raphael Satter reported from Washington on 15 October that the Israeli digital advertising agency Discover-Tech used a network of online ads to track targets and help hack their devices, drawing on two reports published the same day by Citizen Lab at the University of Toronto and by Confiant, a New York advertising-security firm. According to the wire, Discover-Tech’s services gave Candiru — an Israeli spyware firm blacklisted by the US government — and other Israeli surveillance companies access to advertising platforms operated by Google, Comcast and Russia’s Yandex, among others. Citizen Lab put the reach of Discover-Tech’s partnerships at more than 120,000 websites and 75,000 apps. Confiant co-founder Jerome Dangu told Reuters the system served at least 10 million ads a day worldwide. The ads were often for consumer goods, phones or earbuds; the researchers said a user only had to load a page or open an app carrying one to be identified and tracked, and that in some cases Discover-Tech attempted to extract phone numbers from smartphone users.

The mechanism is the part that generalises. Reuters describes the role of “cookie matching” — the routine data-sharing arrangements between advertising firms — which Dangu said allowed Discover-Tech to follow people beyond the reach of its own inventory. That is not a defect in one vendor’s product. It is the standard plumbing of programmatic advertising, operating as designed. Dangu told Reuters the malicious ads were served into hundreds of networks in sensitive categories, naming the Pentagon, the International Atomic Energy Agency and the International Criminal Court. He also said: “You go to almost any site in Palestine — any site — you find a Discover-Tech ad. It gives them a very complete visibility on the digital activities of an entire country.” That sentence is on the record and attributed, but it is one researcher’s characterisation; neither published report, as reported in the wire copy, sets out a quantified country-level breakdown behind it.

What is missing from the story as it stands is everything that would convert a research finding into an accountability finding. No response from Discover-Tech appears in the syndicated Reuters text. Neither do statements from Google, Comcast or Yandex, the three platforms named as having been accessed, nor any comment from the Israeli government. The Candiru link matters because Candiru is already on a US government blacklist, which raises a regulatory question that a conventional privacy disclosure would not: whether any authority in Washington or Brussels treats access to mainstream ad exchanges by a blacklisted surveillance vendor’s partner as a licensing or data-protection matter. The named presence of the ads inside Pentagon, IAEA and ICC networks creates institutional pressure of a kind that privacy research rarely generates.

Assessment: Judge this one by who speaks next. Silence from Google, Comcast and Yandex past the 48-hour mark is not a non-event; it is a decision, and it tells you whether ad exchanges regard surveillance clients as a compliance problem or a customer-service problem. The same applies to the ICC and the IAEA, both of which have institutional reasons to confirm and equally strong reasons not to. Treat two figures with care: the aggregated “nearly 200,000 websites and apps” is arithmetic performed downstream, not researchers' phrasing, and the Palestine line is testimony, not telemetry. Also worth noting from the Gulf: several governments here are customers of the wider Israeli surveillance sector, and none has said anything.