Researchers Uncover Signs of Surveillance Operation on Starlink Users

Researchers say an advertising company may have used online ad auctions to track Starlink users worldwide. TrendAI identified a bidder it codenamed SHADOW-EARTH-79 as the leading buyer of Starlink ad impressions in 105 countries, winning 12.9% of auctions - nearly five times its share across general internet traffic. Its dominance was especially high in Argentina, the Philippines, and Japan, and it also ranked first or second in countries including Syria, Libya, Yemen, South Sudan, and Afghanistan, where legitimate Western advertising demand is negligible. TrendAI judged the pattern more consistent with surveillance infrastructure than a normal commercial business.

Reuters reported that SHADOW-EARTH-79 is Discover-Tech, an Israeli advertising firm previously linked by Citizen Lab to ads that delivered Candiru spyware without users’ interaction. That investigation documented at least 45 infected devices at Al Jazeera and found Discover-Tech’s advertising reached sensitive networks; Google later blocked the firm from its ad platforms, and IAB Europe removed it from its vendor list. Researchers have not reported confirmed infections of Starlink users, but say real-time ad auctions can expose device and location data without breaching Starlink’s network. The concern is acute in countries where Starlink is banned or restricted, since its users may be politically vulnerable or difficult to locate through ordinary internet providers.