Researchers flag Starlink ads as possible tracking tools

TrendAI researchers suspect Starlink advertising served surveillance purposes, six people with knowledge of the findings said.

The six people identified Israeli advertising technology business Discover-Tech as the company behind activity examined by the researchers. They said the researchers considered it a major source of advertising directed at Starlink subscribers and suspected the activity sought to establish users' locations or monitor them.

The distinction between the public findings and that identification is important. TrendAI, part of Tokyo-based cybersecurity business Trend Micro, published a report on October 15 describing the targeting but withheld the company's identity, assigning it the designation “Shadow-Earth-79.”

Advertising auctions offer a tracking route

The researchers based their assessment on advertising information collected through TrendAI's telemetry, the six people said. Their analysis placed Discover-Tech first among bidders seeking Starlink-related advertising traffic in over 100 countries, including jurisdictions that prohibited or limited the satellite service.

Advertising bids are offers made through auctions that allocate placements within apps and web browsers. The suspected surveillance route therefore concerns the advertising ecosystem surrounding Starlink users, rather than a reported intrusion into SpaceX's satellites or terminals.

The supplied account does not establish that any particular subscriber was successfully located through those advertisements. It also does not identify a customer commissioning surveillance, explain which information the advertiser obtained, or quantify how many people might have been affected.

Satellite access carries security stakes

Starlink carries communications through satellites operated by SpaceX instead of relying on domestic telecommunications providers. That architecture allows terminals to bypass national internet controls and support communications in areas where ordinary access is restricted or dangerous.

The security stakes extend beyond consumer privacy. Ukraine's armed forces use Starlink for communications near the front and to help direct attacks by drones, making the possibility of identifying subscribers relevant to battlefield operations as well as government restrictions.

Separate reporting in May described Israeli-owned companies marketing capabilities to identify and follow Starlink subscribers. One account linked those offerings to advertising information, providing context for the researchers' concerns without independently establishing the allegations involving Discover-Tech.

Discover-Tech identification remains separately sourced

The connection between Discover-Tech and the designation in TrendAI's public report rests on the six people's accounts. The supplied material does not explain their individual roles or why they were unnamed, and TrendAI did not publicly identify the business in its report.

Asked about its decision to withhold the name, TrendAI offered no direct explanation specific to this case. Instead, the company said its attribution practices seek to limit errors and avoid labels that could misdirect security teams or prompt unsuitable responses.

Neither Discover-Tech nor its chief executive provided a response to inquiries made during a two-week period, according to the supplied account. SpaceX also provided no response to a request for comment.

If the suspected location tracking is substantiated, the case would connect advertising-data practices with security risks for satellite internet users, including those operating under national restrictions. Until then, the unresolved issues are whether the advertisements enabled surveillance, who sought that capability, and what evidence supports naming Discover-Tech.