An institutional OSINT investigation into zero-click spyware delivery, advertising intelligence, identity deanonymisation, commercial surveillance networks and the strategic vulnerability of the global digital advertising infrastructure.

Scope: This assessment examines the Discover-Tech investigation published on 15 October 2026, its documented operations between 2024 and 2026, comparable commercial surveillance actors internationally, the regulatory exposure of the United States, Israel, the European Union and the United Kingdom, and the strategic outlook through October 2031.

Executive Summary — Bottom Line Up Front

The Discover-Tech case provides substantial evidence that commercial digital advertising infrastructure can be repurposed into a surveillance-delivery system capable of identifying individuals, collecting intelligence about their devices and, in selected circumstances, delivering sophisticated spyware without requiring an advertisement click.

The principal technical investigation, published by the University of Toronto’s Citizen Lab on 15 October 2026, documents 3,770,286,576 advertising bids, 441,954,291 apparently successful bids, 120,768 websites and 75,373 applications within its March–June 2026 dataset. It also links Discover-Tech’s advertising infrastructure to Candiru spyware attacks against at least 45 devices at Al Jazeera during 2024–2025.

A separate investigation by Confiant provides technical evidence of malicious advertising code, device fingerprinting, concealed command-and-control communications and connections to commercial surveillance actors. Its findings reinforce the central technical assessment, although the two investigations were coordinated and should not be counted as wholly independent corroboration of every allegation.

The consequential discovery is not simply that advertisements were misused to deliver malware, an established cybersecurity problem, but that an intermediary could combine the targeting power of advertising exchanges with specialised offensive cyber capabilities, creating an operational bridge between mass commercial data collection and selective device compromise.

The international comparison identifies several distinct categories of potentially relevant companies: spyware manufacturers, advertising-intelligence providers, mobile-location data brokers, commercial hacking intermediaries and ordinary advertising infrastructure operators. These categories must remain separate because technological similarity does not establish common ownership, operational cooperation or unlawful conduct.

The principal national-security concern extends beyond individual privacy. The same advertising architecture that allows companies to target consumers can expose the location, device characteristics, browsing patterns and potentially identifiable behavioural signatures of military personnel, diplomats, government officials, researchers, journalists and critical-infrastructure employees.

Principal judgment: Discover-Tech should be assessed as a documented example of a broader structural vulnerability in the digital advertising economy, rather than as evidence that every surveillance company uses the same technique. The immediate institutional requirement is to treat advertising-data exposure and advertising-script execution as interconnected cybersecurity, counterintelligence, procurement and regulatory risks.

Europe’s Cybersecurity Funding: Italy’s Resilience Gap

The Surveillance Economy Has Crossed a New Frontier: How Digital Advertising Became an Instrument of Espionage

The Discover-Tech investigation exposes a structural failure in the global digital economy: commercial advertising systems can provide intelligence operators with access to individuals, institutions and devices that traditional cybersecurity controls were never designed to protect.

The revelations published on 15 October 2026 concerning Israeli advertising company Discover-Tech have exposed a contradiction at the centre of the global digital economy. Infrastructure developed to distribute advertisements and monetise consumer behaviour was used to support intelligence collection and the delivery of sophisticated spyware. Investigations by the University of Toronto’s Citizen Lab and cybersecurity company Confiant established links between Discover-Tech’s advertising operations and Candiru, an Israeli surveillance vendor placed on the United States Entity List in November 2021. The implications extend beyond an individual company or an isolated cyberattack. Governments have regulated personal data, cybersecurity, commercial surveillance exports and digital advertising through separate instruments, while the underlying technology has allowed these activities to converge. The resulting vulnerability affects national security, industrial competitiveness, financial institutions and the credibility of international regulatory supervision.

The numbers reveal an intelligence infrastructure, not an advertising campaign

The scale of Discover-Tech’s operations is central to understanding the significance of the investigation, although the figures require careful interpretation. Citizen Lab analysed 3,770,286,576 advertising bids between March and June 2026, identifying 441,954,291 apparently successful bids, with activity distributed across 120,768 websites and 75,373 mobile applications. Mobile applications accounted for 76.7% of the recorded bids, compared with 23.3% for web browsers. Within the analysed MyDSP dataset, Yandex represented 67.4% of recorded exchange activity, Google Ad Manager 24.74% and Vungle 7.24%.

These figures describe the volume and distribution of advertising transactions, not the number of individuals successfully identified or devices compromised. Their significance lies in the economic structure they reveal: access to programmatic advertising permits an operator to encounter vast quantities of device-related information before selecting a much smaller population for targeted surveillance. An advertising bid can therefore possess intelligence value independently of whether the operator wins the auction or displays an advertisement.

The geographical distribution reinforces the need to distinguish commercial reach from confirmed targeting. Citizen Lab recorded 457,283,658 bids associated with Yemen, 139,427,322 with Pakistan and 97,595,716 with Montenegro. Population-adjusted observations placed Montenegro at 156.68 recorded bids per capita, compared with 13.99 for Yemen. These concentrations warrant investigation, but neither the absolute volumes nor the population ratios establish how many residents were identified, which governments were responsible or whether particular devices were infected.

The decisive evidence concerns Al Jazeera, where Citizen Lab linked Discover-Tech’s advertising infrastructure to Candiru spyware infections affecting at least 45 devices during 2024–2025. The broadcaster’s network records allowed investigators to associate advertising interactions with subsequent spyware-related communications. The case demonstrates the transition from potential advertising exposure to confirmed intrusive surveillance, without justifying the extrapolation of 45 infections to the billions of advertising transactions observed elsewhere.

Source: Citizen Lab, Exposing AdFection, 15 October 2026.

The decisive vulnerability lies between commercial data collection and offensive cyber capability

Discover-Tech’s importance derives from its position between two previously distinguishable markets: commercial advertising intelligence and intrusive spyware. Advertising exchanges distribute information about available impressions, devices and digital environments, while specialised surveillance suppliers develop capabilities to obtain access to protected systems. Controlium, the platform examined by Citizen Lab, connected advertising delivery with selective targeting and downstream code responses, creating a mechanism through which ordinary advertising activity could become an entry point for offensive operations.

Confiant identified device-fingerprinting functions, remotely controlled code behaviour and techniques capable of varying advertising responses according to the characteristics of the receiving environment. An individual did not need to click an advertisement for the delivery pathway to begin, although the execution of advertising code alone did not guarantee an operating-system compromise. That distinction separates the structural vulnerability of advertising infrastructure from the additional technical requirements of a successful spyware infection.

The consequences are industrial as well as operational. A surveillance vendor possessing expensive exploitation capabilities can benefit from an intermediary already connected to extensive advertising inventory, while the intermediary can provide identification and delivery services without developing the complete offensive technology independently. The arrangement potentially reduces the need to expose specialised capabilities across large populations of devices, concentrating their use on selected targets.

This commercial complementarity explains why regulating spyware manufacturers alone cannot address the entire problem. The intelligence value may originate upstream, where ordinary advertising transactions distribute identifying information, before any prohibited exploit is delivered.

Source: Confiant, ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming, October 2026.

Corporate fragmentation makes surveillance harder to regulate than to commercialise

The wider surveillance industry demonstrates how technological capabilities can be distributed across companies performing different development, ownership, financial and distribution functions. The United States Treasury’s actions of 5 March and 16 September 2024 identified a multinational structure associated with the Intellexa commercial spyware consortium, including companies established in Greece, Ireland, Hungary, North Macedonia and the British Virgin Islands.

The official record identified Cytrox AD as a developer of Predator spyware, Intellexa Limited as a technology reseller, Thalestris Limited as a holder of distribution rights and Aliada Group Inc. as a company involved in substantial financial transactions within the consortium network. Treasury described activity involving tens of millions of dollars, but that amount cannot be equated with consolidated revenue, profit or payments from any particular government.

Such structures matter because the company developing surveillance software may differ from the entity holding intellectual-property rights, signing procurement contracts or receiving payments. Export restrictions directed at one participant do not automatically establish the responsibilities of every associated legal person, while technical evidence of cooperation does not necessarily demonstrate common corporate control.

Discover-Tech’s own history illustrates a related distinction. The advertising technology associated with MyDSP predated the company’s incorporation in March 2020, while historical ownership and governance records identified relationships involving advertising businesses and individuals connected to the surveillance sector. These connections justify corporate investigation but do not establish that every historical shareholder, technology supplier or commercial counterparty participated in the subsequent Candiru operations.

The resulting regulatory difficulty is structural: commercial capability can be assembled through relationships that do not correspond neatly to the boundaries of a single company or national jurisdiction.

Source: U.S. Department of the Treasury, Sanctions Enablers of the Intellexa Commercial Spyware Consortium, 16 September 2024.

Europe’s regulatory architecture governs the components but struggles with their convergence

The European Union possesses extensive legislation governing personal information, electronic communications, cybersecurity and surveillance-technology exports. Regulation (EU) 2016/679, the General Data Protection Regulation, establishes rules concerning personal-data processing, lawful purposes, security and international transfers. The ePrivacy framework governs defined forms of access to information stored on terminal equipment, while the Digital Services Act establishes obligations concerning advertising transparency for covered online platforms.

The legal architecture extends further. Directive (EU) 2022/2555, known as NIS2, addresses cybersecurity risk management and incident reporting for covered entities, while Regulation (EU) 2022/2554, the Digital Operational Resilience Act, applies a specialised resilience framework to the financial sector from 17 January 2025. Regulation (EU) 2021/821 provides export-control mechanisms for specified dual-use and cyber-surveillance items.

The difficulty is not simply the absence of legal instruments, but the separation of their purposes and enforcement authorities. A data-protection regulator may establish unlawful collection without identifying the customer directing an espionage operation; a cybersecurity authority may detect malicious code without determining beneficial ownership; an export-control authority may examine technology transfers without possessing the complete financial and operational record.

The Court of Justice of the European Union’s judgment of 7 March 2024 in Case C-604/22, IAB Europe, clarified important aspects of personal-data classification and controller responsibility within advertising frameworks. It did not establish automatic liability for every downstream activity conducted by every participating company. That distinction remains critical when a commercial exchange is used by an actor engaged in malicious surveillance: technical participation does not itself prove knowledge or complicity.

Source: Court of Justice of the European Union, Case C-604/22, March 2024.

The United States has exposed the same vulnerability through commercial location-data enforcement

The American regulatory record demonstrates that the intelligence risks of commercial advertising extend beyond spyware delivery. In January 2025, the Federal Trade Commission finalised orders involving Mobilewalla, Gravy Analytics and Venntel, addressing practices concerning sensitive location information and its commercial distribution.

Mobilewalla is a particularly revealing comparator because the FTC restricted the collection of information from real-time advertising exchanges for purposes other than participation in the auctions. The case establishes that transaction data can possess commercial value independently of the advertising placement itself, while also demonstrating that the misuse of sensitive advertising-derived information can raise regulatory concerns without involving malware.

The enforcement record continued into 2026. The FTC announced a proposed resolution involving Kochava and Collective Data Solutions on 4 May 2026, followed by a stipulated order recorded in June. Together, these proceedings demonstrate sustained official concern about the collection and distribution of commercially generated location information.

The distinction between American data-broker enforcement and the Discover-Tech spyware investigation remains important. The named data brokers were not thereby established as participants in AdFection. Rather, the proceedings expose adjacent vulnerabilities in the commercial information economy: data originally generated through consumer activity can acquire uses materially different from those associated with the service that collected it.

Source: Federal Trade Commission, Mobilewalla Final Order, January 2025.

Over the next 24 months, the cost of inaction will fall on institutions unable to control their external data exposure

Between October 2026 and October 2028, the most consequential decisions will concern whether governments and major technology platforms address advertising-derived information collection and malicious code delivery as related security problems, rather than relying exclusively on the exclusion of individual surveillance vendors.

The European exposure is not uniform. Italy must consider the dependencies affecting defence industries, energy, telecommunications and advanced manufacturing; France combines national cybersecurity responsibilities with established enforcement concerning advertising-data processing; Germany faces questions arising from industrial supply chains and specialised personnel; and the United Kingdom possesses an extensive regulatory record concerning real-time bidding and online tracking. NATO’s decision in July 2024 to establish an Integrated Cyber Defence Centre further reflects the strategic importance of security dependencies involving privately owned infrastructure, although it does not itself establish a solution to advertising-mediated surveillance.

The immediate costs of inaction will fall on institutions whose security programmes protect internal networks while leaving commercially generated information about personnel and activities insufficiently understood. Governments and defence organisations face counterintelligence exposure; semiconductor and advanced-manufacturing firms risk disclosure of strategically relevant patterns; banks confront additional third-party technology and data-governance obligations; and media organisations face consequences for source confidentiality where surveillance progresses to device compromise.

The commercial burden will also reach advertising platforms. Vendor removals following the October 2026 investigation demonstrate that access to advertising markets can be restricted, but they do not establish that equivalent collection or delivery mechanisms have disappeared. Platforms that fail to demonstrate credible controls over downstream code and data recipients face continuing compliance, security and counterparty risks.

The governing choice is therefore between controlling the technical and commercial conditions that make advertising-derived surveillance possible, or repeatedly identifying individual operators after those conditions have already been exploited. The first requires investment in supplier assurance, data-flow visibility, code-execution controls and legally coordinated investigation; the second leaves the financial and security consequences with institutions whose ordinary commercial dependencies remain outside their effective control.

EU Cyber Resilience Act Reporting Rules Go Live as ENISA’s Single Reporting Platform Changes the Operating Model for Product Cybersecurity

---

Navigational Index — Three Analytical Pillars

Pillar I — The Discover-Tech Architecture: Technical Mechanisms, Corporate Structures and Operational Evidence

• Chapter 1. From Commercial Advertising to Intelligence Collection: Historical Development of ADINT and the Global Real-Time Bidding Economy
• Chapter 2. Discover-Tech and Controlium: Corporate Identity, Ownership, Management, Infrastructure, Partners and Commercial Positioning
• Chapter 3. The AdFection Method: Advertising Auctions, Identity Resolution, Device Fingerprinting and Zero-Click Spyware Delivery
• Chapter 4. Operational Reconstruction: Candiru, Al Jazeera, Geographic Concentration, Sensitive Networks and the Limits of Attribution

Pillar II — Worldwide Corporate Intelligence: Surveillance Vendors, Advertising Intelligence, Commercial Data Brokers and International Networks

• Chapter 5. The Israeli Commercial Surveillance Ecosystem: Candiru, NSO Group, Intellexa, Cytrox, Bindecy, Intelos and Related Corporate Networks
• Chapter 6. The Global Advertising-Intelligence Industry: Commercial Data Collection, Identity Resolution, Geolocation Intelligence and Government Procurement
• Chapter 7. Worldwide Comparative Corporate Investigation: North America, Europe, the Middle East, Asia-Pacific, Latin America and Transnational Supply Chains
• Chapter 8. Corporate and Financial OSINT: Beneficial Ownership, Registries, Subsidiaries, Intermediaries, Acquisitions, Contracts, Export Controls and Sanctions Exposure

Pillar III — National Security, International Law, European Vulnerability and Strategic Countermeasures

• Chapter 9. International Legal and Regulatory Architecture: GDPR, ePrivacy, Export Controls, Sanctions, Commercial Spyware and State Responsibility
• Chapter 10. Comparative European Security: Italy, France, Germany, the United Kingdom and European Union Institutions
• Chapter 11. Strategic Exposure of Governments, NATO, Defence Industries, Semiconductor Supply Chains, Financial Institutions and Media Organisations
• Chapter 12. Counterintelligence and Defensive Architecture: Detection, Attribution, Vendor Assurance, Advertising-Supply-Chain Controls and Incident Response
• Chapter 13. Strategic Scenarios 2026–2031: Technological Convergence, Surveillance-Market Evolution, Regulatory Responses and Indicators
• Chapter 14. Institutional Courses of Action, Intelligence Collection Priorities and Final Net Assessment

---

Banking System Under Fire: Why AI Is Forcing a New Cybersecurity Architecture for Global Finance

Master Abstract

The strategic transformation of advertising infrastructure

The disclosures concerning Discover-Tech represent an important development in the documented relationship between commercial digital advertising and offensive cyber operations because they demonstrate how technical functions originally developed to maximise advertising efficiency can be incorporated into a system for covert intelligence collection and selective device compromise. The relevant infrastructure was not designed exclusively for espionage: advertising exchanges, demand-side platforms, identifiers, bidding requests, audience segmentation and tracking scripts are ordinary components of the commercial internet. Their intelligence significance derives from the combination of extensive access to device-related information, highly automated distribution, persistent identity-linking mechanisms and the ability of certain advertising arrangements to execute third-party code within the user’s browsing environment. These functions become materially more dangerous when controlled by an actor capable of distinguishing a particular target from the broader advertising population and directing specialised code only towards that target. The Citizen Lab investigation describes precisely such an architecture through Discover-Tech’s Controlium platform and associated advertising-delivery infrastructure, while Confiant’s technical analysis independently establishes important characteristics of the concealed code-delivery and device-profiling mechanisms. Exposing AdFection — The Citizen Lab — October 2026 and ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming — Confiant — October 2026.

The operational importance of this finding lies in the asymmetry between the scale of commercial advertising exposure and the much smaller number of individuals who may ultimately be selected for intensive surveillance. A network processing enormous numbers of advertising opportunities need not compromise every exposed device to become strategically useful: it can observe recurring device identifiers, correlate changes in network location, enrich behavioural profiles and reserve costly exploitation techniques for those targets whose intelligence value justifies the expenditure. This distinction is essential when interpreting the approximately 3.77 billion bids examined by Citizen Lab, because advertising bids are not equivalent to unique people, successful advertisement impressions, successful identification events or spyware infections. The numerical relationship between those categories reveals the structure of the opportunity available to a surveillance operator, but it does not supply a defensible count of uniquely surveilled individuals or compromised devices across the entire advertising network. In consequence, the significance of the operation should be assessed through its demonstrated capabilities, its distribution infrastructure and its confirmed targeting evidence, rather than by presenting the largest available advertising metric as a count of espionage victims.

The convergence of advertising intelligence and mercenary spyware

The central corporate finding is that Discover-Tech appears to have occupied an intermediary position connecting conventional advertising infrastructure with commercial surveillance specialists. Citizen Lab identifies operational or corporate connections involving Candiru, also described in the investigation under the name Integrity Labs, together with Bindecy and Intelos, while examining a wider corporate environment in which persons and entities associated with the Intellexa network also appear. This creates several analytically distinct relationships: a technical connection may demonstrate that infrastructure was used to deliver or support particular capabilities; a historical shareholding may establish an ownership interest during a defined period; a common director may establish a governance relationship; and a researcher’s identification of overlapping network infrastructure may justify further investigation without independently proving that every associated company participated in the same operation. The distinctions are fundamental to corporate OSINT because complex international surveillance businesses frequently operate through different legal persons, contractual intermediaries and commercial brands, and the evidentiary requirements for identifying beneficial ownership are not equivalent to those for identifying operational infrastructure.

The comparison with other surveillance actors also demonstrates why the global industry should not be reduced to a list of companies described collectively as spyware manufacturers. The United States Federal Trade Commission has brought enforcement actions concerning the acquisition, processing and sale of sensitive geolocation information, including cases involving Gravy Analytics, Venntel, Mobilewalla and X-Mode/Outlogic. These proceedings establish that commercial location-data markets can create significant risks to consumers and sensitive institutions even where no malware delivery is alleged. Separately, the United States Treasury has sanctioned participants in the Intellexa commercial spyware consortium, documenting a transnational corporate structure associated with the development and distribution of highly invasive surveillance technology. The Discover-Tech case therefore sits at the intersection of markets that have often been examined separately: legitimate advertising intermediation, commercial data brokerage, advertising-derived intelligence and offensive cyber exploitation. Their convergence may generate capabilities that are more consequential than those of any single component, because surveillance actors can potentially move from identifying a target to locating a reachable digital environment and finally attempting device compromise within a connected commercial workflow.

The national-security and economic implications

For governments and strategically important enterprises, the risk is broader than the possibility that an employee might encounter a malicious advertisement. Advertising systems can transfer information about a device or user to numerous commercial participants, and the mere receipt of bid-related information may be intelligence-relevant even when a company does not win the auction or display the eventual advertisement. Depending on the information actually disclosed and the availability of additional identifiers, such access can support activity-pattern analysis, probabilistic identity resolution and the identification of individuals whose recurring connections to sensitive facilities or institutional networks are valuable to an adversary. The presence of Discover-Tech advertising activity in networks associated with defence organisations, international institutions and technology companies consequently establishes a reason for investigation, but does not establish that those organisations suffered successful spyware infections, that confidential information was extracted or that an identified government directed the activity. These further propositions would require institutional incident records, forensic artefacts, access logs, verified command-and-control transactions or comparable evidence. Citizen Lab’s analysis of Discover-Tech’s advertising reach and the established compromise evidence at Al Jazeera illustrate both the seriousness of the exposure and the importance of preserving those evidentiary boundaries.

European institutions face a particularly complex challenge because the protection of personal data, the regulation of advertising markets, the enforcement of cybersecurity requirements and the investigation of state-linked espionage are distributed across partially overlapping jurisdictions and authorities. The European legal response cannot therefore be assessed through privacy law alone, just as the United Kingdom’s response cannot be understood exclusively through national-security institutions. The United Kingdom Information Commissioner’s Office had already identified transparency, lawful basis and security as fundamental concerns in real-time bidding during its 2019 regulatory examination, demonstrating that the underlying architectural weaknesses long preceded the October 2026 Discover-Tech disclosures. The principal development in 2026 is the stronger technical connection between those structural vulnerabilities and the documented delivery of mercenary spyware. An effective institutional response must consequently address both the distribution of advertising-derived personal information and the execution of third-party code through advertising channels, while ensuring that legitimate commercial intermediaries are not incorrectly equated with companies found to have participated in malicious surveillance. Summary Report of Adtech Fact Finding Forum — Information Commissioner’s Office — March 2019.

Key Evidence Table — Discover-Tech and the AdFection Investigation

The following figures are separated according to their underlying units of measurement and evidentiary status, because combining bidding records, application counts, network exposure and confirmed device compromises would produce a misleading estimate of the operation’s actual reach.

Indicator	Value or documented status	Reference period	Definition and evidentiary limitation	Issuer and exact source
Advertising bids examined	3,770,286,576	March–June 2026	Recorded bids in the exposed MyDSP dataset, not unique people	Citizen Lab, Section 5 — October 2026
Apparently successful bids	441,954,291	March–June 2026	Bids identified as winning within the analysed records; approximately 11.7% of recorded bids	Citizen Lab, Section 5
Websites displaying relevant advertising	120,768	March–June 2026	Distinct websites within the analysed delivery dataset	Citizen Lab, Section 5
Mobile applications displaying relevant advertising	75,373	March–June 2026	Distinct Android and iOS applications within the analysed dataset	Citizen Lab, Section 5
Mobile application share of recorded bids	76.7%	March–June 2026	Share of bidding activity, not share of unique affected devices	Citizen Lab, Section 5
Web-browser share of recorded bids	23.3%	March–June 2026	Share of bidding activity	Citizen Lab, Section 5
Yandex exchange share	67.4%	March–June 2026	Share of records attributed to that exchange value within MyDSP	Citizen Lab, Table 2
Google Ad Manager exchange share	24.74%	March–June 2026	Share of records attributed to that exchange value	Citizen Lab, Table 2
Vungle exchange share	7.24%	March–June 2026	Share of records attributed to that exchange value	Citizen Lab, Table 2
Al Jazeera devices targeted	At least 45	2024–2025	Devices associated with the documented Candiru attack campaign; the technical report identifies infections	Citizen Lab, Section 2
Users classified as eligible in a particular backend dataset	3,637,213	Period examined in the report	Internal eligibility count associated with a particular feature, not a validated total of spyware victims; Citizen Lab notes that additional customers could have used the feature	Citizen Lab, technical analysis
Advertising intermediary sanctions or platform response	Access terminated, suspended or blocked by several identified vendors	October 2026	Platform and vendor decisions, not criminal judgments	Citizen Lab, Section 9
Estimated global number of unique individuals successfully tracked	Not established by the reviewed primary technical evidence	As of 17 October 2026	Advertising scale does not establish deduplicated user reach	Evidentiary limit of available records

Interpretation of the principal quantitative findings

The disclosed bidding records provide an unusually substantial empirical basis for assessing the magnitude of Discover-Tech’s advertising operations, although their importance should not be confused with a comprehensive accounting of every commercial relationship or operational campaign. Citizen Lab reports that the records came from two publicly accessible Apache Druid instances associated with Discover-Tech’s advertising infrastructure, and expressly states that those records did not include all activity conducted through other buying platforms, particularly Beeswax and Eskimi. The figures are therefore bounded by the collection architecture and the available dataset rather than constituting a certified global census of Discover-Tech’s operations.

A further distinction concerns the difference between the exchange participation percentages and the responsibility of the corresponding advertising companies. The presence of Yandex, Google Ad Manager or Vungle as an exchange value establishes the relevance of those systems to the advertising transactions examined; it does not demonstrate that the platform operator knew about a spyware campaign, approved malicious code or intentionally facilitated an intelligence service. Such conclusions would require separate evidence concerning communications, knowledge, contractual arrangements, compliance warnings, incident responses and the timing of remedial actions.

The same caution applies to the frequently repeated estimate that hundreds of millions of people may have encountered Discover-Tech’s activities. That estimate, attributed by Reuters to Confiant cofounder Jérôme Dangu, is important as an assessment of possible reach, but the primary technical data reviewed here do not independently establish a deduplicated population of that size. The confirmed evidence is sufficiently serious without treating possible reach as a measured number of human targets.

The Worldwide Corporate Landscape — Initial Comparative OSINT Assessment

A rigorous global comparison requires distinguishing companies that have been technically connected to Discover-Tech from those whose products reproduce one or more of its capabilities, and from advertising intermediaries whose infrastructure may have been used without evidence that the intermediary participated knowingly in the underlying operation.

The appropriate analytical classification is therefore based on demonstrated technical function, documented legal entity, known relationships, source competence and strength of attribution, not on whether a company operates in Israel or markets products to intelligence and defence customers.

Company or network	Principal jurisdiction or documented geographic connection	Relevant activity	Relationship to Discover-Tech or comparable capability	Evidence status
Discover-Tech	Israel	Advertising intermediation, targeted delivery, identification and surveillance-enabling infrastructure	Central subject of the October 2026 investigation	Extensive technical evidence published by Citizen Lab and Confiant
Candiru / Integrity Labs	Israel	Mercenary spyware and device exploitation	Technically connected to Discover-Tech’s advertising delivery pathway	Documented attack linkage; separate U.S. export-control history
Bindecy	Israel	Commercial offensive cyber activities	Connections investigated through Discover-Tech authentication and corporate evidence	Researcher-attributed relationship; full commercial arrangements not publicly established
Intelos	Israel-linked commercial surveillance ecosystem	Advertising intelligence and surveillance analytics	Connected through technical and corporate findings	Research-supported association; not equivalent to confirmed participation in every Candiru campaign
Intellexa Consortium	Transnational, with documented entities in Europe and elsewhere	Commercial spyware, including Predator	Corporate-network intersections identified in the research	Official U.S. sanctions record; distinct from proven involvement in AdFection delivery
Cytrox	North Macedonia-linked corporate operations	Predator spyware development	Relevant member of the wider Intellexa ecosystem	Documented through U.S. Treasury records
NSO Group	Israel	Mercenary spyware, including Pegasus	Comparable offensive surveillance industry, but not established as an AdFection participant	U.S. export-control record; no demonstrated Discover-Tech operational role in the reviewed findings
Gravy Analytics	United States	Commercial location intelligence and data brokerage	Comparable intelligence value from location data, not the same delivery method	Official FTC enforcement proceeding
Venntel	United States	Commercial location-data products	Similar commercial location-surveillance exposure	Official FTC enforcement proceeding
X-Mode / Outlogic	United States	Collection and commercial distribution of precise location information	Comparable location-data architecture without demonstrated AdFection participation	Official FTC enforcement proceeding
Mobilewalla	United States	Mobile advertising-derived location data and analytics	Particularly relevant comparator for advertising-data collection	Official FTC enforcement proceeding
Google advertising platforms	United States / global	Advertising exchange and distribution infrastructure	Platform connectivity documented; access subsequently terminated	Infrastructure relationship, not established malicious co-participation
Yandex advertising platforms	Russia / international operations	Digital advertising distribution and bidding	Substantial share of Discover-Tech’s analysed MyDSP bidding records	Documented technical integration; no proven knowing participation
Beeswax / FreeWheel / Comcast	United States	Advertising-buying technology	Documented Discover-Tech platform access and subsequent removal	Infrastructure intermediary
Vungle / Liftoff	International advertising technology market	Mobile advertising distribution	Documented integration and subsequent access review	Infrastructure intermediary
Eskimi	International advertising technology market	Advertising technology and campaign distribution	Documented advertising relationship and subsequent account restrictions	Infrastructure intermediary
Xandr / Microsoft advertising systems	United States	Advertising infrastructure and identity-related interoperability	Connections examined in Citizen Lab’s technical assessment	Infrastructure connection; culpability not established

The Discover-Tech-specific relationships are drawn from Citizen Lab’s October 2026 report and Confiant’s technical investigation; the broader spyware and data-broker comparisons are supported by U.S. Treasury and Federal Trade Commission records. Exposing AdFection — Citizen Lab — October 2026, Treasury Sanctions Members of the Intellexa Commercial Spyware Consortium — U.S. Treasury — March 2024, Gravy Analytics and Venntel Final Order — FTC — January 2025 and Mobilewalla Proceeding — FTC — January 2025.

Why the international corporate distinction matters

The similarities between these companies are neither uniform nor necessarily evidence of a shared commercial or intelligence network. Candiru and comparable spyware vendors offer capabilities directed towards compromising devices and accessing information that conventional advertising technologies cannot ordinarily obtain. Advertising-intelligence specialists derive value from the ability to collect, correlate and analyse commercially available identifiers and associated behavioural information, which can be operationally significant without requiring exploitation of a software vulnerability. Location-data brokers specialise in obtaining or processing geographic observations and making them useful to commercial or institutional customers, while advertising exchanges provide the transactional infrastructure through which advertising inventory and associated data are distributed.

Discover-Tech’s distinctive significance, as presented by Citizen Lab, is that these activities were brought into proximity through an advertising-facing intermediary. Its operations allegedly allowed the broader commercial advertising system to perform functions associated with surveillance access, while specialised spyware systems remained capable of acting on selected devices. This creates a much more demanding investigative problem than merely identifying which company produced a particular exploit, because evidence of responsibility may be distributed across advertising accounts, software suppliers, intermediate domains, cloud services, corporate vehicles, contractual counterparties and end-customer organisations.

For corporate intelligence purposes, the relevant market should therefore be mapped through both vertical and horizontal relationships. Vertical analysis must follow the functional progression from advertising inventory and user identification to device-level access and subsequent information extraction; horizontal analysis must identify entities with common shareholders, directors, beneficial owners, technologies, personnel, distributors and customers. A credible global register will also distinguish historical corporate links from current ownership and technical interoperability from contractual cooperation. None of these relationships can be inferred from geographic proximity, nationality or similar product descriptions alone.

The Technical Relationship — How Commercial Advertising Can Become a Surveillance Channel

The relevant architecture contains five distinguishable functional stages.

ANALYTICAL DEPENDENCY MODEL — NON-OPERATIONAL OVERVIEW

Publisher website or mobile application

An advertising opportunity arises when a page or application requests commercial advertising content.

Advertising exchange and bidding infrastructure

Bid requests and associated signals may expose device, network, application and advertising-identifier information to participating parties.

Discover-Tech advertising intermediation

MyDSP and associated buying arrangements connect advertising opportunities with Discover-Tech-controlled delivery and targeting functions.

Controlium and selective response mechanisms

Advertiser-controlled scripts and device identifiers support profiling and the selection of devices for further processing.

Downstream surveillance and exploitation capability

The documented Candiru-linked pathway could deliver malicious code to selected targets without advertisement interaction; successful compromise requires additional technical conditions.

Reconstructed from the functional relationships established in Citizen Lab’s technical investigation. The sequence is explanatory, not a claim that every advertising impression proceeds to spyware execution.

The first distinction is between surveillance arising from access to advertising transaction data and surveillance arising from code delivered through an advertisement. In the former case, an actor may obtain enough information to identify or infer patterns associated with a device without displaying the ultimate advertisement to the user. In the latter case, the successful placement of advertising content introduces an additional technical opportunity: the execution of code associated with that content, subject to the applicable browser, application and advertising-platform security boundaries.

The second distinction concerns targeted selection. Advertising systems normally allow campaigns to distinguish among broad audiences based on commercial characteristics, but sufficiently detailed identifiers and auxiliary data can make it possible to focus on an individual device or a very small group of devices. Citizen Lab documents a Discover-Tech-controlled server arrangement that could return different responses depending on observed identifiers and other request characteristics. Such selectivity has two intelligence consequences: it permits concentration of expensive technical capabilities on selected targets, and it complicates detection because ordinary observers, automated advertising scanners and unrelated users need not receive the same code.

The third distinction concerns the relationship between running advertising code and compromising the device’s operating system. The ability to execute JavaScript in an advertising context does not automatically confer unrestricted access to personal messages, stored documents, microphones or protected application data. Those outcomes require additional weaknesses, exploit chains, permissions or other compromise mechanisms. The AdFection investigation is important precisely because it connects ordinary advertising delivery to a more specialised exploitation capability in documented cases, not because advertising scripts inherently possess the privileges of full spyware.

Confiant’s investigation adds evidence of a sophisticated malicious code framework involving device fingerprinting, behavioural observation, encrypted communications and dynamically controlled functions. Those features explain why inspection of a static advertising image would be inadequate for understanding the associated surveillance risk: the materially important behaviour could be delivered or changed after the visible advertisement had loaded, while additional technical measures limited what intermediary platforms and researchers could observe. ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming — Confiant — October 2026.

Competing Explanations and Intelligence Assessment

The present evidence supports examination of three competing, although partially overlapping, explanations of Discover-Tech’s role. The purpose is not to manufacture uncertainty about the technical findings, but to distinguish what those findings establish from what would require access to internal financial, contractual or operational records.

Hypothesis	Diagnostic support	Disconfirming or limiting evidence	Indicators requiring examination	Current standing
H1 — Deliberately constructed surveillance intermediary	Dedicated targeting infrastructure, links with specialised surveillance vendors, highly selective code delivery and documented Candiru-linked attacks	Internal strategy, contracts and complete customer instructions are not publicly established	Corporate communications, contracts, revenue composition, customer authorisations and detailed deployment records	Strongly supported as the functional interpretation advanced by Citizen Lab; full corporate intent remains incompletely documented
H2 — Commercial advertising provider subsequently exploited by surveillance customers	Legitimate advertising mechanisms can be technically repurposed, and individual customers may control downstream code	The reported architecture and multiple surveillance-industry connections are difficult to reconcile with purely incidental misuse	Contractual division of control, historical development records and evidence of internal knowledge	A narrower alternative that requires further evidence
H3 — Commercial surveillance service within a broader state-directed operation	Relevant spyware vendors have documented government-customer histories, and the documented campaign involved strategically important targets	No publicly reviewed record establishes a specific state as the director of the overall Discover-Tech operation	Government procurement, authenticated customer contracts, lawful investigative findings and attributable operational records	Plausible for specific campaigns, but not established as an overall explanation

The strongest current assessment concerns the technical and functional role of Discover-Tech, rather than the identity of every ultimate customer or governmental beneficiary. Its documented infrastructure supported surveillance-relevant collection and the delivery of malicious code associated with a mercenary spyware vendor, while the ownership, purchasing and operational arrangements of particular campaigns remain a distinct matter for investigation. Although governmental customers are relevant to the commercial spyware market, an analyst cannot identify the state responsible for a particular operation from a spyware company’s nationality, the geography of its targets or its known historical customers.

This limitation is especially important in the Al Jazeera case, because the presence of a strategically sensitive media organisation among the targets creates a substantial counterintelligence concern without independently identifying the contracting authority or political purpose behind the attacks. A defensible attribution would require converging evidence concerning command decisions, financing, customer access, operational timing and technical control, not merely an inference from regional political relationships.

Institutional Exposure — Initial International Assessment

United States: intelligence risk within commercial data markets

The American regulatory record provides some of the clearest official evidence that commercial data collection can present a significant national-security problem independently of the deployment of spyware. In its proceedings against Gravy Analytics and Venntel, the Federal Trade Commission examined the collection and sale of sensitive location information, including information associated with visits to medical facilities and places of worship, and finalised restrictions in January 2025. The Commission’s proceedings involving Mobilewalla and X-Mode/Outlogic further demonstrate that the governance of commercial location information is not an isolated issue involving a single provider.

These cases do not establish that the companies operated like Discover-Tech or supplied spyware. They establish something analytically different but closely related: sensitive intelligence can be derived from information generated for commercial purposes and distributed through ordinary business relationships. That observation has consequences for defence procurement, mobile-device policy and the governance of external advertising-data suppliers, particularly where organisations rely on contractual assurances that do not provide visibility into downstream transfers.

FTC Finalizes Order Prohibiting Gravy Analytics and Venntel from Selling Sensitive Location Data — Federal Trade Commission — January 2025.

European Union: fragmented supervision of an integrated technical threat

The European challenge arises from the fact that an advertising transaction can involve a publisher in one jurisdiction, an exchange in another, a demand-side platform elsewhere and additional data recipients whose identity or eventual purpose is not necessarily apparent to the person concerned. The corresponding legal issues span the definition of personal data, the lawful basis for processing, purpose limitation, consent, security measures, responsibilities among controllers and processors, and potentially the criminal investigation of unauthorised computer access.

The Court of Justice of the European Union’s judgment of 7 March 2024 in Case C-604/22, IAB Europe v Gegevensbeschermingsautoriteit, provides an important legal foundation concerning consent-related data and controller responsibility in the advertising ecosystem. The legal relevance of the judgment must nevertheless be distinguished from the merits of the Discover-Tech allegations: it does not constitute a finding that Discover-Tech committed an infringement, nor does it automatically determine the responsibility of every advertising participant whose technology was used.

The strategic regulatory issue concerns the gap between compliance frameworks primarily designed to govern the processing of personal information and the additional cyber-espionage risk created when the same infrastructure allows downstream execution of selectively delivered code. Effective supervision must therefore be capable of examining both information disclosure and executable content, while preserving the differences between the legal obligations of publishers, exchanges, advertising purchasers and actors deploying spyware.

Judgment in Case C-604/22, IAB Europe v Gegevensbeschermingsautoriteit — Court of Justice of the European Union — March 2024.

Italy, France, Germany and the United Kingdom: differentiated priorities

Italy should be examined through the exposure of public administration, diplomatic communications, defence-industrial organisations, strategic manufacturers, financial services and internationally connected technology suppliers. The central intelligence question is not whether Italian institutions appeared in a particular advertising dataset, something that cannot be generalised without supporting records, but whether existing security and procurement arrangements provide sufficient visibility over advertising software, external tracking dependencies, identity leakage and third-party code execution. The institutional assessment must ultimately reconcile the responsibilities of the national cybersecurity authorities, personal-data protection authorities and sector-specific supervisors.

France presents a particularly important regulatory comparison because the Commission nationale de l’informatique et des libertés has developed an enforcement record relating to personalised advertising and consent. In June 2023, the CNIL announced a €40 million sanction against Criteo concerning failures including verification of user consent. That case concerns advertising-data compliance, not spyware delivery, but demonstrates the ability of a national regulator to investigate the practices of a commercially significant advertising company. The French national-security inquiry should separately examine defence, government communications and strategic-industry exposure rather than interpreting privacy enforcement as evidence that those systems have been protected from offensive advertising-based operations.

Germany requires attention to the intersection of large industrial organisations, digitally integrated manufacturing, multinational supply chains and the distribution of privacy and cybersecurity responsibilities among European and domestic authorities. The strategic concern is the potential availability of behavioural and device-related information about employees working across industrial and research environments, particularly where device usage is linked to internationally accessible advertising services. The relevant intelligence methodology should examine advertising dependencies and actual technical exposure before drawing conclusions about particular German companies or facilities.

The United Kingdom offers a comparatively mature public record of regulatory concern regarding the structure of real-time bidding. Its Information Commissioner’s Office identified problems involving transparency, lawful processing and security years before the Discover-Tech disclosures, demonstrating that the underlying risks are not reducible to a newly discovered vulnerability. The 2026 case strengthens the argument that privacy and cybersecurity evaluations of advertising systems should be coordinated, with separate consideration of national-security consequences and the operational limitations of regulatory oversight.

The comparative European conclusion is that common advertising technologies can generate cross-border exposure even while the relevant national authorities retain different powers, investigative procedures and institutional priorities. Effective cooperation consequently depends on consistent technical definitions, common evidentiary standards and mechanisms for connecting advertising-platform incident information with national cybersecurity and intelligence responsibilities.

Principal Intelligence Gaps and Watch Indicators

The most important remaining questions concern attribution, financial relationships, the extent of technical compromise and the ability of advertising-industry countermeasures to interrupt comparable operations without simply displacing them to other platforms.

Priority	Consequential question	Record or observation needed	Strategic significance
Critical	Who purchased and directed particular spyware campaigns?	Authenticated contracts, procurement records, financial transactions and competent investigative findings	Establishes ultimate operational responsibility
Critical	How many devices were actually compromised beyond the documented Al Jazeera cases?	Independently examined forensic records, victim notifications and verified incident investigations	Distinguishes infrastructure exposure from successful intrusion
Critical	Which other commercial surveillance actors deploy equivalent advertising-based delivery mechanisms?	Technical investigations demonstrating actual code-delivery relationships and attributable corporate evidence	Determines whether AdFection is an isolated implementation or a recurring industry model
High	What was Discover-Tech’s beneficial ownership during each relevant period?	Historical corporate registry extracts, shareholder filings, director changes and authenticated ownership records	Separates corporate association from control
High	What financial relationship existed between Discover-Tech and identified surveillance vendors?	Audited accounts, contracts, payment records and verified procurement disclosures	Clarifies business model and operational dependence
High	Can advertising exchanges reliably detect selective malicious code delivery?	Independent platform-security assessments and documented enforcement outcomes	Determines whether commercial controls can materially reduce the threat
High	How does advertising-identifier deanonymisation affect sensitive institutions?	Authorised technical assessments and observed data-linkage outcomes	Measures counterintelligence exposure without extrapolating from advertising reach
High	Are current vendor exclusions effective and durable?	Updated vendor registries, account-status records and documented recurrence evidence	Distinguishes temporary disruption from sustained risk reduction

Five-year strategic outlook, 2026–2031

Three developments will be particularly important in determining whether the Discover-Tech case becomes a turning point in commercial surveillance regulation or remains one episode within a larger and insufficiently supervised market.

First, the continued commercial value of device identification and behavioural targeting creates incentives to maintain data flows that are useful to advertising and potentially valuable to intelligence operators. Even if a particular company’s accounts are terminated, those incentives remain unless the underlying conditions of data access, identifier exchange and executable advertising content change. Vendor exclusion should accordingly be evaluated as an immediate defensive action rather than presumed to eliminate the architectural vulnerability.

Second, the growing public record of official proceedings concerning location-data brokers and commercial spyware suppliers gives governments multiple existing intervention mechanisms, including data-protection enforcement, export controls, sanctions, cybersecurity regulation, procurement restrictions and criminal investigation. The effectiveness of these mechanisms will depend less on announcing additional prohibitions than on the capacity to identify operationally meaningful relationships among corporate entities, software infrastructure, intermediaries and end customers.

Third, the evolution of advertising platforms could move the risk in competing directions. Restrictions on cross-site identifiers, tighter validation of advertising code, greater transparency concerning recipients of bid information and improved isolation of advertising execution could reduce particular forms of surveillance exposure. Conversely, the emergence of substitute identification methods or new intermediaries could preserve meaningful intelligence collection even where traditional advertising identifiers become less accessible. A credible forecast therefore requires continuing observation of technical adoption, enforcement outcomes and newly documented incidents; the present record does not support precise probabilities for these competing pathways.

Initial Institutional Net Assessment

The October 2026 disclosures warrant treating advertising-derived intelligence and advertising-delivered exploitation as a connected strategic-security problem, but they do not justify categorising the entire global advertising industry as a malicious surveillance enterprise or assigning responsibility to companies solely because their infrastructure appears within a documented delivery chain.

The stronger analytical conclusion is that a market built to automate the identification, valuation and targeting of commercial audiences also provides technically valuable capabilities for intelligence collection. The Discover-Tech investigation establishes that those capabilities were combined, in documented circumstances, with infrastructure associated with mercenary spyware and with attacks against an internationally significant media organisation. The official American enforcement record concerning data brokers and spyware suppliers demonstrates that governments had already identified serious risks in adjacent markets before this disclosure; the new technical evidence makes the interaction between those markets more tangible and more consequential.

The highest-priority response is therefore an integrated institutional assessment of advertising-data exposure, third-party code execution, external vendor relationships and the intelligence value of the information disclosed by ordinary digital services. Such a response must be supported by verifiable evidence and legally competent authorities, while recognising that an institution may face meaningful counterintelligence exposure even without any confirmed successful device infection.

The subsequent chapters will develop the technical mechanisms, corporate ownership questions, worldwide company comparisons, financial relationships, jurisdictional implications and defensive options individually, with the distinction between established fact and analytical inference maintained throughout.

---

PILLAR I — THE DISCOVER-TECH ARCHITECTURE: TECHNICAL MECHANISMS, CORPORATE STRUCTURES AND OPERATIONAL EVIDENCE

Primary technical investigations: Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware — Citizen Lab, University of Toronto, 15 October 2026 and ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming — Confiant, 15 October 2026.

The four chapters examine the economic and historical architecture of advertising intelligence, reconstruct Discover-Tech’s corporate development and commercial relationships, distinguish the technical mechanisms through which advertising becomes an intelligence and exploitation channel, and assess the operational evidence concerning Candiru, Al Jazeera and geographically dispersed institutional exposure. The analysis distinguishes corporate registration evidence, platform documentation, observations made by cybersecurity researchers, formal institutional decisions and conclusions that remain dependent on records not publicly available.

Chapter 1. From Commercial Advertising to Intelligence Collection: Historical Development of ADINT and the Global Real-Time Bidding Economy

The transformation of advertising markets into an infrastructure for the collection and distribution of behavioural information

The emergence of advertising intelligence, increasingly described by researchers and commercial practitioners as ADINT, should be understood as the consequence of a long technological transformation in which digital advertising progressively ceased to depend primarily on the content of a particular publication and acquired the capacity to identify, classify and pursue individual users across unrelated digital environments. This transformation created a commercial infrastructure capable of associating advertising identifiers with device characteristics, network connections, application usage, geographic signals and behavioural observations, while distributing information among multiple technologically specialised intermediaries whose commercial relationships are not ordinarily visible to the individual concerned.

Historically, advertising publishers sold access to audiences defined by the characteristics of newspapers, television programmes, websites or demographic groups. The expansion of internet advertising introduced increasingly granular mechanisms for measuring impressions, associating browsing activity with persistent identifiers and purchasing access to selected audiences rather than to an entire publication. Programmatic advertising subsequently automated much of this process by establishing technological relationships among publishers, advertising exchanges, supply-side platforms, demand-side platforms, measurement providers, identity-resolution services and advertising customers.

This development profoundly changed the information economics of advertising. A transaction no longer required an advertiser merely to purchase a visible position on a website; the decision to purchase could depend on an automated assessment of information describing the device, the digital environment and, where available, the likely identity or attributes of the user. In markets implementing real-time bidding, an advertising opportunity can therefore initiate the distribution of bid-related information before the advertising placement has been awarded. The infrastructure consequently possesses an intelligence value distinct from the commercial value of the advertisement itself.

The October 2026 Citizen Lab investigation establishes that this distinction is central to the Discover-Tech case. The researchers describe an advertising system in which information obtained through advertising transactions could support large-scale profiling and the selection of particular devices for additional activity. The technical relevance of the findings lies in the ability of an intermediary to participate in ordinary advertising processes while integrating those processes with more specialised surveillance infrastructure. Exposing AdFection — Citizen Lab, Section 1, October 2026.

The architecture of real-time bidding and the movement of commercially generated intelligence

Real-time bidding operates through automated interactions in which an advertising opportunity is evaluated and potentially purchased within a very short period. A publisher or application creates an opportunity to display advertising content, an intermediary represents that opportunity to prospective purchasers, and demand-side systems assess whether the available information corresponds to the targeting requirements and commercial valuations of their customers. The winning participant, subject to the applicable auction rules and technical arrangements, obtains the opportunity to display the advertising creative.

The essential security issue is that the information distributed during this process can possess independent analytical value. Even where the transaction does not result in an advertisement being displayed by a particular prospective purchaser, some information describing the opportunity may already have been transmitted to that prospective purchaser or to supporting infrastructure.

The precise contents of bid requests depend on the relevant advertising protocol, platform implementation, consent status and device environment. They should not be treated as universally identical, and the presence of a particular data field in an industry specification does not establish that it was transmitted in every transaction. Nevertheless, advertising protocols explicitly contemplate the exchange of information relating to advertising inventory, application or website context, devices, network characteristics and available identifiers.

The Interactive Advertising Bureau Tech Lab’s OpenRTB framework provides a technical reference for understanding these processes. Its importance to the present investigation is that it formalises the machinery by which information can be distributed to advertising buyers and other participants in automated transactions. It does not independently prove that any particular actor unlawfully obtained information, but it establishes the commercial protocol environment in which advertising-based intelligence collection can occur. OpenRTB 2.6 Specification — IAB Tech Lab.

Table 1.1 — Commercial advertising components and their counterintelligence relevance

Component	Ordinary commercial function	Information or capability relevant to intelligence	Principal security distinction
Publisher website	Provides content and advertising inventory	Context of the visit, page environment and opportunities for third-party content delivery	Exposure of advertising content does not itself prove identity resolution
Mobile application	Incorporates advertising through application interfaces or SDKs	Application context, mobile identifiers and device-related signals where accessible	App-level permissions and SDK integration differ from ordinary browser advertising
Supply-side platform	Helps publishers make inventory available to buyers	Distribution of transaction information to prospective purchasers	Visibility into bidding participants and onward transfers is material
Advertising exchange	Facilitates automated auctions	Receives and transmits bid-related information and identifies transaction participants	A recorded auction is not equivalent to a successful advertising impression
Demand-side platform	Evaluates and purchases advertising opportunities	Combines targeting criteria with available identifiers and campaign data	A legitimate DSP can be misused without every DSP being a surveillance vendor
Identity-resolution provider	Connects identifiers associated with devices, browsers or services	Potential association of otherwise separate observations	Identity matching can be probabilistic, outdated or erroneous
Data-management platform	Organises audience information and segments	Creation of profiles based on multiple data sources	Aggregated audience data are not necessarily anonymous
Tracking pixel	Records an event or initiates an associated request	Network metadata, identifier retrieval and interaction signals	Visibility depends on browser restrictions, permissions and implementation
Advertising creative	Presents visual or interactive content	Possible execution of third-party content in the advertising context	Code execution within an advertisement is not automatically operating-system compromise
Attribution service	Measures advertising outcomes	Links advertising exposures with subsequent activity	Correlation may expose behavioural relationships beyond a single site
Fraud-detection service	Identifies automated or suspicious activity	Browser characteristics, execution behaviour and fingerprinting signals	Legitimate anti-fraud collection can resemble reconnaissance at the level of individual technical features
Advertising-data broker	Acquires or markets information derived from commercial data flows	Potential reconstruction of movement patterns and recurring identities	Brokerage does not establish malware delivery or participation in an attack

This classification provides a more accurate basis for national-security analysis than grouping all companies working with advertising identifiers into a single surveillance category. The same technical observation can have different significance depending on the actor’s authority, the information retained, the purposes for which it is processed and whether it is subsequently linked to other data or offensive capabilities.

The emergence of ADINT as a distinct intelligence discipline

ADINT is not a legally standardised intelligence discipline with a universally accepted institutional definition. In the present assessment it denotes the deliberate acquisition, correlation and exploitation of information generated by digital advertising systems for intelligence purposes, rather than for the ordinary sale, delivery, attribution or measurement of advertisements.

This definition is important because advertising intelligence overlaps with, but is not identical to, several more established fields. Signals intelligence generally concerns intelligence derived from signals or communications; cyber threat intelligence concerns knowledge about cyber threats and their technical or organisational characteristics; open-source intelligence draws upon publicly or commercially available information obtained through lawful means; and commercial location intelligence may derive from information generated by mobile applications and associated data intermediaries. ADINT occupies an intersection among these activities without necessarily adopting their institutional mandates, legal authorisations or evidentiary practices.

The distinctive property of advertising-derived intelligence is its access to an economy in which the movement of information about devices and users occurs continuously as part of routine commercial transactions. An intelligence customer does not necessarily require a direct relationship with the publisher visited by an individual or with the application installed on that individual’s device. Depending on the commercial access available and the advertising systems involved, a participating intermediary can observe or receive transaction-related information from a substantial number of otherwise unrelated digital properties.

That distinction explains why the history of advertising intelligence cannot be reconstructed solely through the history of commercial spyware. Spyware vendors specialise in gaining access to devices and protected information, whereas advertising intelligence may operate without bypassing operating-system security. The convergence becomes particularly consequential when commercially acquired identity or device information is used to select a target for subsequent technical exploitation, creating a potential progression from identification and reconnaissance to device compromise.

The Discover-Tech investigation provides a documented example of such convergence, but the historical record supports a narrower conclusion than the assertion that ADINT originated with Discover-Tech. The components of the relevant system—programmatic advertising, audience identification, identifier synchronisation and commercial location-data processing—were already established before the company’s incorporation in 2020.

The regulatory recognition of advertising-data exposure before the Discover-Tech investigation

Concerns about the security and lawful processing of information within real-time bidding did not originate with the 2026 disclosure. In June 2019, the United Kingdom Information Commissioner’s Office published its examination of adtech and real-time bidding, identifying significant problems involving transparency, lawful bases for processing, special-category data and data security.

The significance of that earlier regulatory examination is not that it anticipated every feature of AdFection, but that it demonstrated institutional awareness of structural weaknesses in a commercial system through which personal data could be distributed across complex chains of intermediaries. The later emergence of documented spyware delivery through advertising infrastructure therefore constitutes an escalation in the demonstrated consequences of a longstanding information-governance problem.

The intervening period also witnessed increasing regulatory attention to commercial location-data brokerage. In the United States, the Federal Trade Commission’s investigations of location-data businesses established that information derived from mobile devices could expose visits to sensitive places and could be handled in ways that violated applicable consumer-protection requirements. These proceedings concern different commercial conduct from the Candiru attacks, but they are relevant to the same strategic problem: the availability of information generated in everyday digital activity to organisations that were never the user’s intended service provider.

The European legal position also evolved through litigation concerning the classification and responsibility associated with advertising consent information. In its judgment of 7 March 2024 in Case C-604/22, the Court of Justice of the European Union addressed questions involving the IAB Europe’s Transparency and Consent Framework and the circumstances in which information encoded in a consent string can constitute personal data. The judgment is important to the allocation of responsibility within advertising systems, although it does not determine the legality of the Discover-Tech operation or the culpability of unrelated advertising vendors.

Relevant institutional records are the ICO Update Report into Adtech and Real Time Bidding — Information Commissioner’s Office, June 2019, Judgment in Case C-604/22 — Court of Justice of the European Union, 7 March 2024 and FTC Finalizes Order Prohibiting Gravy Analytics and Venntel from Selling Sensitive Location Data — Federal Trade Commission, January 2025.

Table 1.2 — Historical development and institutional milestones

Period	Development	Documentary basis	Significance for ADINT
2010s	Expansion of programmatic advertising, audience targeting and automated exchanges	IAB technical standards and historical industry documentation	Establishment of large-scale automated distribution of advertising information
2016	Matomy launched the MyDSP platform	Historical Matomy documentation examined by Citizen Lab	Establishes that important technology later associated with Discover-Tech predates the company
2018	Matomy sold MyDSP to Marketcom Technologies	Transaction disclosures examined by Citizen Lab	Demonstrates that advertising infrastructure may pass between successive corporate owners
June 2019	UK ICO examined data protection issues in real-time bidding	ICO regulatory report	Formal recognition of structural privacy and security concerns
March–October 2020	Discover-Tech incorporated and acquired control of domains associated with MyDSP	Israeli corporate records and historical domain evidence examined by Citizen Lab	Entry of a new corporate entity into an established advertising infrastructure
November 2021	United States added Candiru to the Entity List	U.S. Department of Commerce	Official export-control recognition of risks associated with commercial spyware
March 2024	EU Court of Justice ruled in Case C-604/22	CJEU judgment	Clarified important aspects of personal-data classification and controller responsibility
2024–2025	Candiru-linked attacks against Al Jazeera documented	Network records examined by Citizen Lab	Evidence of advertising-mediated spyware attacks against selected devices
January 2025	FTC finalised restrictions concerning Gravy Analytics and Venntel	FTC final order	Official enforcement concerning sensitive commercial location data
April–September 2026	Confiant analysed Discover-Tech advertising activity	Confiant technical report	Detailed evidence of surveillance-oriented advertising code and selective delivery
October 2026	Citizen Lab and Confiant published their investigations	Technical reports dated 15 October	Public documentation linking advertising infrastructure to mercenary spyware delivery

The historical sequence reveals a major analytical distinction between technological creation and operational weaponisation. MyDSP was not originally created in 2026 for the AdFection campaign, and the publicly available history does not support treating every earlier corporate owner of the platform as responsible for subsequent malicious use. Instead, the case demonstrates how an established commercial system could remain valuable through changes in ownership, corporate structure and market access, while later being incorporated into an activity with substantially different security implications.

The economic logic of advertising intelligence

Advertising intelligence benefits from an underlying commercial arrangement that differs fundamentally from the economics of traditional device-targeted cyber intrusion. A specialised offensive cyber capability may require considerable investment in exploit research, vulnerability acquisition, infrastructure and operational support, whereas participation in programmatic advertising provides access to an existing market in which millions of impressions and transactions can be purchased, assessed or observed through standardised systems.

This does not mean that advertising-derived surveillance is free or that the public record establishes Discover-Tech’s actual expenditure. Advertising inventory has a commercial price; exchanges may impose fees and restrictions; technical delivery requires infrastructure; and operators attempting to identify particular devices can experience substantial uncertainty concerning the accuracy and persistence of identifiers. Nevertheless, the broader economic mechanism is significant because advertising infrastructure can separate the comparatively inexpensive task of encountering candidate devices from the more specialised and potentially expensive task of compromising a selected target.

The result is a potential asymmetry between reconnaissance scale and exploitation scale. An operator may examine very large numbers of advertising opportunities while choosing to deploy additional code against only a small subset. Consequently, an assessment based solely on the total number of malicious exploit attempts could underestimate the importance of the underlying intelligence collection, whereas an assessment that treats every advertising bid as a successful surveillance event would overestimate actual impact.

The available evidence also shows why a conventional marketing interpretation of campaign performance is inadequate. In ordinary advertising, a company typically evaluates impressions, click-through rates, conversions and customer-acquisition costs. In a surveillance-oriented operation, the decisive outcome may instead be the identification of a device, the association of identifiers, the confirmation that a target is active or the establishment of a suitable opportunity for subsequent exploitation. The visible advertisement can therefore become incidental to the operator’s actual objective.

Table 1.3 — Comparison of conventional advertising and advertising-derived intelligence

Analytical dimension	Conventional advertising	Advertising intelligence	Advertising-mediated spyware operation
Principal objective	Promote products and services	Collect and correlate information about users or devices	Obtain intelligence and potentially compromise selected devices
Primary success measure	Commercial campaign performance	Quality and continuity of intelligence-relevant observations	Target identification, successful access and operational objectives
Identity requirements	Audience segmentation or attribution	Persistent or probabilistic identification	Reliable selection of intended target
Geographic information	Regional commercial targeting	Movement patterns and location-related intelligence	Target localisation and suitable operational opportunities
Value of an advertisement click	Often commercially important	May be unnecessary	May be unnecessary
Value of an unsuccessful bid	Primarily commercial decision information	Potentially useful if bid data are available	Potentially useful for reconnaissance
Third-party code	Advertising measurement and presentation	Profiling and collection functions	Possible delivery path for specialised malicious content
Organisational risk	Privacy and compliance exposure	Counterintelligence and data-security exposure	Device compromise and potentially broader institutional intrusion
Evidentiary requirement	Advertising records and business documentation	Verified data flows and collection behaviour	Technical evidence linking delivery with attempted or successful exploitation

The analytical importance of the table is that it identifies a continuum of technical capability without assuming that every participant progresses through all three categories. A company can operate a demand-side platform without conducting intelligence collection, an intelligence provider can use advertising-derived information without possessing spyware, and a spyware vendor can compromise devices through delivery methods unrelated to advertising.

The role of advertising certification and market access

One of the most important historical developments revealed by the Discover-Tech investigation concerns the commercial value of recognition within advertising-industry vendor registries. Citizen Lab reports that Discover-Tech appeared on Google advertising vendor lists and on IAB Europe’s Global Vendor List during the period beginning in 2020, with those listings continuing until the company’s removal in October 2026.

Such registrations are operationally important because large advertising markets rely on structured procedures for determining which vendors may participate, receive data or execute approved classes of third-party advertising functions. Recognition by a commercial platform may facilitate technical interoperability and the establishment of commercial relationships, although it should not be confused with a governmental security authorisation or an independent certification that a vendor is incapable of malicious conduct.

The investigative question is therefore whether screening procedures intended to verify vendor identity, policy compliance and technical compatibility are sufficiently capable of discovering the concealed use of advertising infrastructure for intelligence collection and offensive cyber operations. Discover-Tech illustrates the limits of interpreting vendor registration as a comprehensive security guarantee: the company reportedly maintained access for years before the findings published in October 2026 prompted its removal.

This does not establish that the advertising platforms knew the complete nature of Discover-Tech’s activities throughout that period. It establishes a discrepancy between the apparent legitimacy conferred by participation in commercial advertising infrastructure and the malicious activities subsequently identified through technical investigation.

The chronology, registration details and platform responses appear in Exposing AdFection — Citizen Lab, Sections 7 and 9, October 2026.

Chapter 1 — Key judgments

The historical development of ADINT is best understood as the intelligence-oriented exploitation of commercial capabilities that developed over many years, rather than as a wholly new technological category invented by the Discover-Tech operation. The decisive structural characteristic is the separation between obtaining information about advertising opportunities and displaying advertisements, combined with the ability to correlate identifiers across different digital environments. Regulatory investigations preceding October 2026 had already identified serious problems involving the distribution and commercial exploitation of personal data; the AdFection findings extend the demonstrated consequences of those problems into selective spyware delivery.

What would change the assessment: A fuller historical record of advertising-intelligence procurement, including authenticated earlier operational deployments and vendor contracts, could demonstrate that advertising-mediated spyware delivery was operationally established before the earliest public cases presently documented. Such evidence would change the historical assessment of the maturity of the technique without diminishing the significance of the Discover-Tech findings.

Open official record: The most important unresolved historical issues concern the extent to which government procurement and export-control records distinguish advertising intelligence from conventional location-data analytics and commercial spyware, and whether advertising-industry compliance audits before October 2026 documented warning indicators associated with the conduct later identified.

Chapter 2. Discover-Tech and Controlium: Corporate Identity, Ownership, Management, Infrastructure, Partners and Commercial Positioning

Principal judgment: Discover-Tech combined inherited advertising technology with corporate relationships extending into the commercial surveillance industry

The corporate history of Discover-Tech is strategically significant because the company did not emerge as an isolated technology start-up with an entirely new advertising product, but developed at the intersection of pre-existing advertising businesses, technology assets transferred through successive ownership arrangements, and individuals or corporate vehicles connected to the commercial surveillance industry. The resulting organisational structure provided a commercial explanation for its ability to operate in established advertising markets while creating substantial analytical difficulties in determining the exact relationship between historical ownership, current corporate control, technical infrastructure and operational responsibility.

The most important distinction is between Discover-Tech Ltd as a legally registered Israeli company, MyDSP as an advertising-technology asset with an earlier commercial history, and Controlium as the surveillance-oriented platform identified in the October 2026 investigation. These were not interchangeable entities or technologies, and their different origins explain important aspects of the company’s development.

Citizen Lab examined Israeli corporate records and reported that Discover-Tech Ltd was incorporated in March 2020, initially with Dekel Boni as director and sole shareholder. Its subsequent ownership and governance structure included individuals with backgrounds in advertising technology as well as relationships involving Eric Banoun and a British Virgin Islands company, Chaia Services Ltd, which researchers connected to the wider Intellexa corporate environment. Exposing AdFection — Citizen Lab, Section 7, October 2026.

Corporate formation and the chronological reconstruction of ownership

According to the company records examined by Citizen Lab, Discover-Tech Ltd was registered in March 2020 and its shareholder structure expanded shortly after incorporation. From April 2020, the reported shareholders included Dekel Boni, Guy Lants, Yaniv Basil, Zfanya Leib, Sergei Bartashevich and Chaia Services Ltd, a corporate vehicle registered in the British Virgin Islands.

Eric Banoun joined the board during the company’s early development and remained a director until January 2025. Chaia Services Ltd ceased to be a shareholder in March 2026. Citizen Lab reports that, as of July 2026, Discover-Tech was directed by Dekel Boni and owned by Boni, Basil and Lants.

This chronology is important because it places the company’s historical exposure to surveillance-industry relationships within a defined period, rather than implying that every individual or corporate vehicle identified in the investigation continued to exercise control on 17 October 2026. A shareholder’s historical participation may establish an ownership relationship at a particular date, while the implications of that shareholding depend on voting rights, beneficial ownership, contractual arrangements and actual managerial authority.

Table 2.1 — Discover-Tech corporate ownership and governance chronology

Date or period	Entity or individual	Documented role or event	Evidentiary significance
March 2020	Discover-Tech Ltd	Incorporation in Israel	Establishes the identifiable legal company
March 2020	Dekel Boni	Initial director and sole shareholder	Establishes initial registered control
April 2020 onward	Dekel Boni, Guy Lants, Yaniv Basil, Zfanya Leib and Sergei Bartashevich	Identified shareholders	Establishes expansion of the reported shareholder base
April 2020 onward	Chaia Services Ltd	British Virgin Islands corporate shareholder	Introduces an international corporate vehicle
2020–January 2025	Eric Banoun	Member of the board of directors	Documents a governance relationship involving a person associated with other surveillance businesses
January 2025	Eric Banoun	Departure from the board	Establishes an endpoint for that reported directorship
March 2026	Chaia Services Ltd	Ceased to be a shareholder	Establishes an ownership change preceding the public investigation
July 2026	Dekel Boni	Sole reported director	Establishes the latest governance position described in the reviewed research
July 2026	Boni, Basil and Lants	Reported company owners	Establishes the latest shareholder group described by Citizen Lab
October 2026	Discover-Tech Ltd	Subject of public technical investigations and subsequent advertising-platform restrictions	Documents a material change in commercial operating conditions

Source: Exposing AdFection — Citizen Lab, Section 7: Discover-Tech and Its Corporate Network, 15 October 2026.

The table reflects the corporate registry analysis published by Citizen Lab rather than a newly certified extract from the Israeli registrar. That distinction matters because the precise legal status of a company at a specified cut-off date is properly established through an up-to-date, authenticated registry record, while historical investigative reporting provides the basis for identifying the documents that require such verification.

Eric Banoun, Chaia Services and the distinction between an industry relationship and operational command

The reported participation of Eric Banoun in Discover-Tech’s governance is among the most consequential corporate findings because of his documented associations with other businesses in the commercial surveillance industry. Citizen Lab identifies Banoun as a co-founder of Circles and Senpai Technologies, with Senpai associated with the Intellexa consortium, while reporting that his relationship with Discover-Tech began shortly after incorporation.

This relationship establishes an important personnel connection across businesses specialising in different forms of surveillance technology. It does not, by itself, demonstrate that those businesses operated under a common command structure or that Banoun personally directed the advertising campaigns subsequently attributed to Discover-Tech.

The distinction is particularly important in evaluating Chaia Services Ltd. Citizen Lab describes the company’s registered location in the British Virgin Islands and cites earlier reporting concerning a director linked to Sara Hamou, who has been associated with the Intellexa corporate network. The researchers also state that they could not obtain the British Virgin Islands company’s underlying corporate registration information directly.

Consequently, the strongest defensible corporate conclusion is that the public record supports a meaningful historical connection between Discover-Tech and individuals or companies associated with the wider surveillance industry, while the precise beneficial ownership and voting control of Chaia Services during the relevant period remain incompletely established through the documents reviewed.

An investigative report should not substitute the existence of an offshore company for proof of concealment or illegality. The use of international corporate vehicles may serve numerous lawful purposes, including investment, asset ownership and cross-border financing. Their intelligence relevance in this case arises from the need to determine whether an identified company acted merely as an investment shareholder or formed part of a more extensive commercial, managerial or financing arrangement.

The origins of MyDSP and the transfer of advertising technology

The history of MyDSP provides an essential explanation for Discover-Tech’s ability to participate in large advertising markets relatively soon after its incorporation.

Citizen Lab traces the platform to Matomy, an Israeli advertising-technology company that launched MyDSP in 2016. The investigation records that Matomy sold the business to Cyprus-based Marketcom Technologies Ltd in 2018, with the asset subsequently associated with Glispa, the Berlin-based advertising business linked to Market Group.

The transition to Discover-Tech is visible through historical domain-registration evidence and advertising-provider records, although Citizen Lab reports that the precise transaction or arrangement by which Discover-Tech obtained the platform has not been fully established.

The technical continuity is particularly evident in Google’s advertising-provider documentation, which recorded a change involving provider identifier 3036 on 31 July 2020, when the provider name changed from MarketDSP to Discover-Tech Ltd while the relevant platform domains remained associated with the provider entry.

This is an important finding because continuity of a domain, platform identifier or technology asset can establish a relationship between successive commercial operators without proving that the companies were identical legal entities. It also demonstrates why historical infrastructure analysis must distinguish corporate control from software provenance.

Table 2.2 — MyDSP technology provenance and corporate transitions

Year	Company or asset	Identified development	Documentary significance
2016	Matomy / MyDSP	Launch of MyDSP advertising technology	Establishes original platform history
2018	Matomy / Marketcom Technologies Ltd	Sale of MyDSP	Documents transfer of a pre-existing advertising asset
2019	MyDSP / Glispa	Historical website associated the platform with Glispa	Supports continuity within the advertising-business network
March 2020	Discover-Tech Ltd	Israeli company incorporated	Establishes later acquiring or operating entity
June–October 2020	MyDSP and associated domains	Historical domain records indicate transfer to Discover-Tech	Establishes control over relevant infrastructure
31 July 2020	Google advertising provider ID 3036	Provider identity changed from MarketDSP to Discover-Tech Ltd	Documentary continuity of advertising-platform registration
2023–2026	Discover-Tech / MyDSP	Continued links through vendor registrations and platform infrastructure	Supports continued operation under Discover-Tech
October 2026	Google / Discover-Tech	Access terminated following the investigation	Establishes commercial platform action, not a historical ownership change

Source: Exposing AdFection — Citizen Lab, Section 7: Tracing the Origins of Discover-Tech’s MyDSP Advertising Tech.

The historical platform literature cited by Citizen Lab also reported substantial commercial capabilities before the transfer to Discover-Tech. A 2018 MyDSP website described access to 50 billion daily advertising impressions and the capacity to target 500 million users. Those figures are historical vendor claims about accessible advertising inventory and potential targeting capacity, rather than verified counts of unique people reached or monitored by Discover-Tech in 2026.

Their principal significance is therefore industrial rather than operational: the advertising technology entering Discover-Tech’s corporate environment had already been designed for participation in large-scale programmatic markets. The later misuse of such infrastructure did not require the company to create a worldwide advertising distribution system from nothing.

RelevanTech, Glispa Discover and the mobile-device distribution business

A second historical strand concerns RelevanTech Ltd, which Citizen Lab traces to Dekel Boni and Yaniv Basil in 2015. The business was associated with mobile-device application discovery and recommendation services, later entering the Glispa corporate environment and becoming associated with the Glispa Discover brand.

This history is relevant because Discover-Tech’s public commercial descriptions were not confined to programmatic advertising. Its website also described services involving mobile operators and device manufacturers, including the promotion, recommendation and distribution of applications on mobile devices.

An archived 2022 description referred to placing applications on newly activated devices and supporting operator-certified installations, while historical company material identified mobile operators and manufacturers among its commercial customers.

Citizen Lab identified a 2021 contractual connection involving the Serbian subsidiary of A1 Telekom Austria and a mobile application through which customers could access operator services. This evidence supports a historical commercial relationship, but does not demonstrate that the application contained surveillance code or that A1 knowingly participated in the later operations investigated in 2026.

This distinction is indispensable because device manufacturers and telecommunications operators occupy commercially and technically sensitive positions. Their access to device-distribution channels may create important commercial advantages, but any claim that such access was exploited for espionage requires evidence relating to the particular software, contractual implementation and relevant operational period.

The subsequent sale of business assets to Affle further demonstrates why historical marketing descriptions cannot simply be treated as evidence of Discover-Tech’s operating capabilities in October 2026.

The 2021 Affle transaction and the separation of acquired assets from alleged surveillance operations

Citizen Lab identifies a transaction in 2021 in which Affle MEA FZ-LLC, part of the Affle group, acquired business assets from Discover-Tech Ltd. The transaction involved a mobile-device marketing platform associated with application discovery, recommendations and initial device customisation.

The financial documentation cited by the researchers describes assets including intellectual property, branding, domains, commercial relationships and goodwill. Such terminology is relevant because an asset acquisition does not necessarily constitute the acquisition of the selling company’s shares, liabilities, remaining operations or managerial control.

Citizen Lab expressly states that it has no reason to believe Affle controlled the malicious advertising operations under investigation, while acknowledging that the complete scope of the asset sale was not established.

Accordingly, Affle belongs in a corporate-transaction reconstruction, but not in a list of confirmed participants in the AdFection operation. The distinction is not a matter of caution alone; it follows from the legal difference between acquiring specified business assets and assuming control over a separate company’s subsequent activities.

The transaction and its limitations are described in Exposing AdFection — Citizen Lab, Section 7: A Sale of Assets Leaves Open Questions, October 2026.

Table 2.3 — Corporate relationships and limits of attribution

Entity	Nature of documented relationship	Time reference	What the relationship establishes	What it does not establish
Matomy	Original developer of MyDSP	2016	Technology provenance	Participation in 2024–2026 attacks
Marketcom Technologies	Historical purchaser of MyDSP	2018	Asset-transfer history	Responsibility for subsequent Discover-Tech activity
Glispa	Historical corporate and technology association	2010s	Advertising-business continuity	Current control over Discover-Tech
RelevanTech	Earlier company associated with Discover-Tech founders	From 2015	Personnel and commercial origins	That all earlier products were surveillance products
Chaia Services Ltd	Former Discover-Tech shareholder	2020–March 2026	Historical offshore corporate shareholding	Complete beneficial ownership or operational command
Eric Banoun	Former Discover-Tech director	2020–January 2025	Governance and surveillance-industry personnel connection	Direction of a particular attack
Affle MEA FZ-LLC	Acquired specified business assets	2021	Documented business transaction	Ownership or participation in the AdFection operation
Intelos	Technical, historical website and personnel connections	Periods examined by Citizen Lab	Substantial investigative relationship	Participation in every Discover-Tech campaign
Adtimizer	Domains and infrastructure relationships examined by researchers	2026	Technical relationship requiring explanation	Knowing participation in spyware delivery
Volasim	Commercial relationship and infrastructure associated with advertising activity	2026	Documented advertising relationship	Authorisation or knowledge of spyware deployment

Controlium as an operational platform rather than a conventional advertising dashboard

Controlium is the decisive differentiating element in the company’s identified technology architecture. Citizen Lab obtained access to frontend source code published by the platform and reconstructed functionality showing that the system was designed to manage controlled advertising campaigns, select delivery platforms and associate advertising content with target identifiers and downstream responses.

The significance of this discovery is that Controlium appears to connect functions usually distributed across separate commercial and surveillance systems. A conventional advertising interface allows customers to define campaigns, upload creatives and select advertising inventory. Controlium contained those familiar elements but also exposed functionality relating to target identifiers, specialised response delivery, campaign restrictions and the association of particular users with controlled advertisements.

Citizen Lab documented an administrative interface through which customers could be restricted by campaign volumes, target countries and domains or applications where advertising could appear. Its customer-facing modules included functions for generating advertisement tags, selecting advertising delivery platforms, uploading creatives and associating campaign identifiers with specified users.

Such a platform has implications extending beyond an individual spyware campaign because it suggests the possibility of repeatable service delivery to multiple customers, although the exact contractual arrangements and operational instructions for those customers are not publicly established.

It is especially important not to confuse the existence of a feature visible in source code with proof that the feature was actively used in every documented campaign. The interface establishes intended or implemented platform functionality; its actual operational use must be assessed through logs, telemetry, customer records or observed network behaviour.

Exposing AdFection — Citizen Lab, Section 3: Exposing Discover-Tech’s Controlium, October 2026.

Table 2.4 — Controlium’s documented functional modules

Platform component	Documented function	Security significance	Evidentiary boundary
Administrative customer management	Configures customer accounts and restrictions	Supports differentiated access to platform functions	Does not identify every real-world contracting entity
Country restrictions	Limits advertising activity by country	Supports geographically constrained campaigns	Does not prove campaign attribution to a particular government
Domain and application lists	Restricts advertising to particular publishing environments	Permits inventory selection	Does not establish exploitation of every listed environment
Tag Generator	Associates advertising content with delivery and measurement elements	Connects ordinary advertising presentation with additional requests	Does not establish that every generated tag was malicious
Creative Upload	Configures advertising creatives and delivery arrangements	Supports deployment through several buying platforms	Does not establish actual delivery volumes without independent records
Campaigns module	Associates controlled advertisements with user identifiers and response categories	Indicates individualised targeting capability	Does not prove successful exploitation
Identity-related options	Includes functions associated with external user identifiers	Relevant to cross-platform identity resolution	Exact meaning of some options remains uncertain
NOAS response arrangement	Provides selective code responses associated with advertising events	Creates a separation between visible advertisements and downstream code	Successful operating-system compromise requires additional evidence
Authentication system	Controls nominal access to platform functions	Security weakness reported in implementation	Vulnerability discovery does not establish unauthorised third-party access

Citizen Lab also identified weaknesses in Controlium’s authentication implementation and publicly accessible endpoints. The researchers explained that they avoided exploiting an identified authentication weakness because doing so would have constituted unauthorised access. This methodological restraint is relevant to the reliability of the investigation: the researchers relied on publicly exposed information and observed infrastructure rather than claiming unrestricted access to internal corporate systems.

Corporate infrastructure relationships: Wix accounts, hosting and advertising identifiers

An especially significant component of the investigation concerns the identification of relationships among corporate websites through publishing-account metadata and infrastructure characteristics.

Confiant identified a shared Wix website-publication account associated with Discover-Tech and Tekma, while Citizen Lab found that the Discover-Tech and Intelos websites had historically shared a Wix account. The Citizen Lab report identifies the common account identifier a620bcc2-0237-4cbc-94c2-219ab49bed45 across several websites and periods.

A common website-publication account is stronger evidence of administrative coordination than two websites merely sharing a commercial hosting provider, because it suggests access through the same website-management environment. Nevertheless, it does not conclusively establish that the websites belong to the same legal company or that their operators are identical. Shared service providers, contractors and historical account arrangements are potential alternative explanations that require evaluation against other evidence.

The investigation’s significance derives from convergence. Historical directorships, commercial branding, website metadata, account relationships and specialised infrastructure connections provide mutually reinforcing reasons to examine the relevant companies together. No single shared website identifier should be treated as a substitute for an authenticated ownership record.

Confiant additionally documented subdomains under Adtimizer-related infrastructure that resolved to an Amazon Web Services load balancer associated with Discover-Tech. The researchers identified certificate relationships and other technical characteristics indicating that particular services had been operated within closely connected infrastructure.

Adtimizer, however, responded that the relevant subdomains had been used exclusively within Discover-Tech infrastructure and that Adtimizer itself did not operate or control the alleged malicious activity. That response must be preserved because a technical infrastructure relationship does not automatically establish knowledge, contractual responsibility or criminal participation.

The evidence and company responses are contained in Exposing AdFection — Citizen Lab, Sections 7 and Correspondence with Companies and ADINT: Weaponized Ad Tech — Confiant, October 2026.

Advertising-platform partnerships and the distinction between technical integration and culpability

Discover-Tech’s commercial position depended on access to advertising infrastructure operated by companies in several jurisdictions. Citizen Lab identified Google, Yandex, Vungle and Sunteng among the systems integrated with MyDSP, while examining purchases through Beeswax and Eskimi and identifier relationships involving Xandr.

These relationships are central to understanding the company’s reach. They also create a significant risk of erroneous corporate attribution if the existence of a technical connection is interpreted as proof that an advertising platform knowingly participated in spyware operations.

Table 2.5 — Advertising infrastructure and documented relationships

Platform or provider	Jurisdictional or corporate association	Nature of observed connection	Reported response by October 2026
Google advertising systems	United States	MyDSP integration and approved vendor registrations	Removed Discover-Tech from relevant vendor lists and terminated exchange access
Yandex	Russia-linked advertising infrastructure	MyDSP transactions and identifier-synchronisation evidence	No response reported within Citizen Lab’s stated comment period
Vungle / Liftoff	United States	Mobile advertising inventory and MyDSP connection	Paused Discover-Tech access pending review
Sunteng / Shunfei Technology	China	MyDSP exchange integration	No response reported within the researchers’ stated period
Beeswax / FreeWheel / Comcast	United States	Advertising buying and identifier synchronisation	Removed Discover-Tech from Buyer Cloud
Eskimi	Lithuania-linked advertising technology	Advertising buying through Controlium-supported arrangements	Blocked identified accounts and domains
Xandr / Microsoft Advertising	United States	Identifier retrieval and synchronisation	No response reported within the researchers’ stated period
IAB Europe	European advertising-industry association	Transparency and Consent Framework vendor registration	Removed Discover-Tech from the Global Vendor List on 8 October 2026

Source: Exposing AdFection — Citizen Lab, Section 9 and Correspondence with Companies, October 2026.

The various platform responses illustrate different stages of commercial and technical risk management. Removing a vendor from a registry, terminating an account, pausing participation and blocking domains are distinct actions with different operational consequences. None automatically proves that every previous transaction was malicious, and the public record does not establish that each platform applied identical detection or enforcement standards.

Corporate positioning and unresolved commercial economics

Discover-Tech’s apparent commercial position combined the characteristics of an advertising intermediary with those of a specialised platform serving surveillance-relevant purposes. Its access to commercial advertising infrastructure was an essential operational resource, while its relationships with companies associated with the surveillance sector created a potential route through which advertising access could be incorporated into more specialised intelligence operations.

The available technical record does not establish the company’s complete revenue, profitability, annual advertising expenditure, customer concentration, contractual pricing, shareholder distributions or financial dependence on particular surveillance vendors. Advertising volumes cannot be translated into revenue without additional information concerning bid prices, clearing prices, fees, margins, ownership of advertising accounts and the contractual structure of individual campaigns.

An institutional financial investigation should therefore distinguish the value of advertising purchased, the costs incurred by the intermediary, payments received from customers and the revenue attributable to any software or intelligence services. Treating the published bidding totals as a financial statement would introduce an unsupported valuation.

Chapter 2 — Key judgments

Discover-Tech’s documented history demonstrates the convergence of established advertising technology, complex corporate relationships and surveillance-oriented platform functions. The company inherited or acquired access to technology developed before its incorporation, maintained historical governance and ownership connections involving individuals or vehicles associated with the surveillance industry, and developed or operated Controlium as a system capable of coordinating individually targeted advertising activity.

The corporate evidence is sufficiently substantial to justify an integrated international investigation, but it does not establish common operational responsibility across every historically connected company. In particular, the Affle asset transaction, historical MyDSP ownership and the participation of ordinary advertising intermediaries must remain distinct from the documented malicious activity.

What would change the assessment: Authenticated shareholder agreements, detailed historical registry extracts, Controlium customer contracts and financial records could determine whether the apparent relationship between advertising and surveillance activities was organised through a single commercial strategy, customer-specific arrangements or several partially independent operating structures.

Open official record: The principal gaps concern the complete beneficial ownership history of offshore shareholders, the precise terms of the transfer of MyDSP assets into Discover-Tech’s control, the contractual scope of the 2021 Affle transaction, and audited financial information capable of distinguishing ordinary advertising revenue from payments associated with surveillance services.

Chapter 3. The AdFection Method: Advertising Auctions, Identity Resolution, Device Fingerprinting and Zero-Click Spyware Delivery

Principal judgment: the decisive innovation was the controlled transition from an advertising event to selective delivery of surveillance-oriented code

AdFection should be understood as an advertising-mediated exploitation method in which commercial advertising infrastructure provides both access to a selected device and a mechanism for initiating further technical activity without requiring the user to click an advertisement. Its distinctive feature is not the mere presence of JavaScript in advertising content, which is commonplace, but the reported combination of individualised selection, cross-platform identifiers, selective responses, concealed communications and connections to a specialised commercial spyware system.

The October 2026 investigations describe a technical architecture in which Discover-Tech could distinguish the ordinary advertising population from selected targets, execute surveillance-relevant code within the available browser or application context, and support further interaction with infrastructure attributed to Candiru. Confiant’s investigation additionally demonstrates that the code exposed to advertising-security scanners could differ from that delivered under other conditions, complicating conventional malicious-advertisement detection.

The technical interpretation requires particular discipline because several capabilities that appear similar in ordinary descriptions have very different security implications. Identification of a device does not establish identification of its human operator; obtaining a browser fingerprint does not establish unrestricted access to the device; execution of JavaScript does not establish operating-system compromise; and interaction with a spyware-associated server does not, without additional evidence, establish successful implant deployment.

Advertising auctions as the initial access environment

In conventional web browsing, the content visible to a user may come from several independently operated services. The primary website supplies editorial or functional content, while advertising slots can be filled through external systems that purchase the opportunity to display content within the browser. A similar arrangement can exist inside mobile applications where advertising software development kits communicate with external advertising providers.

Discover-Tech’s operation exploited the fact that a successful advertising transaction could cause content under the advertiser’s control to be rendered on a device that had not intentionally interacted with the advertiser. The user could be reading an article, consulting a weather service or using an unrelated application, and the advertising system could still introduce a connection to the advertiser’s infrastructure.

Citizen Lab reports that advertising content associated with Discover-Tech could contain a reference to a server responsible for deciding whether additional JavaScript should be returned. The system was designed to distinguish target eligibility using information associated with the advertising request, including identifiers and network characteristics.

This arrangement creates an operational separation between the advertising intermediary and the ultimate code delivered to a particular device. The advertising platform may initially evaluate a creative containing a familiar advertising image and associated script reference, while the content returned through the subsequent request may depend on conditions evaluated by the advertiser-controlled infrastructure.

This design is relevant to defensive monitoring because security systems that inspect an advertisement only once may observe different behaviour from the behaviour experienced by a selected target. The risk is not that all third-party script references are malicious, but that selective response mechanisms can conceal harmful content from inspections performed outside the intended target environment.

Exposing AdFection — Citizen Lab, Sections 2, 3 and 6, October 2026.

NOAS and the separation between visible advertising content and downstream execution

The NOAS server, also described in the research as a getAd server, is central to the documented operation because it connected advertising impressions to subsequent processing while allowing responses to vary according to the available target information.

Citizen Lab found that the system could receive advertising identifiers and other request characteristics, then return either executable JavaScript or an empty response. In many ordinary impressions, the user would therefore see little or no indication that a selective technical decision had occurred, while the request could still provide information to Discover-Tech.

The distinction between the initial request and the returned code is important because it enables two separate classes of activity. The first consists of collecting or confirming information that helps identify the device and the advertising context. The second consists of delivering additional code when a particular condition is satisfied.

The reviewed evidence supports the existence of this selective mechanism, but not a universal conclusion that every advertisement carrying a NOAS reference attempted an operating-system exploit. Some observations are consistent with collection, reconnaissance or campaign management, and the exact purpose of an individual response must be established from the associated technical record.

Table 3.1 — Analytical decomposition of the AdFection mechanism

Functional stage	Documented technical characteristic	Intelligence consequence	What additional evidence is required
Advertising opportunity	Website or application makes inventory available	Creates potential access to a device environment	Transaction records establishing participation
Target selection	Advertising systems evaluate identifiers and campaign constraints	Supports selection of candidate devices	Evidence of the actual criteria used in a campaign
Advertising delivery	Discover-Tech-controlled content is rendered	Creates a connection to downstream infrastructure	Impression and request records
Selective response	NOAS-related infrastructure determines whether to return code	Differentiates ordinary exposures from selected devices	Server responses and controlled comparative observation
Device profiling	Additional code examines available device and browser characteristics	Enriches a device-associated profile	Observed functions and transmitted information
Surveillance infrastructure contact	Browser or application communicates with associated external services	May support further reconnaissance or exploitation	Correlated network telemetry and infrastructure attribution
Exploitation attempt	Specialised malicious code targets a software weakness	Potential transition towards deeper access	Verified exploit behaviour and relevant vulnerability evidence
Successful compromise	Device exhibits confirmed spyware activity	Establishes a materially different level of intrusion	Forensic artefacts, implant behaviour or independently validated compromise evidence

The transitions in this table are analytically distinct. A complete assessment should identify the latest stage that the evidence actually establishes for each incident rather than assigning the most severe possible outcome to every advertising observation.

Identity resolution: from advertising identifiers to persistent intelligence targets

Identity resolution is particularly important because advertisers and surveillance operators frequently encounter devices through identifiers that are not themselves human names. A browser cookie, mobile advertising identifier, internal advertising-platform identifier or public IP address can help associate activity with a device or connection, but the accuracy and persistence of the association vary.

A mobile advertising identifier may be reset or restricted, browser cookies may be deleted or partitioned, and public IP addresses can be shared or dynamically assigned. Different people may use the same device, while the same person may use multiple devices. Consequently, the inference that two observations belong to the same person requires supporting information rather than mere repetition of an identifier.

The purpose of identity synchronisation is to establish relationships among identifiers used by different systems. In ordinary advertising, this can help participating services coordinate targeting, measurement or attribution. In an intelligence context, it can provide a mechanism for following an identifiable device or user across digital properties that otherwise operate independently.

Citizen Lab reports that Discover-Tech’s tracking infrastructure engaged in identifier synchronisation involving advertising systems associated with Beeswax, Yandex and Xandr. The researchers examined browser behaviour, source code and archived network-request records showing that Discover-Tech-associated services could exchange or retrieve identifiers used by those platforms.

The consequences are potentially important because identity synchronisation can extend the analytical usefulness of an advertising observation beyond the particular website or application where it originated. If multiple identifiers can be reliably associated, an actor may connect observations that would otherwise remain isolated within separate advertising systems.

Nevertheless, the existence of a synchronisation request does not establish that it succeeded, that the resulting association was accurate or that a particular person was identified by name. An analytically sound surveillance assessment must distinguish technical identity matching from validated human attribution.

Exposing AdFection — Citizen Lab, Section 6: How Discover-Tech Deploys Ads in the Browser, October 2026.

Table 3.2 — Identity and device information: intelligence value and limitations

Information category	Potential analytical value	Important limitation
Browser cookie identifier	Associates repeated activity within the relevant browser context	May expire, be deleted, partitioned or blocked
Mobile advertising identifier	Supports cross-application advertising association where accessible	Can be reset, restricted or unavailable
Public IPv4 address	Establishes an observed network exit point	Carrier-grade NAT, shared networks and VPNs complicate individual attribution
Public IPv6 address	May provide additional device or connection specificity	Address rotation and privacy extensions affect persistence
Browser and operating-system characteristics	Contribute to device differentiation	Many devices can share similar characteristics
Screen and rendering characteristics	Contribute to a browser fingerprint	Not independently unique or necessarily stable
Language and locale	Provide contextual information	Do not establish nationality or location
Advertising exchange identifier	Connects observations within an advertising ecosystem	Depends on platform rules and matching accuracy
Website or application context	Indicates the environment associated with an advertising event	Does not prove a person’s intent or identity
Network ownership or ASN	May associate traffic with an organisation or connectivity provider	Does not establish the institutional role of the individual user
Geographic inference from IP address	Supports approximate geographic classification	May reflect proxies, infrastructure or incorrect geolocation
Mobile subscriber telephone number	Stronger potential link to a subscriber identity when accurately obtained	Subscriber identity and actual device user may differ; acquisition requires additional conditions

The last category is especially significant because Citizen Lab documented activity by a separate threat actor it designated DARK CARTOGRAPHER, which attempted to associate advertising identifiers with mobile telephone numbers through weaknesses in telecommunications-related mechanisms. The researchers described several categories of vulnerability affecting multiple mobile providers and stated that disclosures were underway.

Those findings require separate treatment from the Candiru exploitation chain because telephone-number deanonymisation and spyware deployment represent different technical outcomes. Their common dependence on advertising access is nevertheless evidence that the same commercial entry point can support multiple surveillance objectives.

Device fingerprinting and the significance of environment-aware code

Confiant’s investigation provides particularly detailed evidence concerning the surveillance-oriented JavaScript framework associated with the advertising activity it examined. The researchers identified functions capable of collecting information about device configuration, browser characteristics, graphics capabilities, network status, navigation events and other aspects of the execution environment.

The technical value of such information arises from its possible combination. A single browser property rarely establishes a reliable identity, but several characteristics observed together may distinguish an environment sufficiently to support recognition or further investigation. These characteristics can also help an operator determine whether code is being executed in an ordinary user environment, a restricted advertising frame or an automated testing system.

Confiant examined capabilities involving WebGL rendering information, screen dimensions, platform attributes, language settings, connectivity information and browser interfaces associated with device features. It also described a command-controlled framework in which additional actions could be requested through a remote communication channel.

The existence of these capabilities does not establish that every possible browser interface was successfully accessed. Modern browsers restrict access according to origin, permissions, sandboxing, security policies and the execution context. Confiant explicitly noted that some functions might not be available inside an advertising frame.

This limitation is particularly important when interpreting permissions-related interfaces. For example, the presence of code referencing geolocation or media-device interfaces does not demonstrate that location, microphone or camera access was successfully obtained. Such access is subject to additional technical and permission requirements.

ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming — Confiant, Technical Analysis, October 2026.

Table 3.3 — Observed fingerprinting categories and their analytical significance

Category	Examples documented by Confiant	Potential function	Interpretation limit
Device identification	User agent, platform, language and screen properties	Characterise a device environment	Does not prove unique identification
Graphics rendering	WebGL and rendering parameters	Distinguish configurations	Similar systems may produce matching outputs
Browser capabilities	Availability of selected browser APIs	Characterise technical environment	API detection does not prove successful use
Network status	Connectivity interfaces and events	Observe connectivity conditions	Does not establish network interception
Navigation behaviour	Location and navigation-related browser properties	Identify context and changes	Browser restrictions and origin boundaries apply
Page visibility	Focus and visibility events	Determine whether content is actively displayed	Does not establish user attention
Timing behaviour	Performance and rendering timing	Characterise environment or automation	Variable conditions reduce reliability
Geolocation interfaces	Permissions and location-related APIs	Potentially obtain location when allowed	Explicit technical and permission conditions remain relevant
Remote instructions	Command-controlled feature execution	Enable selective behaviour	Must be distinguished from unrestricted device access
Encrypted communication	Protected communication with remote infrastructure	Conceal or protect exchanged application data	Encryption alone does not establish malicious intent

Command-and-control functions within an advertising context

Confiant documented a framework capable of receiving remote instructions and executing selected functions, including a mechanism for processing additional code. This is a material departure from ordinary static advertising because it introduces the possibility that the functionality executed on a device changes according to instructions received after the initial advertising content has loaded.

The security consequences must be assessed within the constraints of the execution environment. Arbitrary JavaScript execution within an advertising frame remains subject to the browser’s applicable security boundaries, unless another weakness or misconfiguration enables those boundaries to be crossed. The presence of remote code execution within that frame therefore creates an opportunity for further malicious activity, but is not automatically equivalent to unrestricted access to the operating system.

Confiant also documented communications designed to conceal or limit the visibility of the instructions exchanged between the code and its controlling infrastructure. From a defensive perspective, this complicates systems that assume the initial advertisement contains all materially important executable behaviour.

The researchers described a command-polling system and alternative communication mechanisms, together with code capable of executing further instructions in the browser context. These findings support characterising the framework as an advanced surveillance-oriented delivery and reconnaissance capability, while the actual success of a complete spyware exploit chain must be established independently.

Confiant specifically stated that it had not captured a complete exploitation chain in the wild through its own telemetry. Citizen Lab, however, linked a corresponding advertising-mediated delivery process to documented Candiru infections at Al Jazeera. The different evidence bases are complementary: one investigation exposes aspects of the broader advertising and code-delivery machinery, while the other supplies incident-level evidence of successful spyware compromise. Confiant Technical Investigation — October 2026 and Citizen Lab, Section 2 — October 2026.

The significance of selective code delivery and advertising-security evasion

Conventional advertising-security analysis relies on inspecting delivered advertising content, identifying suspicious external resources and observing code behaviour in representative test environments. These measures can be effective against malicious advertising that behaves consistently across users and devices, but selective delivery creates a harder problem because the response experienced by the intended target may not be reproducible through a generic scanner.

In the Discover-Tech case, the researchers identified mechanisms capable of returning no additional code for ordinary requests while making different responses available when the system recognised particular conditions. The defensive implication is that a clean result from a single inspection does not establish that the same advertising content will remain harmless under all conditions.

This observation also explains the relevance of the advertising-platform responses published by Citizen Lab. Eskimi reported that the campaigns and creative tags under investigation used techniques that caused different code to load depending on device, IP address and location, while some campaigns operated against narrowly specified target lists. Eskimi stated that its monitoring eventually flagged such behaviour and that campaigns or tags were stopped as its controls detected them.

The platform’s response is evidence of its reported enforcement experience, not an independently audited account of every relevant campaign. Nevertheless, it establishes that selective delivery represented a practical challenge to the verification systems operating within the advertising supply chain.

The appropriate institutional response is not limited to the detection of known malicious domains. A mature defensive assessment must examine the relationship between advertising-execution privileges, remote-code loading, behavioural variation across inspection environments and the broader information disclosed through ordinary advertising requests.

The difference between zero-click delivery and successful zero-click compromise

The term zero-click is frequently used imprecisely in public commentary. In this context it indicates that the user did not need to click the advertisement to initiate the malicious delivery pathway. It does not mean that every advertisement was automatically capable of compromising every device or that the browser’s security model ceased to apply.

A successful spyware infection requires additional technical conditions. These may include a suitable vulnerable software version, an exploit chain capable of reaching the desired execution environment, successful interaction with the intended target and subsequent operation of the implant. The exact chain is not established by the presence of advertising code alone.

Citizen Lab’s analysis of Al Jazeera is therefore essential because it moves beyond the observation of suspicious advertising requests and identifies a sequence connecting advertising infrastructure with Candiru validation and command-and-control systems on devices that researchers assessed as infected.

The report’s technical contribution should accordingly be stated with precision: the investigators documented a real-world advertising-mediated, no-interaction spyware delivery pathway, including confirmed compromise evidence in the Al Jazeera case, while the broader advertising dataset does not establish that every exposed device was compromised.

Defensive detection requirements arising from the technical findings

An organisation attempting to assess exposure to AdFection-like activity must distinguish ordinary advertising telemetry, surveillance-oriented profiling, attempted exploitation and confirmed compromise. These categories require different observations and cannot be reliably merged into a single indicator of infection.

Advertising transactions and associated tracking requests can provide evidence of exposure. Correlated requests to unusual script-delivery services may support investigation of selective code delivery. Connections to infrastructure independently attributed to offensive surveillance systems can materially strengthen a threat hypothesis, particularly when they occur in a reproducible sequence. Confirmed compromise requires additional forensic evidence establishing that malicious code crossed the relevant security boundary and achieved the assessed level of access.

Table 3.4 — Defensive evidence and the conclusions it can support

Evidence class	Observation	Defensible conclusion	Insufficient conclusion
Advertising log	Relevant advertising transaction recorded	Potential advertising exposure	Confirmed spyware infection
Browser request record	Connection to a surveillance-associated advertising endpoint	Relevant third-party interaction	Successful user identification
Identifier-synchronisation record	Exchange or retrieval of advertising identifiers	Identity-linkage functionality was invoked	Correct attribution to a named person
Script analysis	Selective delivery and fingerprinting functions identified	Surveillance-oriented capability exists	Successful operating-system compromise
Advertising-platform alert	Campaign flagged for evasion or prohibited behaviour	Platform detected suspicious activity	Every campaign impression was malicious
Network correlation	Advertising contact followed by spyware-associated validation	Stronger evidence of attempted exploitation	Complete proof of compromise in isolation
Implant behaviour	Confirmed malicious activity on the device	Supports established compromise	Identification of the ultimate state customer
Authenticated command records	Verified operational instructions associated with a campaign	Potential evidence of control and intent	Automatic attribution to all related companies
Reconstructed forensic timeline	Consistent sequence of advertising exposure, validation and implant activity	Strong incident-level causal evidence	Universal infection rate across advertising inventory

Chapter 3 — Key judgments

AdFection demonstrates the practical security implications of combining commercial advertising access with surveillance-oriented code delivery and specialised exploitation infrastructure. The technique is operationally significant because it can separate large-scale information collection from selective exploitation and can conceal consequential behaviour from inspections that do not reproduce the intended target environment.

The technical evidence establishes a sophisticated delivery architecture and, through Citizen Lab’s Al Jazeera investigation, a documented connection to successful spyware infections. It does not support extrapolating infection counts from advertising impressions or treating every identifier-synchronisation event as proof of personal identification.

What would change the assessment: Independently examined exploit artefacts identifying the exact vulnerabilities used, a larger set of confirmed victim-device investigations and authenticated records describing customer-level targeting decisions would permit more precise conclusions about platform limitations, infection success rates and operational control.

Open official record: The consequential technical gaps concern the full device-specific exploitation chains, the precise software versions affected, independently validated outcomes on systems outside the Al Jazeera investigation, and platform-level audit records describing which security controls detected or failed to detect the selective advertising responses.

Chapter 4. Operational Reconstruction: Candiru, Al Jazeera, Geographic Concentration, Sensitive Networks and the Limits of Attribution

Principal judgment: the operational evidence establishes targeted spyware compromise, exceptionally broad advertising exposure and a materially smaller observed exploitation footprint

The operational reconstruction must begin by separating three distinct evidence populations: the devices involved in the Al Jazeera compromise investigation, the advertising traffic documented through Discover-Tech’s bidding and impression records, and the more selective Candiru-associated delivery activity observed by Confiant. Each population answers a different intelligence question, and none can be treated as a statistically representative substitute for the others.

The Al Jazeera investigation provides incident-level evidence connecting Discover-Tech advertising infrastructure to spyware compromise. The Discover-Tech transaction records establish the scale and geographic distribution of advertising activity, including the delivery of advertising content containing suspicious script references. Confiant’s telemetry supplies additional observations of campaigns involving infrastructure attributed to Candiru, but does not independently establish that every such interaction resulted in an infection.

These distinctions are essential to the assessment of national-security consequences. A very large advertising footprint creates opportunities for information collection and selective target access, but the number of successfully compromised devices depends on specific targeting decisions, technical vulnerabilities and the outcome of individual exploitation attempts. Conversely, the relatively small number of confirmed infections does not diminish the intelligence significance of a system capable of continuously identifying and evaluating candidate targets across numerous countries and institutional environments.

Candiru as a commercial surveillance actor and the official export-control record

Candiru occupies a different position in the relevant corporate ecosystem from Discover-Tech. The latter was identified as an advertising intermediary facilitating surveillance-related activity, whereas Candiru is a commercial spyware developer with an established history of public cybersecurity investigation and United States export-control restrictions.

On 3 November 2021, the United States Department of Commerce announced the addition of several companies to its Entity List, including Candiru and NSO Group. The Commerce Department stated that the decision concerning these companies reflected evidence that they had developed and supplied spyware to foreign governments that used the capabilities to maliciously target government officials, journalists, businesspeople, activists, academics and embassy personnel.

The Entity List is an export-control instrument, not a criminal conviction or a judicial determination of responsibility for every subsequent operation associated with the listed company. Its significance lies in the restrictions it places on specified transactions involving items subject to United States export controls, as well as its formal recognition by a competent government authority of the risks associated with the named commercial spyware companies.

The October 2026 Citizen Lab investigation identifies Candiru under the additional commercial name Integrity Labs and attributes the spyware delivered through Discover-Tech’s advertising pathway to the same surveillance vendor with high confidence.

The relevant official record is Commerce Adds NSO Group and Other Foreign Companies to Entity List for Malicious Cyber Activities — U.S. Department of Commerce, 3 November 2021. The incident-specific technical evidence is presented in Exposing AdFection — Citizen Lab, Section 2, 15 October 2026.

Reconstruction of the Al Jazeera campaign, 2024–2025

Citizen Lab reports that at least 45 devices within the international news organisation Al Jazeera were targeted during a series of attacks in 2024 and 2025. The researchers assessed with high confidence that the incidents involved Candiru spyware delivered through advertisements purchased or distributed using Discover-Tech infrastructure.

The strongest feature of the published evidence is the availability of network logs supplied by the affected broadcaster. Such records allow analysts to examine the chronology of connections made by devices during the relevant period rather than reconstructing an attack solely from advertising-platform documentation or retrospective public allegations.

According to Citizen Lab, affected devices first communicated with infrastructure associated with Discover-Tech, consistent with an advertising impression. Subsequent connections involved a Candiru validator server, which the investigators identify as part of a system used to evaluate devices before further profiling and infection. Devices assessed as infected subsequently communicated with Candiru command-and-control infrastructure.

This temporal sequence is materially more probative than the isolated presence of a suspicious advertising domain. It establishes an observed progression among infrastructure components that perform different technical roles, with the sequence supported by the investigators’ analysis of network behaviour and infrastructure fingerprints.

Nevertheless, temporal correlation must be assessed alongside attribution evidence and implant behaviour. A device’s connection to a particular domain is insufficient by itself to demonstrate the execution of a specific exploit, because domains can host multiple services and requests can occur for different reasons. Citizen Lab’s conclusion rests on the convergence of network records, server identification and the observed behaviour of the spyware-associated infrastructure.

Exposing AdFection — Citizen Lab, Section 2: Confirming the Targeting of Al Jazeera with Candiru Spyware via Discover-Tech Ads, October 2026.

Table 4.1 — Reconstructed sequence and evidentiary strength

Stage	Observed or reported event	Evidence basis	Operational interpretation
1	Advertising content associated with Discover-Tech reached a device	Network logs and infrastructure attribution	Establishes advertising-mediated initial contact
2	Device communicated with Discover-Tech-associated delivery infrastructure	Temporal network sequence	Supports connection between impression and downstream request
3	Device subsequently contacted a Candiru validator service	Network records and server fingerprinting	Supports a transition from advertising exposure to spyware-related evaluation
4	Additional communication and profiling activity occurred	Technical sequence examined by Citizen Lab	Supports further assessment of device suitability or exploitation
5	Affected devices communicated with Candiru command-and-control infrastructure	Correlated incident evidence	Strong support for successful spyware activity in the investigated cases
6	Researchers linked the sequence to Candiru with high confidence	Combined forensic and infrastructure analysis	Establishes vendor-level technical attribution
7	Ultimate customer or government controlling each operation	Not established by the cited incident sequence	Requires separate procurement, contractual or operational evidence

The distinction between vendor-level attribution and customer-level attribution is critical because commercial spyware companies can provide capabilities to customers whose operational decisions are not visible in technical records alone. Even where the malware family and delivery infrastructure are confidently identified, the sponsoring authority, contracting organisation and individual operators may remain unresolved.

Candiru infrastructure fingerprinting and the interpretation of historical server records

Citizen Lab developed a technical fingerprint associated with Candiru validator servers and applied it to historical internet-scanning records. The researchers reported identifying 305 distinct domain names associated with 319 IP addresses matching the relevant fingerprint during the period from August 2022 through July 2026.

These figures provide useful information about the breadth of infrastructure matching the researchers’ detection method, but they are not equivalent to the number of spyware customers, active campaigns, exploited vulnerabilities or confirmed victims.

The distinction between domain names and IP addresses also matters. Multiple domains may resolve to a single address, and a domain may use several addresses over time. Cloud hosting, network changes and deliberate infrastructure rotation can further complicate attempts to associate observed infrastructure with a stable operating entity.

Citizen Lab reported that the relevant fingerprint appeared to become less commonly observable during May and June 2026, indicating that the detection method had temporal limitations. The researchers also described their historical search as sampled rather than exhaustive, using one available Censys snapshot per month to control query costs.

The correct conclusion is therefore that the investigation documented a substantial historical set of infrastructure matching the relevant Candiru server characteristics, with defined limits arising from observation frequency, fingerprint validity and changes in server behaviour.

This evidence contributes to technical attribution when combined with incident records, but cannot establish operational control merely because a server exhibits a matching response characteristic.

Table 4.2 — Candiru infrastructure measurements

Indicator	Published value	Observation period	Interpretation
Distinct validator-associated domains identified	305	August 2022–July 2026	Historical domains matching the researchers’ relevant fingerprint
IP addresses associated with identified infrastructure	319	August 2022–July 2026	Addresses associated with matching historical infrastructure
Historical sampling frequency	One snapshot per month	During the examined period	The search was not a continuous, exhaustive census
Change in observable fingerprint behaviour	Gradual retirement noted	May–June 2026	Detection coverage may deteriorate as infrastructure changes
Confirmed number of distinct customers represented	Not established	Entire period	Infrastructure totals cannot be converted into customer counts
Confirmed number of compromises represented	Not established	Entire period	Server matches do not prove infections

Source: Exposing AdFection — Citizen Lab, Section 2: Fingerprinting Candiru Servers, October 2026.

Geographic concentration and why different datasets produce different maps

The geographic distribution of Discover-Tech activity must be evaluated according to the metric being measured. A raw advertising-bid count can identify where the company’s buying system attempted to participate in advertising transactions, but cannot automatically establish how many advertisements were actually displayed. A recorded impression supplies stronger evidence of advertising exposure, while a connection to spyware-related infrastructure identifies a narrower type of activity requiring further technical interpretation.

Citizen Lab analysed geographical patterns among MyDSP bidding records associated with advertisements that apparently contained NOAS-related script references. It reported activity involving IP addresses geolocated to 161 countries, while emphasising the limitations of IP-based geographic classification.

The raw bidding counts were highly uneven. Yemen, Pakistan, Montenegro, Brazil and Mexico were among the countries with the largest recorded volumes, although the order and interpretation depend on the precise population of advertisements and bidding records being examined.

Table 4.3 — Leading countries by recorded bids for NOAS-associated advertisements

Rank	Country	Recorded bids	Geographic interpretation
1	Yemen	457,283,658	Largest raw count in the reported table
2	Pakistan	139,427,322	Substantial recorded bidding activity
3	Montenegro	97,595,716	High activity relative to national population
4	Brazil	76,108,495	Large recorded volume within a major national market
5	Mexico	32,675,229	Significant recorded bidding activity
6	China	30,072,952	Recorded activity within the dataset
7	Belarus	25,122,945	Significant recorded activity
8	Armenia	23,189,997	Elevated prominence in both raw and population-adjusted comparisons
9	Czechia	19,107,486	Significant recorded bidding activity
10	Israel	18,477,493	Recorded activity in the company’s home jurisdiction

Source: Exposing AdFection — Citizen Lab, Section 5, Table 4, October 2026.

The distribution is analytically important because it cannot be explained simply by ranking the world’s largest populations or digital advertising markets. However, the figures do not establish that the associated national populations were specifically selected for espionage, because bidding outcomes also depend on advertising inventory, purchasing strategies, exchange access, network routing and the composition of available applications.

Population-adjusted observations provide an additional perspective but introduce their own interpretative limitations. Bids per capita measure the intensity of a recorded transaction population relative to national population, not the number of advertisements received by an average resident or the proportion of the population successfully monitored.

Table 4.4 — Highest reported bids per capita

Rank	Country	Bids per capita	Analytical observation
1	Montenegro	156.68	Exceptionally elevated relative to the other reported countries
2	Yemen	13.99	High population-adjusted activity
3	Armenia	7.49	Significant relative concentration
4	Latvia	3.14	Elevated concentration despite lower absolute volumes
5	Seychelles	3.13	Small population can strongly affect the ratio
6	Belarus	2.77	Meaningful concentration in the dataset
7	Israel	1.80	Notable relative activity
8	Czechia	1.75	Elevated relative activity
9	Denmark	0.99	Included among the ten highest reported values
10	Azerbaijan	0.97	Included among the ten highest reported values

Source: Exposing AdFection — Citizen Lab, Section 5, Table 5, October 2026.

Montenegro’s position is analytically striking, particularly when compared with countries with much larger populations. Nevertheless, such a ratio cannot demonstrate national targeting intent in isolation because repeated transactions associated with the same devices, applications or networks may materially influence the denominator-adjusted result.

The same caution applies to Yemen and Armenia, where the recorded geographical concentration justifies further examination but cannot establish the identity of the ultimate intelligence customer or the targeting criteria used.

Advertising distribution through websites and applications

The international reach of Discover-Tech depended on the ability of its advertising partners to distribute content across unrelated digital environments. Citizen Lab identified advertisements with relevant script references displayed through 75,373 mobile applications and 120,768 websites during the examined period.

The applications included entertainment services, media services, communication applications, learning applications and other consumer products. The breadth is operationally significant because the affected publishing environments were not confined to specialist technical websites or platforms associated with any particular surveillance target.

Citizen Lab specifically identified substantial numbers of advertisements in widely used Android applications, including MX Player, Lark Player and Viber, as well as lower but still significant activity in numerous other applications and websites.

The significance of these findings lies in access rather than assumed complicity. A publisher or application may receive advertisements through intermediaries without directly contracting with the ultimate advertiser, and the presence of Discover-Tech advertising within an application does not establish that the application developer knew about or approved the surveillance-oriented functions.

The distribution pattern also demonstrates why protective measures implemented only by individual websites may be insufficient. A commercial advertising campaign can shift among publishers, applications and buying platforms, while particular targets may encounter advertising through many unrelated digital activities.

Exposing AdFection — Citizen Lab, Section 5: Apps and Websites That Displayed the Ads, October 2026.

Confiant’s geographical observations of Candiru-associated delivery

Confiant examined advertising-security telemetry collected between 1 April and 10 September 2026 and distinguished the broad Discover-Tech advertising footprint from the much smaller observed activity involving handoffs to infrastructure attributed to Candiru.

The company reported that its observed Candiru-associated handoff activity involved nine countries: Belgium, the United Arab Emirates, Montenegro, Bahrain, Thailand, Saudi Arabia, Mexico, Spain and Malaysia. It also reported that Belgium accounted for 56% of the global hits observed within that particular dataset.

This finding should not be interpreted as proof that Belgium accounted for 56% of all Discover-Tech spyware attacks worldwide. The denominator is Confiant’s observed Candiru-associated activity, within the stated telemetry and period, rather than a complete global record of infections.

Confiant also described the relevant traffic as comparatively low-volume, frequently measured in hundreds to low thousands of advertising impressions per day within its observation set. Such a pattern is consistent with selective targeting, but precise conclusions about operational intent require caution because the available measurements depend on the monitoring coverage and traffic visible to Confiant.

The geographical observations further demonstrate that apparently sensitive operations need not produce obvious concentrations on government-owned networks. Confiant reported that much of the observed Candiru-associated delivery activity involved residential or mobile addresses, indicating that target exposure could occur through ordinary consumer connectivity.

Table 4.5 — Confiant’s observed Candiru-associated advertising activity

Indicator	Observation	Scope and qualification
Technical telemetry period	1 April–10 September 2026	Confiant’s investigated activity
First described detection	12 April 2026	Advertising creative detected by Confiant
Countries observed in Candiru-associated delivery	Belgium, UAE, Montenegro, Bahrain, Thailand, Saudi Arabia, Mexico, Spain, Malaysia	Observed delivery geography, not a confirmed victim-country census
Belgium share	56%	Share of hits within the relevant Confiant dataset
Volume of Candiru-associated handoffs	Hundreds to low thousands of impressions daily	Approximate scale described by researchers
Network characteristics	Predominantly residential and mobile addresses	Does not identify individual human targets
Full exploit-chain capture by Confiant	Not established	Confiant expressly distinguished staging evidence from a complete observed exploit chain

Source: ADINT: Weaponized Ad Tech for Zero-Click Spyware and Mass Identity Vacuuming — Confiant, October 2026.

Exposure of sensitive institutional networks

The most consequential institutional dimension of the investigation concerns the appearance of Discover-Tech advertising traffic in networks associated with governments, international organisations, defence-related institutions and strategically significant businesses.

Citizen Lab reported evidence involving organisations such as the United Nations, NATO and European Commission, while the Reuters account additionally described networks associated with the Pentagon, International Atomic Energy Agency and International Criminal Court, citing Confiant’s findings.

The security implications are material because advertising activity originating from networks associated with such organisations may disclose information useful to an external intelligence actor, particularly where network characteristics, repeated observations and device identifiers can be correlated.

However, the evidentiary meaning of a network association must be carefully defined. An IP address allocated to an organisation does not necessarily identify the human user responsible for a particular request, and a connection associated with an institutional network does not establish that the device was administratively managed by that institution or contained confidential material.

The strongest defensible conclusion is therefore that the investigations identified advertising activity associated with sensitive institutional environments, creating a basis for security review and potential counterintelligence concern. Claims of successful compromise require additional device-level evidence.

Table 4.6 — Institutional exposure and attribution requirements

Institution or category	Reported connection	What is established at the published evidence level	What remains necessary for a compromise finding
Al Jazeera	Targeted campaign involving Candiru-linked spyware	Incident-level forensic and network evidence supporting infection attribution	Full victim-by-victim incident records and ultimate customer identification
NATO-associated networks	Advertising activity described by Citizen Lab	Exposure relevant to advertising and information security	Device-level forensic evidence of intrusion
United Nations-associated networks	Advertising activity described by Citizen Lab	Potential institutional network exposure	Authenticated incident findings
European Commission-associated networks	Advertising activity described by Citizen Lab	Potential institutional network exposure	Evidence of actual device compromise
Pentagon-associated networks	Advertising exposure reported by Confiant through Reuters	Exposure within a sensitive network category	Correlated forensic evidence
IAEA-associated networks	Advertising exposure reported by Confiant through Reuters	Potential exposure relevant to an international institution	Device-specific technical findings
ICC-associated networks	Advertising exposure reported by Confiant through Reuters	Potential institutional exposure	Evidence of malicious access or data extraction
Semiconductor and technology firms	Advertising activity associated with named industry networks	Potential exposure of strategically important commercial environments	Corporate incident records and confirmed affected endpoints

The principal investigations are Exposing AdFection — Citizen Lab, October 2026 and ADINT: Weaponized Ad Tech — Confiant, October 2026. The relevant contemporary reporting is Israeli Company Used Online Ads to Run Vast Spy Operation, Researchers Say — Reuters, reproduced by The Times of Israel, 15 October 2026.

The presence of internationally important organisations in the advertising-exposure evidence creates a particularly demanding attribution problem. For national-security purposes, it may be important to investigate whether the observed requests originated from managed institutional devices, contractors, visitors, employees using personal devices, or infrastructure associated with remote access or network services. Without this distinction, a simple list of institutional networks can generate more dramatic conclusions than the evidence supports.

The operational importance of the Palestinian territories and regional concentration

Reuters reported that Confiant observed particularly extensive Discover-Tech advertising activity in the West Bank and Gaza, with its cofounder describing saturation across websites accessed in Palestinian digital environments.

That reported pattern is relevant to regional intelligence analysis because geographically concentrated advertising activity could provide an unusually broad observational position in a comparatively confined digital environment. However, a high frequency of advertising impressions does not automatically establish that a corresponding proportion of the resident population was identified, nor does it prove that a government commissioned surveillance of that population.

The distinction between territorial exposure and individual identification is especially consequential in conflict environments, where network infrastructure, roaming arrangements, shared connectivity, proxies and displaced populations can complicate geographic attribution.

A credible regional intelligence assessment would need to connect advertising observations with reliable information about network origin, application distribution, identifiers and the intended targets of any selective follow-on campaigns. The October 2026 reporting provides a significant reason to investigate those relationships, but not a validated census of individually surveilled Palestinian residents.

International operational consequences for government and industrial security

The advertising activity documented by Citizen Lab and Confiant has important implications for the protection of strategically sensitive industries because digital exposure does not require an employee to visit a malicious website or intentionally communicate with an adversary.

A device used for ordinary communication, entertainment or information retrieval can encounter third-party advertising during legitimate activity. Where advertising requests distribute persistent identifiers or device characteristics, an intelligence actor with suitable access may be able to collect observations about devices associated with strategically important organisations. Under additional conditions, selective code delivery can create a route towards more intrusive activity.

The semiconductor industry is especially relevant to the investigation because Reuters identified advertising activity associated with networks belonging to Nvidia, Sandisk, Broadcom and Micron. These observations do not establish successful compromise of those companies, but they demonstrate the potential relevance of advertising exposure to industries that occupy important positions in international technology supply chains.

The same analysis applies to defence manufacturers, government contractors, research establishments and financial institutions, where commercially generated device information may reveal organisational patterns even if the advertising activity never achieves operating-system access.

A national-security assessment should therefore avoid evaluating advertising risk exclusively through conventional consumer privacy metrics. The strategic value of an observation may depend on the institutional significance of the device or person concerned, not on the commercial value of the advertisement that produced it.

Attribution analysis: separating infrastructure, operator, vendor, customer and state

The discovery of spyware-associated infrastructure permits several levels of attribution, but those levels must not be collapsed.

Infrastructure attribution concerns the technical identification of domains, servers, software characteristics and communication patterns associated with a known system or operator. Vendor attribution concerns the identification of the company responsible for developing or maintaining the relevant spyware or platform. Operational attribution concerns the individual or organisation that selected targets and directed the activity. Customer attribution concerns the entity that procured the capability, while state attribution requires sufficient evidence to associate the relevant conduct with a government under the applicable analytical or legal standard.

These categories can overlap, but the evidence required for each is different.

A technically distinctive server response can support infrastructure classification. A combination of implant characteristics, network behaviour and known technical signatures may support vendor attribution. Operational control generally requires evidence concerning account usage, targeting instructions, communications or authenticated administrative activity. Customer attribution may require contracts, financial transactions or reliable procurement evidence. Attribution to a state raises further issues concerning authority, direction, control and the relationship between a commercial contractor and a governmental institution.

The Discover-Tech and Candiru investigations provide substantial technical evidence concerning the infrastructure and vendor levels. They do not establish the ultimate governmental responsibility for every operation described.

Table 4.7 — Attribution levels and evidentiary thresholds

Attribution level	Principal question	Evidence capable of supporting the conclusion	Current Discover-Tech assessment
Advertising infrastructure	Which systems distributed the relevant advertising?	Platform logs, network records and provider identification	Strong technical evidence
Surveillance delivery	Which infrastructure selected and delivered additional code?	Code analysis, request sequences and server behaviour	Strong technical evidence
Spyware vendor	Which commercial spyware system was involved?	Implant behaviour, infrastructure fingerprints and comparative technical analysis	Candiru attribution assessed with high confidence for the documented campaign
Campaign operator	Who selected targets and executed the operation?	Authenticated account records, instructions and operator telemetry	Incompletely established
Commercial customer	Who purchased the relevant capability or service?	Contracts, financial records and procurement documentation	Not established for every campaign
Government sponsor	Which state, if any, directed a particular operation?	Competent official findings and converging operational or contractual evidence	Not established by vendor nationality alone
Legal state responsibility	Can particular conduct be attributed to a state under applicable international law?	Evidence satisfying the relevant legal attribution rules	Requires a separate legal and evidentiary analysis

The effect of October 2026 platform restrictions on operational capability

The investigation prompted a series of responses by advertising companies and industry organisations, including removal from vendor registries, termination of platform access, suspension of accounts and blocking of associated domains.

These actions matter because an advertising-mediated operation depends on access to commercial inventory and the associated data flows. Restrictions imposed by significant advertising exchanges can therefore reduce an operator’s ability to distribute advertisements through those particular channels.

However, the public record does not yet establish that Discover-Tech or associated surveillance actors lost access to every potentially usable advertising platform, that all previously collected data were deleted, or that equivalent capabilities could not be re-established through different intermediaries.

An institutional assessment should distinguish the immediate disruption of specific commercial relationships from the broader technological persistence of the surveillance method. Removing an account can interrupt a documented delivery route, while changes to the underlying advertising architecture are required to address vulnerabilities that other actors might exploit.

The relevant company responses are reproduced in Exposing AdFection — Citizen Lab, Correspondence with Companies, October 2026.

Integrated operational assessment

The combined evidence establishes a technically sophisticated operation in which commercial advertising mechanisms were used for purposes extending beyond ordinary advertising, including identity-related collection and the selective delivery of code associated with a commercial spyware vendor. The Al Jazeera incidents demonstrate that this approach was not limited to an abstract technical possibility, while the geographic bidding records and advertising-platform relationships establish that the relevant infrastructure operated at substantial scale.

The most consequential unresolved issue concerns the relationship between the large population of devices exposed to advertising activity and the much smaller population selected for intrusive exploitation. Publicly available evidence does not support a universal conversion rate between impressions, identified devices, attempted exploits and successful infections, nor does it establish the complete geographic distribution of compromised devices.

This uncertainty does not weaken the established findings. Rather, it determines the appropriate intelligence response: advertising exposure must be measured as a potential collection and access opportunity, spyware-associated communications must be investigated as possible exploitation evidence, and confirmed device compromise must be established through technical observations capable of distinguishing malicious activity from ordinary advertising traffic.

The distinction also protects the integrity of corporate attribution. The operation involved advertising infrastructure controlled by several independently operated companies, but technical integration and participation in advertising transactions do not establish knowing cooperation in espionage. Conversely, the documented technical and corporate relationships involving Discover-Tech and surveillance specialists justify substantially deeper investigation of customer structures, financing, operational arrangements and individual responsibility.

Chapter 4 — Key judgments

The strongest operational evidence concerns the Al Jazeera attacks and the identified relationship between Discover-Tech’s advertising pathway and Candiru’s spyware infrastructure. The broader advertising records establish geographic scale and institutional exposure, but cannot independently determine the number of successfully compromised devices or the identities of all ultimate customers.

Confiant’s findings provide particularly important evidence of selective advertising-based code delivery and observations involving Candiru-associated infrastructure in several countries, while preserving the distinction between observed handoffs and completed exploitation chains.

The platform restrictions introduced in October 2026 represent documented commercial disruption, but there is insufficient evidence to conclude that the underlying technical method has ceased to be viable or that other surveillance operators cannot reproduce relevant elements through alternative advertising arrangements.

What would change the assessment: Additional device-level forensic examinations, authenticated campaign records, customer procurement documentation, advertising-platform audit findings and competent official attribution statements could materially increase confidence concerning the scale of successful compromise, individual operational responsibility and the relationship between commercial surveillance vendors and government customers.

Open official record: The principal unresolved matters concern complete customer identification, verified incident information from affected institutions, the disposition of collected advertising-derived information, the durability of platform restrictions and the existence of other operational deployments using comparable methods.

Pillar I — Final Net Assessment

The four chapters establish a continuous development from the commercial foundations of programmatic advertising to the corporate and technical arrangements identified in the Discover-Tech investigation, culminating in the documented use of advertising infrastructure as a delivery channel for mercenary spyware.

The principal intelligence finding is that the commercial advertising economy can supply several capabilities normally considered separately within national-security analysis: access to large populations of devices, information suitable for probabilistic identity correlation, mechanisms for geographically and individually selective targeting, and opportunities for introducing code into user environments. The Discover-Tech case demonstrates the operational importance of combining these capabilities, while the confirmed Al Jazeera incidents establish that an advertising-mediated pathway was successfully connected to sophisticated spyware compromise.

The corporate evidence identifies historical ownership relationships, infrastructure continuity, shared administrative environments and connections with commercial surveillance actors, but does not justify attributing every related company’s activities to a single coordinated operation. Likewise, the presence of advertising activity on sensitive networks warrants counterintelligence attention without establishing that those networks were successfully penetrated.

For senior institutional decision-makers, the resulting distinction is fundamental: advertising reach measures potential exposure, technical surveillance functions demonstrate capability, forensic compromise evidence establishes intrusion, and authenticated contractual or operational records are necessary to determine ultimate responsibility. A credible international investigation must preserve these different levels of evidence while pursuing the corporate and financial relationships capable of connecting them.

---

PILLAR II — WORLDWIDE CORPORATE INTELLIGENCE: SURVEILLANCE VENDORS, ADVERTISING INTELLIGENCE, COMMERCIAL DATA BROKERS AND INTERNATIONAL NETWORKS

Geographic scope: Israel, the United States, Canada, the European Union, the United Kingdom, the Middle East, Eastern Europe, Asia-Pacific, Latin America and the offshore jurisdictions used within transnational surveillance-company structures.

The second pillar examines the corporate and industrial environment surrounding Discover-Tech, with particular attention to companies capable of delivering intrusive spyware, collecting advertising-derived intelligence, resolving digital identities, processing sensitive location information and supplying surveillance capabilities to governmental customers. Its central purpose is to establish which relationships are documented by corporate records, technical investigations and official enforcement decisions, which represent functional similarities rather than business connections, and how ownership structures, international subsidiaries, procurement arrangements and regulatory restrictions influence the operation of the worldwide surveillance market.

Chapter 5. The Israeli Commercial Surveillance Ecosystem: Candiru, NSO Group, Intellexa, Cytrox, Bindecy, Intelos and Related Corporate Networks

Principal assessment: Israel’s commercial surveillance sector contains distinct but intersecting markets whose international influence cannot be measured solely through spyware manufacturers

The most significant characteristic of the Israeli commercial surveillance environment is the presence of businesses operating at different levels of the intelligence-technology value chain, ranging from firms developing intrusive surveillance software to companies specialising in telecommunications intelligence, advertising-derived data collection, identity analytics and technical infrastructure that may support the distribution of capabilities developed elsewhere. These activities should not be treated as a single industry with common ownership or identical customers, because the underlying technical products, legal structures and methods of operation differ considerably, and because commercial relationships between companies do not necessarily establish joint participation in a particular surveillance operation.

The importance of this distinction has increased following the Discover-Tech disclosures of October 2026. Earlier international investigations of commercial spyware concentrated predominantly on the acquisition and deployment of intrusive capabilities associated with companies such as NSO Group and Candiru, while subsequent investigations of the Intellexa consortium demonstrated how offensive surveillance technology could be organised across several jurisdictions through development companies, intellectual-property holders, resellers, distributors and financial intermediaries. The Discover-Tech investigation introduces an additional commercial layer into this landscape by documenting how advertising-based targeting and delivery services can interact with specialised spyware capabilities without necessarily being owned by the same legal entity.

The available official record establishes that the United States has imposed export-control restrictions on NSO Group and Candiru, and separate financial sanctions on companies and individuals associated with Intellexa. Those decisions are relevant evidence of institutional assessments concerning the security implications of particular companies, but they do not establish that every Israeli surveillance vendor engages in unlawful conduct or that the firms named in different enforcement proceedings constitute one coordinated corporate group. The official bases are the Commerce Department’s Entity List decision concerning NSO Group and Candiru — Bureau of Industry and Security, November 2021, Treasury Sanctions Members of the Intellexa Commercial Spyware Consortium — U.S. Department of the Treasury, 5 March 2024 and Treasury Sanctions Enablers of the Intellexa Commercial Spyware Consortium — U.S. Department of the Treasury, 16 September 2024.

Candiru and the industrial organisation of high-end commercial spyware

Candiru occupies a strategically important position because it illustrates the business model of a specialised offensive cybersecurity supplier whose commercial value depends on capabilities that differ fundamentally from conventional intelligence analytics. Whereas an advertising-intelligence provider may collect observations about devices, locations and behaviour without controlling the devices concerned, an intrusive spyware developer offers capabilities intended to obtain access to information or functionality that the legitimate operating environment would otherwise restrict.

The economic implications of that distinction are substantial. Offensive software development involves vulnerability research, compatibility engineering, exploit reliability, infrastructure management, technical support and the continuous adaptation of products to software updates. The resulting capabilities may require significant investment before any particular deployment occurs, while their useful operational life may be affected by security patches, platform architecture changes and public disclosure of technical vulnerabilities.

These characteristics create potential incentives for specialisation within the surveillance market. A spyware manufacturer may possess advanced exploitation technology but lack direct commercial access to millions of ordinary devices, while an advertising intermediary may possess extensive distribution and identification capabilities without developing sophisticated operating-system exploits. Cooperation between such businesses can therefore be attractive because it allows technically distinct functions to be combined without requiring every participant to reproduce the expertise or infrastructure of the others.

This economic complementarity is consistent with the technical relationships documented by Citizen Lab in the Discover-Tech investigation, including the association between Discover-Tech’s advertising mechanisms and Candiru’s spyware infrastructure. It does not, however, establish the terms of any contract, the ownership of the delivered exploits or the division of revenue between the companies. Those questions require financial and corporate records separate from the technical evidence of delivery.

Candiru’s presence on the U.S. Entity List since November 2021 provides an additional international business consideration. An Entity List designation can restrict access to specified items subject to U.S. export controls, but it is not equivalent to a blanket prohibition on every commercial transaction worldwide. The actual legal consequences depend on the listed entity, the items involved, the applicable jurisdiction and the relevant export-control rules. Commerce Adds NSO Group and Other Foreign Companies to Entity List for Malicious Cyber Activities — Bureau of Industry and Security, November 2021.

NSO Group: a comparable market participant, not a demonstrated AdFection operator

NSO Group is relevant to the comparative investigation because its Pegasus spyware belongs to the wider class of commercial technologies designed for intrusive device surveillance. Its inclusion alongside Candiru in the November 2021 U.S. export-control action provides an official basis for comparing the two companies as suppliers whose products generated national-security and foreign-policy concerns.

The relationship should not be extended beyond that evidence. The October 2026 Discover-Tech investigation does not establish that NSO Group operated the AdFection delivery infrastructure, controlled Discover-Tech or participated in the documented Candiru campaign. Treating NSO Group as a direct participant solely because both companies operate in the commercial spyware sector would conflate market similarity with operational attribution.

Nevertheless, NSO Group’s relevance to the global industry is substantial because the public history of Pegasus demonstrates the strategic implications of commercially supplied device exploitation for government customers, while the associated international controversy illustrates the commercial and regulatory consequences that can follow the public identification of intrusive surveillance capabilities. From an industrial perspective, such suppliers may face simultaneous pressure from exploit-development costs, customer demand for continuing technical effectiveness, export restrictions, litigation and the need to maintain access to specialised technical personnel.

The fundamental commercial distinction is that advertising intelligence can remain useful even when it does not culminate in an exploit, whereas the operational value of a specialised spyware product often depends on obtaining reliable access to the selected target. This asymmetry helps explain why advertising-derived intelligence could function as a complementary market rather than merely a substitute for spyware.

Intellexa and the emergence of a multinational surveillance consortium

Intellexa represents one of the clearest documented examples of a transnational commercial spyware structure in which different legal entities perform specialised industrial, commercial and financial roles. The U.S. Treasury’s March 2024 action identified a consortium associated with Predator spyware, while its September 2024 action expanded the official account of corporate ownership, managerial relationships, international intermediaries and financial transactions.

According to Treasury, the consortium was founded in 2019 and operated through a group of entities involved in the development, marketing, distribution and commercialisation of intrusive surveillance technology. Its structure included companies established in Greece, Ireland, North Macedonia and Hungary, illustrating how the legal geography of a surveillance product can differ from the nationality of its founders, technical employees or governmental customers.

The organisation of intellectual property and distribution rights across several entities is particularly important. A company that develops the core software may not be the same legal entity that concludes customer contracts, receives commercial payments or formally owns the relevant distribution rights. Such separation is common in international business, but it becomes an essential object of investigation when governments need to determine the legal persons responsible for exporting, financing or supplying regulated surveillance capabilities.

In the Intellexa case, the United States Treasury identified these functions explicitly, providing a more reliable basis for corporate reconstruction than the inference of common ownership from shared branding alone.

Table 5.1 — Intellexa consortium: officially documented corporate functions

Entity	Jurisdiction identified by U.S. Treasury	Documented commercial or organisational function	Official action
Intellexa S.A.	Greece	Software-development company within the consortium	Entity List action in July 2023; OFAC designation in March 2024
Intellexa Limited	Ireland	Technology reseller and asset-holding company	Entity List action in July 2023; OFAC designation in March 2024
Cytrox AD	North Macedonia	Developer of Predator spyware	Entity List action in July 2023; OFAC designation in March 2024
Cytrox Holdings ZRT	Hungary	Earlier Predator development functions before production moved to Cytrox AD	Entity List action in July 2023; OFAC designation in March 2024
Thalestris Limited	Ireland	Holder of Predator distribution rights and financial holding-company functions	OFAC designation in March 2024
Aliada Group Inc.	British Virgin Islands	Consortium-associated company involved in substantial financial transactions and equity relationships	OFAC designation in September 2024

Documentary basis: Treasury Sanctions Members of the Intellexa Commercial Spyware Consortium — U.S. Treasury, March 2024 and Treasury Sanctions Enablers of the Intellexa Commercial Spyware Consortium — U.S. Treasury, September 2024.

This structure provides an important analytical model for studying commercial surveillance companies outside the Intellexa network. Corporate ownership must be distinguished from beneficial ownership; beneficial ownership from operational management; and operational management from contractual responsibility for a particular export. A company may own distribution rights without developing the relevant technology, while another may provide technical maintenance without being the contracting supplier.

The distribution of these functions complicates regulatory enforcement because different authorities may have jurisdiction over different transactions. A European Union member state may supervise an exporter established within its territory, while a payment-processing intermediary, beneficial owner or customer operates elsewhere. Financial sanctions, export controls, national corporate law and criminal liability can consequently apply to different participants in the same commercial supply chain.

Individuals identified in the Intellexa sanctions record

The Treasury’s September 2024 action is especially valuable for financial OSINT because it describes not only companies but also individuals linked to beneficial ownership, managerial authority and corporate administration.

Tal Jonathan Dilian was identified as the founder of the consortium in the Treasury’s March and September 2024 records. Sara Hamou was identified in the earlier sanctions action as exercising leadership functions involving several consortium entities. The September 2024 action further identified Felix Bitzios, Andrea Nicola Constantino Hermes Gambazzi, Merom Harpaz, Panagiota Karaoli and Artemis Artemiou in connection with ownership, management or operational roles within the corporate network.

These official descriptions establish specific relationships for the purposes of the U.S. sanctions actions; they do not imply that each individual performed the same function or participated personally in every documented deployment of Predator.

Table 5.2 — Intellexa-related individuals and documented roles

Individual	Relationship described by U.S. Treasury	Corporate-intelligence significance
Tal Jonathan Dilian	Founder of the Intellexa consortium and director of Aliada Group	Central organisational and control relationship
Sara Hamou	Leadership roles associated with Intellexa entities and Thalestris	Cross-entity governance relationship
Felix Bitzios	Beneficial owner of a consortium company used to supply Predator to a foreign government client; former manager of Intellexa S.A.	Connects ownership, management and customer supply
Andrea Nicola Constantino Hermes Gambazzi	Beneficial owner of Thalestris Limited and Intellexa Limited	Connects distribution rights and corporate ownership
Merom Harpaz	Senior executive and former manager of Intellexa S.A.	Operational management relationship
Panagiota Karaoli	Director of multiple consortium entities	Cross-company governance relationship
Artemis Artemiou	General manager and board member of Cytrox Holdings; employee of Intellexa S.A.	Relationship between development and broader consortium operations

The appropriate interpretation of this table is not that all listed individuals exercised simultaneous authority over every corporate entity, but that the official sanctions record identifies a network in which ownership, management and commercial responsibilities crossed jurisdictional boundaries. Treasury Sanctions Enablers of the Intellexa Commercial Spyware Consortium — U.S. Treasury, 16 September 2024.

Cytrox and the separation of development, intellectual property and distribution

Cytrox is significant because its role within the Intellexa consortium provides an unusually explicit illustration of how a spyware product can be distributed across corporate entities. Treasury identified Cytrox AD, based in North Macedonia, as a developer of Predator, while Cytrox Holdings ZRT in Hungary had previously performed development functions before production moved to Cytrox AD.

This geographical transition shows why a company’s current place of incorporation cannot necessarily identify the location where the underlying technology was originally developed, nor establish the jurisdiction governing every component of its intellectual property. Technical employees, corporate assets, product rights and operational infrastructure may be transferred separately, and the documentary record must identify which of those elements changed hands.

From the perspective of national-security authorities, such transfers can affect export-control jurisdiction, licensing obligations, sanctions screening and the feasibility of restricting access to critical components. From the perspective of investors and counterparties, they can influence the valuation of intellectual property, the enforceability of licences and the legal exposure inherited through transactions.

The intelligence question is therefore not simply who owns a named spyware brand, but which legal persons control development, support, distribution, customer contracting and the relevant financial proceeds at a given date.

Bindecy and the evidentiary limits of corporate identification

Bindecy occupies a more uncertain position in the publicly documented corporate landscape. Citizen Lab’s October 2026 investigation identifies connections between Bindecy and Discover-Tech through technical and authentication-related evidence, including user activity associated with the Controlium environment.

These findings justify treating Bindecy as a relevant company for further corporate intelligence collection, but they do not have the same institutional status as the U.S. Treasury’s detailed sanctions findings concerning Intellexa. The publicly reviewed record does not establish a complete, authenticated account of Bindecy’s beneficial ownership, financial position, governmental customers or contractual relationship with Discover-Tech.

The distinction is important because the identification of a technical connection can indicate operational access, testing, maintenance, integration or other forms of cooperation, and the evidence must determine which explanation is warranted. Shared technical access should not automatically be converted into a conclusion concerning shared ownership or participation in a particular spyware campaign.

Citizen Lab’s investigation provides the relevant discovery evidence in Exposing AdFection — Sections 4 and 8, October 2026.

Intelos and the emergence of advertising intelligence as a specialised commercial product

Intelos is particularly relevant to the present study because its reported commercial activity concerns advertising-derived intelligence rather than conventional spyware alone. Citizen Lab identifies Intelos Ltd as an Israeli company established in 2018, with Eric Banoun appearing in the corporate records reviewed by the researchers as a shareholder and director.

The company has been associated with a system described as AdHoc, reportedly designed to obtain intelligence from commercial digital advertising data. Its importance to this investigation arises from the possibility that a surveillance customer can acquire useful intelligence without installing an intrusive implant, provided sufficient advertising-derived information is available and can be reliably associated with a target.

The commercial attractiveness of such a product is different from that of a device-exploitation platform. Intelligence derived from commercial data may be used repeatedly for observation, correlation, geographical analysis and target development, whereas successful spyware deployment can require a more resource-intensive technical intervention. The two activities can consequently support one another, particularly where commercially acquired observations are used to identify a valuable target before more intrusive methods are considered.

Nevertheless, the existence of historical corporate or personnel links among Intelos, Discover-Tech and other surveillance-industry participants does not establish that Intelos operated the Candiru exploitation chain described in the October 2026 investigation. The evidence supports a corporate and functional connection that requires further investigation, not the automatic attribution of every related operation to every associated company.

Comparative assessment of the Israeli surveillance-industry companies

Table 5.3 — Corporate and functional differentiation

Company or network	Principal product or capability category	Documentary basis	Relationship to AdFection	Principal unresolved question
Candiru / Integrity Labs	Intrusive spyware and exploitation	BIS designation; Citizen Lab investigation	Direct technical attribution in documented campaign	Complete customer and financial relationships
NSO Group	Intrusive spyware	BIS designation	Comparable industry participant; no demonstrated direct AdFection involvement	Current commercial structure and product deployment by jurisdiction
Intellexa	Multinational commercial spyware consortium	Treasury sanctions records	Wider surveillance-sector relevance; specific AdFection role not established	Full international control and customer relationships
Cytrox AD	Predator development	Treasury and Commerce records	Part of Intellexa, not established as an AdFection operator	Development and intellectual-property control over time
Cytrox Holdings ZRT	Historical Predator development and corporate holding	Treasury records	Indirect market relevance	Historical asset transfers and effective control
Bindecy	Surveillance-related technology	Citizen Lab technical investigation	Technical and access-related connections	Verified ownership, customer base and contractual role
Intelos	Advertising-derived intelligence	Corporate records reviewed by Citizen Lab	Personnel and infrastructure relationships	Actual scale of commercial deployments and procurement
Discover-Tech	Advertising access and surveillance-enabling delivery	Citizen Lab and Confiant investigations	Central advertising intermediary	Complete revenue structure and customer instructions

The principal conclusion is that the Israeli commercial surveillance sector should be studied as a network of partially differentiated industrial capabilities, rather than through a binary distinction between spyware manufacturers and ordinary technology businesses. The Discover-Tech case illustrates why an advertising intermediary can become strategically consequential without necessarily possessing the same exploit-development capabilities as a spyware manufacturer.

Chapter 5 — Key judgments

The official record establishes a substantial international corporate structure surrounding Intellexa and documents significant U.S. export-control and sanctions actions involving commercial spyware suppliers. The technical investigation of Discover-Tech adds evidence of connections between advertising-derived intelligence and intrusive surveillance, but does not establish a single common corporate command structure embracing Candiru, NSO Group, Intellexa, Bindecy and Intelos.

The principal corporate-intelligence priority is to distinguish the legal entities controlling software development, distribution rights, customer relationships and financial transactions. These functions determine how the industry operates and how regulatory restrictions can affect it, while company names and shared personnel provide only part of the required evidence.

What would change the assessment: Authenticated customer contracts, shareholder agreements, beneficial ownership records and audited intercompany transactions could reveal deeper commercial integration among particular companies, or demonstrate that relationships presently appearing significant were limited to investment, historical governance or technical services.

Open official record: The most consequential gaps concern Bindecy’s verified corporate structure, Intelos’s documented government procurement, Candiru’s post-designation commercial relationships, and the precise ownership and licensing arrangements governing the technologies distributed through the Intellexa consortium.

Chapter 6. The Global Advertising-Intelligence Industry: Commercial Data Collection, Identity Resolution, Geolocation Intelligence and Government Procurement

Principal assessment: the commercial location-data industry demonstrates that intelligence-grade observation can emerge without malware, while enforcement records expose a fundamental conflict between advertising-data accessibility and individual control over sensitive information

The global advertising-intelligence market cannot be understood simply as an extension of commercial spyware because its most important economic asset is often not the ability to compromise a device, but the availability of information generated continuously through legitimate consumer technologies. Mobile applications, advertising exchanges, software development kits, measurement providers and commercial data aggregators produce or process information that can reveal aspects of device location, application usage, behavioural patterns and identity relationships. When such information is available in sufficiently granular form and can be retained or correlated across different contexts, it can support intelligence analysis without requiring the operator to bypass the device’s operating-system protections.

The United States Federal Trade Commission has established an increasingly detailed public enforcement record concerning these practices, including formal proceedings involving X-Mode/Outlogic, Mobilewalla, Gravy Analytics, Venntel and Kochava. These proceedings do not establish that the named companies deployed mercenary spyware or participated in the Discover-Tech operation. Their relevance is that they document commercial practices capable of producing sensitive information about individuals and, in several cases, regulatory allegations or findings concerning the collection, use or sale of that information without adequate consumer safeguards.

The economic structure of this industry creates a problem for governments because information collected for advertising, measurement or application functionality may subsequently be licensed to customers whose objectives differ significantly from those originally understood by the user. A commercial transaction can therefore become intelligence-relevant without a conventional cyberattack occurring at the point of collection. The central institutional question is whether contractual conditions, consent mechanisms, technical restrictions and enforcement powers adequately govern the transfer of information once it has moved beyond the original application or publisher.

The primary documentary record includes the FTC’s Final Order concerning X-Mode and Outlogic — April 2024, FTC’s Final Order concerning Mobilewalla — January 2025, FTC’s Final Order concerning Gravy Analytics and Venntel — January 2025 and the FTC v. Kochava official case record, updated June 2026.

Mobilewalla and the intelligence significance of advertising auction data

Mobilewalla is among the most important comparators because its regulatory case concerns the acquisition and use of information associated directly with real-time advertising auctions. The FTC’s January 2025 final order was particularly significant because the agency explicitly restricted the company’s collection of consumer data from online real-time bidding exchanges for purposes other than participating in the auctions.

This creates a legally documented comparison with the broader advertising-data problem identified in the Discover-Tech investigation. In both cases, the underlying commercial infrastructure allows a participant to encounter data about devices in the context of advertising transactions, but the nature of the alleged or documented misconduct differs. The Mobilewalla enforcement proceeding concerns unfair collection and commercial use of sensitive location information; the Discover-Tech investigation concerns surveillance-oriented advertising infrastructure and its documented relationship with spyware delivery.

The distinction demonstrates that the commercial value of an advertising bid request is not necessarily exhausted by the opportunity to display an advertisement. Data contained in, or obtained through, the transaction may be useful to an entity that has no commercial need to win the auction, and the repeated aggregation of such data can support activities extending beyond advertising attribution.

The FTC’s official account states that its action against Mobilewalla was the first in which the Commission alleged that collecting information from advertising auctions for purposes unrelated to auction participation constituted an unfair practice. This development provides an important regulatory foundation for evaluating future cases in which advertising participation functions as a channel for data acquisition rather than as a means of delivering advertising to prospective consumers.

Table 6.1 — Mobilewalla enforcement record and its implications

Documentary element	Verified status	Intelligence or regulatory significance
Respondent	Mobilewalla Inc.	Identifiable commercial legal entity
Regulatory authority	U.S. Federal Trade Commission	Consumer-protection enforcement
Final order	14 January 2025	Establishes binding restrictions under the order
Data category	Sensitive consumer location information	Potential reconstruction of visits and movement patterns
Collection channel	Included online real-time bidding exchanges	Direct relevance to advertising-derived data acquisition
Special restriction	Prohibition on collecting RTB data for purposes other than participating in auctions	Targets a specific secondary-use practice
Sensitive locations	Included healthcare, religious and other protected categories	Demonstrates risks extending beyond ordinary commercial targeting
Spyware deployment	Not established by the FTC proceeding	Prevents false equivalence with Candiru

Source: FTC Finalizes Order Banning Mobilewalla from Selling Sensitive Location Data — Federal Trade Commission, 14 January 2025.

The Mobilewalla case reveals an important problem of incentives. Advertising exchanges distribute information so prospective purchasers can decide whether to bid, but a recipient may derive informational value independently of making a purchase. Consequently, conventional auction economics can permit an asymmetry in which the economic cost of observing certain data is lower than the intelligence value of the information received. The existence and magnitude of that asymmetry depend on exchange rules, access fees, technical controls and actual data availability, and should not be quantified without transaction-level evidence.

Gravy Analytics and Venntel: commercial location data and the government-customer question

The FTC’s January 2025 final order involving Gravy Analytics and its subsidiary Venntel provides a second essential comparison because it documents concerns concerning sensitive location-data products and their potential commercial and governmental uses.

The Commission alleged that the companies engaged in unfair practices involving the sale and processing of sensitive location information, including information associated with visits to healthcare facilities and places of worship. Its public account also described concerns involving insufficient verification of consumer consent for commercial and government uses.

The government-customer dimension is particularly important for an institutional intelligence report because the availability of information through commercial data providers can create procurement arrangements that do not resemble conventional surveillance-technology acquisition. A public authority may purchase a dataset or analytical service rather than a device-compromise tool, and the resulting capability may be described in contractual documentation as data analytics, location intelligence or information services.

The legal evaluation of such purchases depends on the applicable domestic framework, the nature of the information, the purpose of acquisition, procurement authority and restrictions governing governmental use. It would be inaccurate to infer that every government purchase of commercial location information is unlawful, just as it would be inaccurate to assume that commercial availability automatically confers unrestricted governmental authority to obtain or use the information.

The FTC’s final order restricts the relevant companies’ handling of sensitive location data, subject to defined exceptions, and requires a programme addressing sensitive data locations. Those provisions demonstrate that regulatory oversight can reach both the commercial distribution of information and the internal systems through which sensitive locations are identified and excluded.

FTC Finalizes Order Prohibiting Gravy Analytics and Venntel from Selling Sensitive Location Data — Federal Trade Commission, January 2025.

X-Mode and Outlogic: supplier assurance and downstream restrictions

The X-Mode/Outlogic proceeding illustrates a related but analytically distinct regulatory concern: whether a commercial data broker can demonstrate that information supplied by third parties was collected under adequate consent arrangements and that downstream purchasers are subject to enforceable restrictions.

In April 2024, the FTC finalised an order prohibiting the sharing or sale of sensitive location data in connection with allegations involving precise location information that could reveal visits to sensitive locations. The order required measures including the development of a sensitive-location programme, supplier assessment procedures and restrictions on certain downstream uses.

The supplier-assessment obligation is particularly relevant to corporate intelligence because location-data businesses may depend on multiple upstream contributors, including applications or technical intermediaries whose own data-collection practices differ. Evaluating the broker alone may therefore be insufficient to establish the lawful or secure origin of the information being sold.

The commercial structure also introduces data-lineage problems. A dataset acquired from a broker may contain observations originating from multiple suppliers, while the ultimate institutional customer may have no direct relationship with the applications that generated those observations. In such circumstances, meaningful due diligence requires more than an assertion that the data were commercially available or anonymised.

The order’s requirements regarding deletion, supplier assessment and recipient restrictions demonstrate that regulators can address data-provenance and downstream-use questions together, rather than viewing the transaction solely as a sale between two commercial entities.

FTC Finalizes Order with X-Mode and Successor Outlogic — Federal Trade Commission, April 2024.

Kochava and Collective Data Solutions: a significant 2026 regulatory development

The Kochava litigation is particularly important to the adopted October 2026 cut-off because the FTC announced a proposed resolution on 4 May 2026, followed by a stipulated order entered into the official case record on 26 June 2026.

The FTC described the case as concerning the sale of sensitive location information linked to large numbers of mobile devices, including information potentially capable of revealing individuals’ movements and visits to sensitive locations. The proposed resolution concerned Kochava and its subsidiary Collective Data Solutions, which had taken over Kochava’s data-broker business.

The distinction between a parent company and a subsidiary carrying on a particular business is material to financial and corporate analysis. Regulatory restrictions may attach to named legal respondents and specified practices, while the corporate group may contain additional operations that require separate examination. Similarly, the acquisition or transfer of a business activity between related legal entities does not automatically extinguish the need to assess historical data processing, contractual liabilities or retained information.

The official record is unusually useful because it identifies the procedural sequence from the original 2022 complaint through amended pleadings and the 2026 stipulated order. It therefore permits an analyst to distinguish allegations in earlier litigation from the operative provisions contained in the eventual judicial disposition.

FTC v. Kochava, Inc. — Federal Trade Commission, Case Proceedings, updated 26 June 2026 and FTC to Ban Kochava and Subsidiary from Selling Sensitive Location Data — Federal Trade Commission, 4 May 2026.

Comparative enforcement matrix: United States location-data brokers

Table 6.2 — Official proceedings and restrictions

Company	Principal data-related business examined	Relevant official action	Date	Distinctive regulatory issue	Link to primary record
X-Mode / Outlogic	Precise consumer location data	FTC final order	April 2024	Sensitive locations, supplier assessment and downstream restrictions	FTC case record
Mobilewalla	Advertising-derived and other consumer location data	FTC final order	January 2025	Secondary collection of information from RTB exchanges	FTC case record
Gravy Analytics	Location-data aggregation and commercial analytics	FTC final order	January 2025	Sensitive location information and consent verification	FTC final-order announcement
Venntel	Location-data products; subsidiary of Gravy Analytics	FTC final order	January 2025	Restrictions on sensitive location-data processing and distribution	FTC final-order announcement
Kochava	Mobile-device location data and analytics	Stipulated federal court order recorded in June 2026	June 2026	Consent and restrictions on sensitive location-data distribution	FTC litigation record
Collective Data Solutions	Subsidiary associated with Kochava’s data-broker business	Covered by the Kochava resolution	2026	Legal and operational continuity following business reorganisation	FTC litigation record

These proceedings establish that the United States has developed a substantial enforcement record concerning commercially acquired location information. They do not establish a common ownership structure or operational cooperation among the respondents, and they should not be interpreted as proof that the companies supplied spyware. Their collective significance is the repeated appearance of problems relating to sensitive data, consent, provenance, secondary use and onward distribution.

The intelligence economics of commercial geolocation

The intelligence value of geolocation information depends on accuracy, time resolution, persistence, provenance and the ability to associate observations with the same device or person across different contexts. A single approximate location observation may have limited significance, while a reliable series of observations can reveal recurring patterns, relationships among locations and changes in routine activity.

Commercial products may differ considerably in these respects. Some data provide approximate geographical context derived from network information, while others originate from device location services capable of greater precision under particular conditions. A dataset may contain repeated observations associated with a pseudonymous identifier without directly containing a person’s name, but pseudonymisation alone does not establish that a person’s identity cannot be inferred through auxiliary information.

The intelligence significance also depends on the user’s institutional role. A location pattern associated with an ordinary consumer may be commercially valuable for advertising analytics, while a similar pattern involving a person connected to a sensitive defence facility or diplomatic mission may have national-security implications. The data do not change their technical character merely because their subject is strategically important; their potential consequences change because of the context in which the information is used.

This is the principal reason commercial data procurement requires analysis extending beyond cybersecurity incident response. A government or corporate security authority may face meaningful exposure even where no unauthorised software has executed on an employee’s device.

Government procurement and the limits of public contractual visibility

Government acquisition of commercial data presents an evidentiary challenge because public procurement records do not necessarily identify every technical source of information contained within a purchased service. A contract may describe analytical capabilities, access licences, data subscriptions or software support without publishing the precise datasets, identifiers or upstream suppliers involved.

Consequently, a complete procurement assessment requires connecting several documentary layers: the legal identity of the contracting supplier, the awarded contract or purchase order, the technical product or service actually supplied, the permitted use of the information, and the commercial chain through which the underlying data were acquired.

The presence of a government customer in a commercial vendor’s marketing material is not equivalent to a completed procurement transaction, and the publication of a contract ceiling does not demonstrate that the entire authorised amount was spent. Similarly, contract renewal can establish continued procurement but does not necessarily prove continuity of the same data sources or operational techniques.

The fundamental intelligence problem is that downstream institutional customers may be several contractual relationships removed from the applications or advertising platforms generating the information. Without explicit data-lineage requirements, investigators may be able to identify the immediate supplier but not the full commercial chain or the original lawful basis for collecting particular observations.

Table 6.3 — Government procurement evidence and analytical interpretation

Evidence	What it can establish	What it cannot establish alone
Public tender	Government intention to acquire a defined capability	That a contract was awarded
Contract award	Identified supplier and contractual commitment	Actual operational use or complete expenditure
Contract ceiling	Maximum authorised contractual value	Amount paid
Modification or option exercise	Change or extension of contractual terms	Continuity of identical technical features
Invoice or payment record	A specific financial transaction	Full technical functionality delivered
Supplier presentation	Claimed product capability	Validated performance in government service
Technical acceptance report	Acceptance under defined testing conditions	Use against a particular target
Licence or subscription record	Right to access a product or data service	Actual querying or operational employment
Official audit	Findings within the audit’s mandate and scope	Complete account of classified or excluded activities
Public sanctions decision	Competent authority’s legal determination under a sanctions regime	Criminal liability or responsibility for unrelated conduct

The geopolitical consequences of commercially available intelligence

The availability of commercially generated information challenges the traditional distinction between domestic commercial markets and foreign intelligence collection. A dataset may originate in one country, be processed through infrastructure elsewhere, pass through a broker established in a third jurisdiction and become accessible to an institutional customer operating in a fourth.

This creates questions concerning cross-border transfers, jurisdiction, national-security screening and the availability of sensitive information to foreign entities. It also complicates attempts to assess whether restrictions imposed on a particular intermediary materially reduce the overall exposure, because equivalent information may be available from another supplier or through a different commercial route.

For institutional decision-makers, the most important issue is not the nationality of a data broker considered in isolation, but the actual chain of data custody and control. The legal place of incorporation, location of servers, nationality of shareholders, identities of customers and applicable transfer restrictions may all differ.

Chapter 6 — Key judgments

The U.S. regulatory record establishes that commercial location-data markets can create significant security and privacy risks without relying on intrusive spyware. Mobilewalla is particularly relevant to advertising intelligence because its enforcement case concerned secondary use of information obtained through real-time bidding exchanges, while the proceedings involving X-Mode/Outlogic, Gravy Analytics, Venntel and Kochava demonstrate problems involving sensitive locations, supplier provenance, downstream use and consumer consent.

The principal intelligence conclusion is that commercially obtained device information can become strategically consequential when correlated with additional observations or used by institutional customers whose purposes differ from those associated with ordinary advertising.

What would change the assessment: Authenticated technical provenance records and government procurement files connecting specific commercial datasets to defined institutional uses would permit a more exact assessment of the global demand for advertising-derived intelligence and the relative importance of individual suppliers.

Open official record: The most consequential gaps concern downstream customer identities, historical data-supplier arrangements, the extent of government procurement through intermediaries and the practical effects of the 2024–2026 enforcement orders on the continued availability of sensitive location information.

Chapter 7. Worldwide Comparative Corporate Investigation: North America, Europe, the Middle East, Asia-Pacific, Latin America and Transnational Supply Chains

Principal assessment: the international surveillance economy is organised through cross-border dependencies rather than a single identifiable global industry

The international commercial surveillance market is characterised by a fundamental mismatch between the location of the companies supplying technology, the jurisdictions in which their products are incorporated or distributed, the states where customers operate and the territories in which surveillance activity is eventually observed. This fragmentation complicates corporate attribution, export supervision, financial investigation and the assessment of commercial responsibility because a single deployment may involve software developed in one country, rights held by an entity incorporated in another, a sales intermediary operating from a third, infrastructure provided by globally distributed technology companies and an end customer subject to a different domestic legal regime.

The available evidence does not support the proposition that every jurisdiction contains a company technologically equivalent to Discover-Tech or that a unified international network controls the principal surveillance suppliers. Rather, it supports the existence of several overlapping markets whose products can be complementary: intrusive spyware, telecommunications surveillance, location-data brokerage, advertising-derived intelligence, commercial intelligence analytics, infrastructure services and government-facing technical integration. These markets are connected through commercial opportunities and technological dependencies, but specific corporate relationships must be demonstrated through documentary evidence rather than inferred from the similarity of the resulting intelligence capabilities.

For comparative purposes, the most important distinction is between the country of supplier incorporation, the location of technical development, the jurisdiction of the customer, the location of observed surveillance activity and the jurisdiction through which financial transactions or export permissions pass. These variables should be recorded independently because collapsing them into a single geographic label can produce incorrect conclusions about the source, ownership or sponsorship of a surveillance capability.

North America: the intersection of commercial intelligence, data brokerage and government demand

North America occupies a distinctive position because the United States combines a large commercial advertising and data-processing industry with a substantial public procurement market, advanced cybersecurity research capabilities and regulatory authorities whose official decisions have generated important evidence concerning surveillance technologies and sensitive commercial information.

The principal corporate comparison is not between American data brokers and Israeli spyware manufacturers as if they performed identical activities, but between the different ways through which private businesses supply information or technological access that may be valuable to governmental customers. A commercial location-data provider may supply information concerning the movement of devices, while a company specialising in intelligence analytics may assist customers in interpreting information obtained from multiple sources. An intrusive spyware vendor offers a fundamentally different capability: the ability to compromise a device and obtain information inaccessible through ordinary commercial data markets.

The FTC enforcement proceedings examined in Chapter 6 establish the regulatory significance of location-data aggregation and secondary use. They do not, however, produce a complete inventory of companies supplying advertising-derived intelligence to government customers, nor do they identify every commercial reseller or institutional buyer. An international corporate census must therefore treat the verified FTC respondents as documented examples of relevant commercial practices rather than as the entire North American market.

The United States also provides the strongest publicly examined official record of sanctions and export controls directed at foreign commercial spyware suppliers. The Department of Commerce’s 2021 Entity List action concerning NSO Group and Candiru, followed by the 2023 listings and 2024 Treasury sanctions affecting Intellexa-related entities, demonstrates the use of separate regulatory mechanisms against different legal persons. These measures have different legal consequences and should never be described collectively as if they constituted one universal prohibition on all international surveillance technology.

The Canadian role is institutionally different. The University of Toronto’s Citizen Lab has produced technical investigations that contributed to identifying surveillance infrastructures and their relationships with affected civil society organisations, journalists and other targets. Its research activity is not evidence that Canada hosts or directs the identified spyware operations; rather, it demonstrates the importance of independent technical research in the international accountability environment. Under the user’s protocol, such research is treated as technical discovery evidence and assessed against available official records, not automatically promoted to governmental authority.

The key North American issue is consequently a dual exposure: government institutions may be purchasers or users of commercially generated information, while their own personnel and facilities may also be subjects of intelligence analysis performed by foreign or domestic actors using commercial data. This dual role creates a governance problem because the same commercial market may offer operational benefits to authorised government investigations while exposing sensitive personal or institutional information to customers whose purposes and legal authority are different.

Europe: development jurisdictions, financial intermediaries and export-control fragmentation

Europe is materially implicated in the international surveillance market because the official Intellexa record identifies legal entities in several European jurisdictions, while the European Union’s dual-use export-control framework establishes obligations affecting specified cyber-surveillance items and, under defined conditions, items not otherwise listed in the relevant annexes.

The most important legal instrument for this analysis is Regulation (EU) 2021/821, which governs controls on exports, brokering, technical assistance, transit and transfers of dual-use items. Article 5 establishes a mechanism concerning non-listed cyber-surveillance items when the relevant authority has informed the exporter that the items are or may be intended for internal repression or serious violations of human rights or international humanitarian law. It also imposes a notification obligation where an exporter becomes aware, through its due diligence findings, of an intended use of the kind specified in that provision.

The distinction between listed and non-listed items is fundamental. A product does not automatically escape regulatory scrutiny because it is absent from a particular control list, but the applicable conditions, authority and evidentiary requirements differ. Likewise, a company incorporated within the European Union cannot be assumed to have violated export-control obligations merely because its technology is associated with surveillance activities elsewhere.

The relevant operative instrument is Regulation (EU) 2021/821 — European Parliament and Council, 20 May 2021, Article 5 and related provisions.

Greece

Greece is especially significant because Treasury identified Intellexa S.A. as a Greece-based software-development company within the Intellexa consortium. This creates a direct relationship between the European legal environment and the international commercial distribution of Predator spyware, although the precise licensing status of particular transactions requires the relevant national administrative records.

The strategic importance of Greece arises from its position as both an EU member state subject to the common dual-use framework and a jurisdiction connected to a major surveillance consortium through a documented legal entity. An analysis of its responsibilities must distinguish national licensing decisions, domestic investigations, EU regulatory obligations and foreign sanctions decisions, rather than assuming that one automatically establishes the legal outcome of another.

Ireland

Ireland is relevant because Treasury identified Intellexa Limited and Thalestris Limited as Ireland-based entities involved in technology resale, asset holding, distribution rights and financial functions. This is especially important to corporate-intelligence analysis because the jurisdiction of a commercial reseller or rights-holding company may influence the legal documentation associated with contracts, licensing and revenue, even when the underlying spyware was developed elsewhere.

An Irish company exercising distribution rights is not necessarily the technical manufacturer of the software it markets. For investigators, the decisive records therefore include the agreements governing distribution, ownership, sublicensing, contractual counterparties and the allocation of proceeds.

Hungary and North Macedonia

Hungary and North Macedonia illustrate the geographic separation between different stages of software development. Treasury reported that Cytrox Holdings ZRT in Hungary had previously performed development functions associated with Predator before production moved to Cytrox AD in North Macedonia.

The importance of this transfer extends beyond the identification of the two companies. It demonstrates why export-control investigations must establish the relevant product version, legal exporter, location of development and contractual arrangements at the time of each transaction. A historical connection to the original developer does not necessarily establish control over later sales, while a subsequent development entity may exercise operational or technical responsibilities that were not present when earlier exports occurred.

North Macedonia is not an EU member state, so its domestic export-control framework and international commitments must be examined separately from obligations applying directly to companies established in EU member states. The existence of commercial or technical relations between entities in those jurisdictions does not eliminate the need to identify the relevant competent authority for each legal person and transaction.

Italy, France, Germany and the United Kingdom

Italy, France, Germany and the United Kingdom require distinct treatment because their industrial structures, national-security authorities, procurement procedures and approaches to the supervision of sensitive technology are not identical.

For Italy, the priority is the possibility of exposure through corporate structures, telecommunications relationships, foreign technology suppliers and commercial-data dependencies affecting strategically important organisations. The appropriate corporate investigation should examine company registrations, telecommunications supply arrangements, public contracts and the role of national authorities responsible for cybersecurity, privacy protection and dual-use export supervision. The available sources reviewed for this chapter do not establish a specific Italian company as a participant in AdFection, and the assessment must not manufacture such a relationship merely to complete a geographic comparison.

For France, the relevant industrial and regulatory environment includes both national-security oversight and a developed administrative practice concerning personal-data protection. Its surveillance-market exposure should be examined through the distinction between vendors supplying lawful security and intelligence technology, companies engaged in advertising-data processing and businesses connected to foreign commercial surveillance suppliers. An enforcement decision concerning advertising consent is not evidence of a spyware operation, but it can establish weaknesses or non-compliance in the governance of commercial information.

For Germany, the industrial significance lies in its large manufacturing and technology economy, extensive international corporate relationships and position within the EU legal system. A company operating within Germany may encounter surveillance-related technologies as a software customer, advertising intermediary, subcontractor, financial counterparty or recipient of imported technical services. Each role has different legal implications. The available evidence does not establish German ownership or direction of the Discover-Tech operation, and the relevant exposure should be investigated through documented corporate and technical relationships rather than presumed from the size of Germany’s digital economy.

For the United Kingdom, the analysis must distinguish the domestic regulatory framework governing personal information and national-security activity from the EU export-control system, which does not apply to the UK in the same general manner after its departure from the European Union. UK company registration, financial supervision, sanctions implementation and export licensing provide important potential evidence sources for investigations of internationally structured surveillance companies. The historical ICO examinations of real-time bidding also make the United Kingdom relevant to assessing commercial advertising-data governance.

Table 7.1 — European jurisdictions and documented surveillance-industry relevance

Jurisdiction	Documented or legally relevant role	Primary authority or framework	Principal intelligence question
Greece	Intellexa S.A. software development	EU dual-use framework and Greek competent authorities	Which legal entity exported or licensed specified surveillance capabilities?
Ireland	Intellexa Limited and Thalestris Limited	Irish corporate law, EU dual-use rules and applicable sanctions	Who controlled distribution rights, transactions and assets?
Hungary	Cytrox Holdings ZRT	Hungarian corporate and export-control framework	What development assets and rights were transferred?
North Macedonia	Cytrox AD	Domestic law and applicable export-control commitments	Which entity controlled later Predator development and supply?
Italy	Potential industrial, procurement and commercial-data exposure	National authorities and EU law	Which documented suppliers and counterparties operate within critical sectors?
France	Advertising regulation, industrial and national-security exposure	CNIL, national authorities and EU law	How are commercial-data and surveillance-technology risks supervised?
Germany	Industrial supply chains and technology-services exposure	Federal and Länder institutions, EU law	Which commercial relationships create verifiable technical or data dependencies?
United Kingdom	Advertising-data regulation, procurement and international corporate structures	UK ICO, Companies House, export and sanctions authorities	How are data brokerage and surveillance suppliers identified and supervised?

The first four jurisdictions have direct documented connections to the Intellexa corporate structure in the U.S. Treasury record. The remaining jurisdictions are material for regulatory and industrial assessment; their inclusion does not imply confirmed participation in the activities under investigation.

Russia and Eastern Europe: cybersecurity companies, state relationships and the limits of functional comparison

Russia presents a different corporate-intelligence problem because official U.S. records identify certain cybersecurity businesses as having relationships with Russian state-security institutions, but these findings do not necessarily concern advertising-mediated surveillance.

In April 2021, the U.S. Treasury sanctioned Positive Technologies and several other Russian technology entities, citing their roles in supporting Russian intelligence services or the relevant national-security concerns identified under the applicable sanctions authorities. In November 2021, the Commerce Department separately added Positive Technologies to the Entity List, alongside NSO Group, Candiru and a Singapore-based cybersecurity consultancy.

These decisions establish regulatory actions against specific entities and form a basis for comparing how governments evaluate the security implications of privately incorporated cybersecurity suppliers. They do not demonstrate that Positive Technologies conducted AdFection-style advertising surveillance, nor establish a commercial relationship with Discover-Tech.

The distinction is particularly important because software vulnerability research, security testing and the development of offensive intrusion capabilities may involve overlapping technical knowledge, while their lawful uses, customers and regulatory treatment differ. An analyst cannot infer the delivery of spyware from the commercial description of a penetration-testing product alone.

The official records are Treasury Sanctions Russia with Sweeping New Sanctions Authority — U.S. Department of the Treasury, April 2021 and Commerce Adds NSO Group and Other Foreign Companies to Entity List — Bureau of Industry and Security, November 2021.

Middle East: surveillance demand, commercial supply and attribution problems

The Middle East has particular significance because the relationship between surveillance suppliers and governmental customers can be affected by regional security concerns, domestic legal frameworks, diplomatic relationships and cross-border corporate structures. However, the existence of surveillance activity within a country does not necessarily establish that its government procured or directed the technology involved.

The available official U.S. sanctions record identifies the Intellexa consortium as a supplier with international government customers, but a complete publicly verified customer-by-customer register is not available in the reviewed documents. The Discover-Tech investigation likewise provides evidence concerning advertising activity and particular technical connections, but does not identify the ultimate governmental customer responsible for every campaign.

For corporate intelligence, the most important distinction is therefore between an observed deployment environment and an authenticated procurement relationship. A technical server located in a particular country, an advertising impression associated with a national IP range or the presence of a local intermediary can each justify further investigation, but none independently identifies the authority controlling an operation.

Middle Eastern surveillance markets should consequently be examined through corporate filings, procurement documents, export licences, official regulatory actions and technical incident reports, with particular attention to whether supply arrangements were concluded directly with an end customer or through foreign distributors.

Asia-Pacific: Indonesia as a documented case of international spyware supply-chain opacity

Indonesia provides one of the more informative documented examples of the difficulties involved in investigating international spyware supply chains. In May 2024, Amnesty International published a technical investigation identifying surveillance infrastructure and malicious domains associated with multiple commercial spyware systems, including Candiru and Predator.

The investigation identified infrastructure consistent with a Predator customer deployment in Indonesia during the period examined, but it did not establish a complete chain of export records, contractual payments or authenticated end-user documentation connecting every observed technical system to a specific purchasing authority.

This distinction is especially important because the presence of a spyware server within a country can suggest a customer deployment without establishing the complete legal arrangements through which the capability was obtained. International intermediaries may conduct sales negotiations, licensing may occur through a separate jurisdiction, and implementation can involve technical personnel or contractors who are not the legal supplier of record.

Amnesty’s report also identified infrastructure and domains designed to imitate Indonesian news and political content. These technical findings are relevant to the operational context, but the investigation explicitly distinguished infrastructure analysis from forensic confirmation of infections affecting particular individuals.

A Web of Surveillance: Unravelling a Murky Network of Spyware Exports to Indonesia — Amnesty International Security Lab, May 2024.

The Indonesian case demonstrates a wider intelligence problem: public technical evidence may identify a deployed capability before official financial or export records reveal how it reached the market. This creates a persistent gap between evidence of technological presence and evidence of legally attributable commercial supply.

Africa: Angola and the value of incident-level forensic corroboration

Angola provides an important example of how international corporate surveillance investigations can be strengthened by forensic evidence from an affected individual.

In February 2026, Amnesty International published a technical investigation concerning Angolan journalist Teixeira Cândido, identifying a successful Predator spyware infection on 4 May 2024. Researchers reported examining the journalist’s device and identifying forensic traces consistent with the execution of Predator spyware, including communications associated with the implant.

This provides a stronger basis for establishing a successful compromise than the identification of a suspicious domain alone. Nevertheless, vendor attribution does not automatically identify the governmental or commercial entity that commissioned the attack, and the reported use of Portuguese-language malicious messages cannot independently establish the nationality of the operator.

The Angola case also supplies an important comparative distinction from AdFection. The documented Predator attack involved a malicious link delivered through messaging rather than the advertising-mediated mechanism examined in the Discover-Tech investigation. Both cases are relevant to the international commercial spyware market, but the delivery methods and their defensive implications are different.

Journalism Under Attack: Predator Spyware in Angola — Amnesty International Security Lab, February 2026.

Latin America: the need to distinguish regional targeting evidence from verified commercial supply

Latin America is relevant to the broader commercial spyware market because publicly documented investigations have identified deployments and targeting involving journalists, activists and political figures in parts of the region. Nevertheless, this chapter does not attribute a particular technology to a particular government without a corresponding competent official record or adequately supported technical investigation.

Mexico is specifically relevant to the Discover-Tech evidence because Citizen Lab’s 2026 advertising data identified substantial transaction volumes associated with Mexican IP addresses, while Confiant observed Candiru-associated delivery activity within Mexico during its telemetry period. These findings do not establish that the Mexican government procured the service, that every observed advertisement represented a malicious attempt or that all exposed individuals were successfully identified.

Latin American corporate investigations should therefore begin with the legal entities responsible for local sales, distribution and technical integration, while separately examining governmental procurement and any verified incidents. National procurement systems, corporate registries, legislative inquiries and judicial records provide different types of evidence, and discrepancies among them should be assessed rather than silently reconciled.

International comparative matrix

Table 7.2 — Selected jurisdictions and the strongest documented form of evidence

Region	Jurisdiction	Relevant actor or documented activity	Evidence class	Operational conclusion supported
North America	United States	Mobilewalla, Gravy Analytics, Venntel, X-Mode/Outlogic, Kochava	Official FTC proceedings	Regulated or litigated commercial location-data practices
North America	Canada	Citizen Lab technical investigations	Research documentation	Technical findings concerning identified surveillance operations
Europe	Greece	Intellexa S.A.	U.S. Treasury sanctions record	Documented development-company relationship
Europe	Ireland	Intellexa Limited, Thalestris Limited	U.S. Treasury sanctions record	Documented resale, asset and distribution functions
Europe	Hungary	Cytrox Holdings ZRT	U.S. Treasury sanctions record	Historical Predator development functions
Europe	North Macedonia	Cytrox AD	U.S. Treasury sanctions record	Predator development role
Eastern Europe	Russia	Positive Technologies	U.S. Treasury and BIS actions	Officially documented sanctions and export-control concerns
Middle East	Israel	Candiru, NSO Group, Discover-Tech, Intelos	U.S. official records and technical investigations	Distinct commercial surveillance and advertising-intelligence capabilities
Asia-Pacific	Indonesia	Predator- and Candiru-associated infrastructure	Technical investigation	Evidence of surveillance infrastructure; full commercial supply chain unresolved
Africa	Angola	Predator infection of Teixeira Cândido	Forensic technical investigation	Confirmed device compromise in the documented case
Latin America	Mexico	Discover-Tech advertising and Candiru-associated delivery observations	Citizen Lab and Confiant telemetry	Exposure and observed delivery activity; ultimate customer unresolved
International offshore	British Virgin Islands	Aliada Group Inc.	U.S. Treasury sanctions record	Documented financial and ownership relationships within Intellexa

The table deliberately distinguishes official sanctions findings, technical attribution, regulatory proceedings and advertising telemetry. It does not present these heterogeneous observations as equivalent measurements of surveillance intensity or as proof that the same commercial network operates in every jurisdiction.

Chapter 7 — Key judgments

The global surveillance market is best understood as a set of overlapping corporate and technological networks operating across different jurisdictions, rather than a single industry organised through one national centre or uniform supply chain. Official U.S. records establish transnational ownership and commercial relationships within Intellexa, while technical investigations in Indonesia and Angola demonstrate how surveillance capabilities can appear in operational environments far removed from the jurisdictions of their developers.

The principal comparative finding is that the location of a company, the location of its intellectual property, the jurisdiction of its distributor, the identity of its customer and the territory of a surveillance operation must be established separately. Failure to preserve these distinctions creates substantial risks of erroneous geopolitical attribution.

What would change the assessment: A larger body of authenticated export licences, national procurement contracts, court records and financial disclosures would permit the construction of a more complete map of actual global suppliers and customers, potentially demonstrating commercial relationships not presently established.

Open official record: Important gaps remain concerning local distributors, government end users, intermediated transactions, the transfer of technical rights between jurisdictions and the practical enforcement of applicable export-control obligations.

Chapter 8. Corporate and Financial OSINT: Beneficial Ownership, Registries, Subsidiaries, Intermediaries, Acquisitions, Contracts, Export Controls and Sanctions Exposure

Principal assessment: identifying the ultimate commercial beneficiaries of surveillance operations requires reconstructing legal control, intellectual-property ownership, financial transactions and export responsibilities as separate but connected evidentiary systems

The greatest challenge in financial and corporate intelligence concerning commercial surveillance suppliers is not necessarily the absence of identifiable companies, but the difficulty of determining which legal and natural persons exercised effective control over specific assets, revenues, customer relationships and operational decisions at a particular point in time. International surveillance businesses can distribute these functions among corporations incorporated in different jurisdictions, while technical branding and product names may continue unchanged after transfers of ownership, intellectual-property rights or commercial responsibilities.

The resulting structures cannot automatically be described as illicit or designed to evade regulatory scrutiny, because multinational corporate groups routinely employ holding companies, regional subsidiaries, intellectual-property vehicles and local distributors for legitimate reasons. Their relevance to intelligence analysis arises when the investigator must determine whether the structure obscures the identity of an ultimate beneficiary, separates the formal contracting entity from the developer of a regulated product, or complicates the enforcement of export controls, sanctions and contractual obligations.

The Intellexa sanctions record provides a particularly instructive example because the United States Treasury identified separate companies performing development, resale, financial holding and distribution functions, while its September 2024 action described beneficial owners, managerial relationships and a British Virgin Islands company involved in substantial financial transactions. This is considerably stronger documentary evidence of a structured international network than the mere appearance of similar company names in commercial registries.

For Discover-Tech and its related commercial environment, the evidentiary picture is different. Citizen Lab identified historical ownership and infrastructure relationships, but the publicly reviewed material does not establish a complete financial account of customer payments, surveillance-related revenue or the contractual allocation of responsibilities between Discover-Tech and Candiru. Consequently, the appropriate corporate intelligence conclusion is that the known relationships justify targeted financial and legal investigation, not that a complete money trail has already been reconstructed.

Beneficial ownership and the limitations of ordinary company registries

A corporate registry ordinarily provides information about the legal existence and certain governance characteristics of an entity, but its disclosure requirements differ across jurisdictions. Depending on the jurisdiction and entity type, records may identify directors, registered shareholders, legal addresses, filing dates, share capital and certain changes in control. They do not necessarily identify every natural person exercising ultimate economic ownership or effective control.

Beneficial ownership is therefore analytically different from registered ownership. A registered shareholder may hold shares on behalf of another person, while voting agreements, trusts, control rights and contractual arrangements can influence the economic or managerial position of persons who are not immediately visible in an ordinary shareholder list.

For surveillance-industry investigations, these differences are particularly consequential where a developer, reseller and contracting entity occupy different places in the corporate structure. The legal person receiving a government payment may not be the company that develops the software, and the ultimate economic beneficiary may not be identifiable from the immediate commercial contract.

The Indonesian surveillance-supply-chain investigation published by Amnesty International in May 2024 illustrates the problem. The researchers identified intermediary companies in Singapore and described the use of corporate-secretarial arrangements that complicated the identification of beneficial ownership and the tracing of surveillance products supplied to Indonesian entities.

The evidence does not justify treating all nominee or corporate-secretarial arrangements as unlawful. It demonstrates that, where public registries reveal only limited information about the persons exercising control, additional documentary evidence may be necessary to reconstruct the ownership and commercial supply chain.

A Web of Surveillance: Unravelling a Murky Network of Spyware Exports to Indonesia — Amnesty International Security Lab, May 2024.

Table 8.1 — Corporate ownership evidence and its legal meaning

Evidence type	Principal information established	Material limitation	Appropriate corroborating record
Certificate of incorporation	Legal formation of an entity	Does not establish current operations or ownership	Current corporate extract
Shareholder register	Registered shareholding at the relevant date	May not identify ultimate beneficial owners	Beneficial ownership filings, shareholder agreements
Director register	Formally appointed directors	Appointment does not prove involvement in every operational decision	Board resolutions and authenticated management records
Beneficial ownership declaration	Declared persons exercising relevant ownership or control	Accuracy and public availability vary by jurisdiction	Supporting ownership and control instruments
Annual financial statements	Financial position and performance within the reporting scope	May be consolidated or omit customer-level information	Detailed notes and subsidiary accounts
Intellectual-property register	Registered rights or applications	Registration does not prove actual operational control	Licensing and assignment agreements
Share purchase agreement	Terms of a defined equity transaction	May contain confidential conditions	Registry updates and financial closing records
Asset purchase agreement	Transfer of specified assets or business activities	Does not necessarily transfer corporate liabilities or shares	Asset schedules and completion documents
Distribution contract	Commercial rights to market or supply a product	May not identify the ultimate end user	Customer contracts and delivery records
Procurement award	Government contracting authority and supplier	Does not establish full expenditure or operational deployment	Invoices, acceptance records and audits
Sanctions designation	Legal action against identified persons under a specified authority	Does not establish responsibility for unrelated operations	Official designation record and supporting findings
Export licence	Authorisation for a specified transaction, where disclosed	Does not prove shipment or final deployment	Customs and delivery records

This matrix demonstrates why a corporate investigation should avoid constructing ownership networks exclusively from commercial databases. Such databases may be useful for identifying entities and historical changes, but the evidentiary significance of a relationship depends on the underlying registry, transaction or legal instrument.

The Intellexa financial network and the significance of Aliada Group

The Treasury’s September 2024 sanctions decision provides a particularly important financial finding involving Aliada Group Inc., a British Virgin Islands company associated with the Intellexa consortium.

The Treasury stated that Aliada Group had enabled transactions involving tens of millions of dollars within the consortium network. It also described relationships involving Intellexa S.A., Intellexa Limited and Cytrox Holdings, as well as the direction of Aliada Group by Tal Jonathan Dilian.

This is a significant official statement concerning the scale of financial activity within a particular corporate network, but the phrase tens of millions of dollars does not establish an exact transaction total, annual revenue or net profit. Nor does it establish that every transaction concerned a completed spyware sale or a particular government customer.

The distinction between transaction volume and recognised revenue is especially important. Transfers within a corporate network may include capital contributions, intercompany payments, asset purchases, financing, licence fees or receipts from customers. Without the relevant accounting and banking records, summing such transfers can lead to double counting or the incorrect classification of financing flows as operating income.

The documented role of Aliada Group illustrates why offshore entities may be significant to sanctions and corporate intelligence. An entity established outside the primary development jurisdiction can hold equity interests or participate in financial arrangements that connect otherwise separate companies, making it necessary to examine the direction and nature of transactions rather than relying solely on product branding.

Treasury Sanctions Enablers of the Intellexa Commercial Spyware Consortium — U.S. Department of the Treasury, 16 September 2024.

Financial reconstruction and the danger of unsupported market valuations

One of the most common weaknesses in analysis of the commercial spyware sector is the publication of large market valuations or revenue estimates without a clear distinction between contract authorisations, completed purchases, recognised revenue, investment financing and the costs of developing technical capabilities.

The reviewed official records support some precise legal and organisational conclusions, but they do not provide a comprehensive, audited global revenue series for commercial spyware or advertising-derived intelligence. The absence of such a series should not be concealed through estimates presented as established market size.

A credible financial analysis must distinguish at least six different quantities. Contract value concerns the agreed commercial consideration under a particular arrangement. Contract ceiling concerns the maximum expenditure permitted under a procurement instrument. Actual outlays concern payments that have been made. Supplier revenue concerns amounts recognised under applicable accounting rules. Intercompany transfers concern flows among related entities, which may not increase the group’s consolidated revenue. Net profit concerns the residual financial result after applicable costs and other accounting items.

The distinction becomes more complicated where a supplier delivers software licences, maintenance, equipment, training, technical support and operational services through different entities. A headline contract value may include several years of support, while only part of the amount is attributable to the underlying surveillance software.

Table 8.2 — Financial quantities relevant to surveillance-market analysis

Financial measure	Meaning	Frequent analytical error
Contract ceiling	Maximum value authorised under a contract	Treating the ceiling as expenditure
Contract award value	Value associated with an awarded agreement	Assuming the entire amount was paid
Invoice value	Amount billed for goods or services	Assuming payment or acceptance has occurred
Government outlay	Amount actually paid	Treating all payments as spyware purchase costs
Recognised revenue	Revenue accounted for by the supplier	Equating it with cash receipts
Operating profit	Result after specified operating costs	Confusing it with revenue
Net profit	Final financial result after applicable charges	Inferring it from contract values
Equity investment	Capital contributed in exchange for ownership	Treating investment as sales
Shareholder loan	Financing provided by a shareholder	Treating financing as earned income
Intercompany transfer	Transaction between related entities	Double counting consolidated activity
Intellectual-property licence fee	Payment for specified technology rights	Treating it as the value of the entire company
Asset acquisition value	Consideration for specified assets or businesses	Equating an asset sale with a full corporate acquisition

The Intellexa network’s documented transaction volume is meaningful evidence of substantial financial activity, but it is insufficient to determine group revenue, profitability or the amounts received from individual governments.

Similarly, Discover-Tech’s large advertising transaction dataset does not establish the company’s sales revenue or surveillance-related income. Advertising bids may represent offers rather than completed purchases, and winning bids do not directly disclose the financial margin retained by the intermediary.

Cross-border intermediaries and the allocation of commercial responsibility

Intermediaries can perform several distinct functions in the international surveillance trade. Some act as authorised resellers, others provide systems integration or technical installation, while others may arrange introductions, negotiate contracts or supply supporting infrastructure.

A corporate relationship involving an intermediary must therefore be interpreted in accordance with the service actually performed. An intermediary receiving a commission is not necessarily the legal exporter of the software, while an entity signing the customer contract may be responsible for delivery even if development occurs elsewhere.

Amnesty International’s Indonesia investigation described an environment involving suppliers, brokers and resellers operating across several jurisdictions, with corporate and trade records providing evidence of transfers but incomplete visibility into ultimate beneficiaries and end-user arrangements.

That evidence demonstrates why the international supply chain cannot be reconstructed simply by identifying the brand of spyware detected in a country. A product may be supplied through distributors that are not publicly associated with the brand, while the governmental procurement record may identify a local technical services company rather than the original developer.

For regulatory purposes, the identity of each intermediary matters because the relevant obligations may concern the exporter, broker, supplier, financial institution or end user under different domestic and international legal frameworks. The existence of a licence in one jurisdiction cannot be presumed to authorise every associated transaction elsewhere.

Export controls and financial sanctions: separate regulatory instruments

Export controls and financial sanctions can affect the same surveillance company, but they are legally distinct mechanisms.

An Entity List designation under the U.S. Export Administration Regulations can impose licensing requirements on specified exports, reexports and transfers involving items subject to the relevant rules. Its practical effect depends on the entity concerned, the item, the applicable jurisdiction and any exceptions or licensing policies.

OFAC financial sanctions operate through different legal authorities and may impose restrictions concerning property, interests in property and transactions involving designated persons, subject to the applicable regulations and authorisations. The consequences can extend beyond the designated company’s direct contracts because corporate ownership relationships and dealings involving designated persons may affect the compliance obligations of counterparties.

The Intellexa record demonstrates this distinction particularly clearly. Certain companies were added to the Commerce Department’s Entity List in July 2023, while separate Treasury actions designated individuals and entities in March and September 2024. These were not interchangeable announcements, nor did they necessarily cover identical legal persons or produce identical restrictions.

Table 8.3 — Official U.S. actions concerning selected surveillance and cybersecurity actors

Date	Authority	Named companies or network	Instrument	Principal significance
April 2021	U.S. Treasury	Positive Technologies and other Russian technology entities	Financial sanctions	Official findings concerning support for Russian intelligence services
November 2021	U.S. Commerce / BIS	NSO Group and Candiru	Entity List	Export-control restrictions based on identified national-security and foreign-policy concerns
November 2021	U.S. Commerce / BIS	Positive Technologies and Computer Security Initiative Consultancy Pte. Ltd.	Entity List	Additional restrictions concerning identified cyber-tool activities
July 2023	U.S. Commerce / BIS	Intellexa S.A., Intellexa Limited, Cytrox AD and Cytrox Holdings ZRT	Entity List	Restrictions concerning commercial cyber-exploitation technology
March 2024	U.S. Treasury / OFAC	Intellexa consortium entities and identified individuals	Financial sanctions	Action concerning development and distribution of commercial spyware
September 2024	U.S. Treasury / OFAC	Additional Intellexa-associated individuals and Aliada Group Inc.	Financial sanctions	Expanded official identification of ownership, management and financial relationships

The source record comprises Treasury Sanctions Russia with Sweeping New Sanctions Authority — April 2021, Commerce Adds NSO Group and Other Foreign Companies to Entity List — November 2021, Treasury Sanctions Members of the Intellexa Commercial Spyware Consortium — March 2024 and Treasury Sanctions Enablers of the Intellexa Commercial Spyware Consortium — September 2024.

The table identifies actions rather than asserting a complete current sanctions-screening result for every named entity. Transaction-specific compliance requires examination of the operative designation, applicable restrictions, subsequent amendments and relevant ownership information at the date of the proposed transaction.

European dual-use regulation and the allocation of responsibility

The European Union’s Regulation 2021/821 is particularly relevant because it expressly addresses cyber-surveillance items and provides a mechanism for controlling certain non-listed items where the circumstances specified in Article 5 are satisfied.

The legal analysis must distinguish a product’s technical capability from its classification under the regulation, the exporter from the developer, and the existence of a licensing obligation from the final administrative decision to grant or refuse an authorisation.

An investigation of a company supplying surveillance technology from the European Union should therefore establish the identity of the legal exporter, the relevant item, the technical classification, the applicable licensing requirements, the competent national authority and the end-use documentation. A company incorporated outside the European Union may still encounter EU-related compliance questions through subsidiaries, transfers, technical services or transactions involving items subject to applicable controls, but those obligations cannot be inferred without examining the actual circumstances.

Regulation (EU) 2021/821 — European Parliament and Council, consolidated legal text and Article 5.

The commercial consequences of regulatory restrictions

Regulatory restrictions can affect the international surveillance sector through several channels beyond the immediate prohibition or licensing requirement. They may reduce access to specific software, hardware or services; create compliance obligations for commercial counterparties; complicate banking and payment relationships; alter customer procurement decisions; and affect the commercial attractiveness of companies seeking investment or acquisition.

These effects cannot be quantified without firm-specific financial evidence. However, the mechanisms are sufficiently clear to justify analysing a surveillance company’s regulatory exposure alongside its technical capabilities and corporate structure.

A company dependent on externally supplied components may face restrictions different from those affecting a firm that develops most of its technology internally. A distributor may encounter transaction constraints without controlling the underlying intellectual property, while a holding company may be exposed through its ownership interests or financial transactions.

This makes commercial dependence a significant subject of intelligence collection. The most important suppliers are not necessarily the most visible corporate names; they may be the providers of indispensable technical services, intellectual-property licences, infrastructure or payment facilities.

Corporate acquisitions and the continuity of technical capability

Acquisitions create additional complexity because a surveillance capability may survive changes in corporate ownership or branding. The relevant technology can move through asset sales, licences, personnel transfers or corporate reorganisations, while historical domain names and public company descriptions continue to reflect previous arrangements.

The MyDSP history examined in Pillar I illustrates how advertising technology can pass through several corporate environments without establishing that each historical owner participated in later activities. The Affle asset acquisition similarly demonstrates the importance of distinguishing the sale of defined business assets from the acquisition of a company’s entire legal identity.

For corporate financial analysis, the operative questions concern which assets were transferred, what liabilities were assumed, whether intellectual-property rights were assigned or licensed, which customer contracts were included, and whether technical support or personnel arrangements continued after the transaction.

An asset purchase may transfer a commercially valuable software platform without transferring ownership of the seller. Conversely, a share acquisition may transfer control of the company while leaving some intellectual-property rights held by another entity. These distinctions have consequences for valuation, sanctions screening and historical attribution.

Corporate OSINT methodology: a verification architecture for decision-grade investigations

A rigorous financial investigation should preserve the original evidence for every corporate relationship, including the legal entity name, jurisdiction, registration identifier where available, filing date, reference period and the exact document supporting the connection.

The investigation should begin with the legal identity of each company rather than its commercial brand. Historical records are necessary because current corporate ownership may differ from the ownership structure during the period of the alleged activity. Shareholder changes, director appointments and transfers of business assets should therefore be recorded with their effective dates.

Financial analysis should proceed separately, using audited statements, official procurement documents, authenticated transaction records and competent regulatory findings. Where source documents do not disclose contract prices, payments or revenue, no monetary value should be invented from transaction counts or platform activity.

Technical infrastructure evidence can then be connected to the corporate record, but only at the level justified by the observation. Shared domains, certificates, hosting environments or website-management accounts may support technical association, while formal corporate control requires different documentary evidence.

Table 8.4 — Corporate-intelligence collection priorities

Investigation objective	Decisive record	Responsible source or repository type	Main analytical outcome
Establish legal identity	Incorporation document and current extract	Competent corporate registrar	Identifies the legal entity
Establish historical shareholders	Dated shareholding records	Corporate registrar or authenticated company records	Reconstructs ownership at the relevant time
Identify beneficial owners	Control declarations and ownership instruments	Competent beneficial ownership authority, company filings or legal records	Identifies natural persons exercising ownership or control
Establish management authority	Director appointments, board resolutions and delegated powers	Company records and official filings	Separates formal management from shareholding
Verify acquisition history	Purchase agreements and completion filings	Company filings and transaction records	Identifies transferred assets or shares
Establish intellectual-property control	Registered rights and licence agreements	Intellectual-property registries and authenticated contracts	Identifies control over software and commercial rights
Establish government procurement	Award notices and signed contracts	Official procurement authorities	Identifies purchaser, supplier and contractual scope
Determine actual expenditure	Invoices, outlay records and audit reports	Government finance and audit authorities	Separates contractual value from payment
Verify export authorisation	Licence and customs records	Competent export-control authorities	Establishes authorised scope of a specified transaction
Evaluate sanctions exposure	Current designations and applicable legal instruments	OFAC, BIS and competent national authorities	Establishes relevant regulatory restrictions
Attribute technical infrastructure	Authenticated service records and forensic evidence	Providers, competent investigators and technical records	Associates infrastructure with operational systems
Attribute a particular operation	Customer instructions, forensic records and validated communications	Competent investigative and judicial authorities	Identifies operational responsibility where evidence permits

Corporate network analysis: avoiding false relationships

Corporate network analysis is a useful OSINT method when it preserves the difference between a verified legal relationship and an inferred association. An ownership edge can establish that one company holds shares in another, subject to the relevant date and voting rights. A directorship edge establishes a governance role. A contractual edge may establish commercial cooperation, while a technical infrastructure edge may identify shared services or administrative access.

These connections have different meanings and should not be combined into an undifferentiated network score. A shared director does not establish identical shareholders, a shared hosting provider does not establish corporate control, and participation in the same advertising exchange does not establish cooperation in surveillance.

The most reliable analytical approach is therefore to preserve the direction, type and date of every relationship. This permits investigators to test whether a company acquired a technology before or after a documented operation, whether a director was serving during the relevant period, and whether a financial intermediary was connected to the specific contracting entity rather than merely to a broader industry network.

A geographically extensive graph may appear persuasive while containing few relationships supported by legally significant documents. For senior institutional readers, a smaller network reconstructed from authenticated records is more valuable than a visually impressive map that treats every technical association as proof of common ownership.

Table 8.5 — Evidentiary meaning of corporate and technical network relationships

Relationship	Strongest supported inference	Insufficient inference
Registered shareholding	Historical legal ownership interest	Ultimate operational command
Beneficial ownership	Economic ownership or control under the relevant definition	Personal execution of a cyber operation
Directorship	Formal governance responsibility	Participation in every company activity
Common legal adviser	Shared professional service	Common corporate control
Shared registered address	Common location or service provider	Identity of beneficial ownership
Shared website-management account	Administrative or service relationship	Legal ownership of every associated website
Shared hosting infrastructure	Technical or commercial infrastructure connection	Knowing participation in malicious conduct
Shared software component	Technical provenance or common dependency	Common customer or operator
Reseller contract	Authorised commercial distribution relationship	Ownership of the underlying technology
Government procurement contract	Defined contractual relationship	Successful operational deployment
Financial payment	Transaction between identified counterparties	Illicit purpose without supporting evidence
Sanctions designation	Official legal restriction concerning a named person	Responsibility for unrelated activities

International regulatory convergence and persistent enforcement gaps

The regulatory environment shows increasing recognition that commercial surveillance technologies and sensitive commercial data can create national-security risks, but the international response remains fragmented across different legal instruments and institutional mandates.

The United States has employed export controls, financial sanctions and consumer-protection enforcement against different companies and practices. The European Union has established a dual-use framework addressing defined cyber-surveillance items, while domestic authorities retain important responsibilities concerning licensing and enforcement. National privacy authorities supervise processing within their respective legal mandates, and criminal investigators may become involved where particular conduct satisfies domestic offences.

These mechanisms can reinforce one another, but they are not automatically coordinated. A product may raise export-control concerns without every associated transaction constituting a sanctions violation, while a data broker may breach consumer-protection requirements without supplying spyware or conducting unauthorised computer access.

The distinction creates a practical challenge for government procurement and supplier assurance. A company may not appear on a particular sanctions list yet still present substantial information-security concerns, while a designated company may be subject to restrictions whose exact scope requires detailed legal assessment. Screening against a sanctions list is therefore necessary in some contexts but insufficient as a general certification of surveillance-related risk.

Financial and corporate indicators for future monitoring

The most important indicators of change in the commercial surveillance sector are not limited to new malware discoveries. Corporate reorganisations, transfers of intellectual property, changes in beneficial ownership, the creation of new distribution companies, changes in procurement procedures and regulatory decisions can materially alter the structure of the market even where the underlying technology remains similar.

A strategically meaningful corporate investigation should therefore examine whether an identified supplier continues operating through the same legal entity, whether distribution functions migrate to another jurisdiction, whether key personnel assume roles in successor companies and whether new contracts or procurement documents reveal changes in the customer base.

Financial evidence can also reveal operational developments that technical investigations may not detect. The acquisition of a software company, the transfer of a valuable licence or a new financing arrangement may indicate changes in commercial strategy, although the existence of such a transaction does not prove an intention to evade controls.

Table 8.6 — Observable financial and corporate warning indicators

Indicator	Possible significance	Verification requirement
Transfer of intellectual-property rights	Change in control or commercial licensing	Registered assignment and contract
New subsidiary in another jurisdiction	Expansion or reorganisation	Incorporation and ownership records
Director migration to successor company	Management continuity	Dated official filings
Reseller replacement	Change in distribution structure	Authenticated supplier or procurement records
Sudden change in contract counterparties	Potential restructuring of commercial sales	Original contracts and amendments
Sanctions-related corporate reorganisation	Change in exposure or operating arrangements	Current ownership records and applicable restrictions
New government procurement awards	Possible expansion of institutional customer base	Official award and contract documentation
Transfer of advertising-platform accounts	Change in technical access arrangements	Verified platform and business records
Acquisition of identity-resolution technology	Potential expansion of data-correlation capability	Transaction and product documentation
Disposal of a surveillance-related business	Reduction or transfer of a particular capability	Sale documents and subsequent company records
Changes in beneficial ownership	Alteration of effective control	Authenticated ownership filings
New export-licensing decisions	Change in permissible commercial activity	Competent authority records

These indicators should be interpreted as reasons for documentary examination rather than presumptions of wrongdoing. The existence of an internationally structured business transaction is not itself evidence of sanctions evasion, unlawful surveillance or deliberate concealment.

Chapter 8 — Key judgments

The corporate and financial evidence establishes that significant parts of the commercial surveillance market operate through internationally distributed legal structures, with different entities exercising development, ownership, financing, distribution and customer-facing functions. The Intellexa sanctions record supplies unusually detailed official evidence of such arrangements, including beneficial ownership and substantial financial transactions involving an offshore corporate vehicle.

The corresponding evidence for Discover-Tech is more limited. The October 2026 technical investigation identifies substantial corporate and operational relationships, but the available record does not establish a complete financial account of the company’s surveillance-related activities or the commercial terms governing its connections with other vendors.

The principal OSINT requirement is therefore to construct corporate and financial relationships from authenticated records while preserving the differences between ownership, control, procurement, payment, technical interoperability and operational responsibility.

What would change the assessment: Verified intercompany accounts, customer contracts, beneficial ownership documentation, export licences and government procurement files could establish the allocation of financial benefits and operational responsibilities across presently separate parts of the surveillance supply chain.

Open official record: The most consequential unresolved questions concern the full transaction history of identified offshore entities, the ownership and licensing of commercial surveillance technologies, the financial dependence of specialised vendors on government customers, and the extent to which regulatory restrictions have altered corporate operations rather than merely their formal structures.

Pillar II — Final Net Assessment

The international commercial surveillance environment comprises a heterogeneous group of businesses whose activities can become interconnected through technology, data access, customer procurement and corporate ownership, but whose legal identities and operational responsibilities must remain separately established. The strongest official evidence concerns the multinational Intellexa consortium, the export-control restrictions affecting identified spyware suppliers and the United States regulatory proceedings involving sensitive commercial location-data businesses.

These records demonstrate that surveillance capabilities are commercialised through more than the direct sale of spyware. They may also depend on intellectual-property licences, technology resellers, international financial intermediaries, data aggregators, advertising infrastructure and analytical services. This industrial diversity is crucial because the effectiveness of any regulatory or security response depends on identifying the actual commercial function performed by each participant.

The global comparison also reveals an important asymmetry in transparency. Technical investigations can expose operational infrastructure and sometimes confirm specific infections, while corporate registries and official enforcement decisions can identify legal relationships and regulatory obligations. Neither source category necessarily reveals complete customer instructions, commercial payments or the ultimate government responsible for an operation.

For the Discover-Tech case, the most consequential outstanding question is therefore not whether similar forms of commercial intelligence exist internationally—the official and technical records demonstrate that they do—but which legal persons, contractual intermediaries and institutional customers control the transition from commercially acquired advertising information to selective offensive surveillance. Establishing that transition requires the integration of corporate records, financial evidence, technical attribution and competent legal findings, without treating similarity of capabilities as proof of common ownership or culpability.

---

PILLAR III — NATIONAL SECURITY, INTERNATIONAL LAW, EUROPEAN VULNERABILITY AND STRATEGIC COUNTERMEASURES

Chapter 9. International Legal and Regulatory Architecture: GDPR, ePrivacy, Export Controls, Sanctions, Commercial Spyware and State Responsibility

Principal judgment: advertising-based espionage exposes a structural discontinuity between commercial data regulation, cybersecurity law, export controls and international responsibility

The Discover-Tech investigation raises a particularly complex question of international regulatory governance because the underlying conduct cannot be adequately assessed under a single legal instrument or institutional mandate. The acquisition of advertising-derived information, the correlation of device identifiers, the transfer of personal data between commercial intermediaries, the delivery of executable advertising content, the attempted exploitation of software vulnerabilities and the possible involvement of governmental intelligence customers constitute legally distinguishable activities, even when they form parts of one continuous technical operation. Their treatment depends on the location and identity of the relevant actors, the nature of the information, the purpose of processing, the technical means employed and the jurisdictional authority of the institution seeking to investigate or regulate the conduct.

The European Union has developed an extensive framework governing personal data, electronic communications, digital services, cybersecurity and dual-use exports, but these instruments were not designed as a single integrated system for investigating commercial advertising infrastructure repurposed to support offensive intelligence operations. This creates a regulatory discontinuity between preventing unlawful information processing, requiring adequate cybersecurity measures, controlling the international supply of surveillance technology and attributing malicious conduct to its ultimate sponsor. An advertising intermediary might therefore be subject to data-protection obligations without being a licensed spyware exporter, while a spyware supplier might face export restrictions even where the precise advertising-data collection practices of its intermediary remain subject to a different authority.

The decisive legal principle is that technical association, administrative responsibility, regulatory infringement, criminal liability and international state responsibility are separate determinations. A company may be responsible for particular personal-data processing operations without being legally responsible for an unrelated downstream intrusion; conversely, a vendor’s absence from a sanctions list does not establish that its commercial conduct complies with privacy, cybersecurity or criminal law. For senior governmental readers, the central challenge is consequently to develop an evidentiary and jurisdictional architecture capable of examining the entire surveillance-delivery chain without collapsing the different legal standards governing its participants.

GDPR: the classification of advertising identifiers and the allocation of responsibility

Regulation (EU) 2016/679 establishes the central European framework for processing personal data, including information relating to an identified or identifiable natural person. Within an advertising-intelligence investigation, the principal legal question is not whether a dataset directly contains a person’s name, but whether the information relates to an identifiable individual, taking account of the means reasonably available to identify that person directly or indirectly.

Article 4(1) defines personal data, while Article 4(2) defines processing broadly enough to encompass operations such as collection, recording, organisation, storage, retrieval, consultation, disclosure and combination. These definitions are particularly relevant to advertising systems because an identifier may initially appear to be a technical reference associated with a browser or device, yet become attributable to an individual when combined with additional observations or identifiers.

The lawfulness of the processing must then be examined under Article 6, while Article 5 requires compliance with principles including purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability. These requirements are distinct from obtaining consent for access to information stored on a user’s device under electronic communications rules. Even where a particular access or storage operation complies with the applicable ePrivacy requirements, subsequent personal-data processing requires its own valid legal basis under the GDPR.

Article 9 adds restrictions concerning special categories of personal data, including information revealing political opinions, religious or philosophical beliefs, trade union membership and specified health-related information. Advertising-derived data do not automatically become special-category data merely because they consist of location records or browsing identifiers, but the nature of the information and the inferences actually produced may bring Article 9 into consideration. For example, repeated observations can reveal sensitive characteristics depending on their content, accuracy and use.

The applicable instrument is Regulation (EU) 2016/679 — European Parliament and Council, 27 April 2016. The interpretation of advertising consent information is further informed by Judgment in Case C-604/22, IAB Europe v Gegevensbeschermingsautoriteit — Court of Justice of the European Union, 7 March 2024.

The Court’s judgment in IAB Europe is particularly important because it addressed the legal character of a string recording a user’s preferences concerning personal-data processing within an advertising framework. The Court held that such information can constitute personal data where it can be associated with an identifiable user, while explaining the circumstances in which an organisation establishing a processing framework may qualify as a joint controller. Crucially, the judgment did not establish automatic responsibility for every subsequent processing operation by third parties merely because those parties operate within a common framework.

This distinction is highly consequential for a Discover-Tech-type investigation. The participation of an exchange, industry association, advertising buyer or publisher in a technical ecosystem does not automatically establish that all participants jointly determined the purposes and means of every downstream operation. The competent authority must identify the actual processing activities and determine the responsibilities associated with them.

Table 9.1 — GDPR provisions relevant to advertising-derived surveillance

Provision	Subject	Application to advertising-intelligence investigations	Principal evidentiary question
Article 4(1)	Personal-data definition	Identifiers, device information and location observations may qualify as personal data	Can the information relate to an identifiable natural person?
Article 4(2)	Definition of processing	Collection, matching, storage and disclosure of advertising-derived records	Which operations were performed and by whom?
Article 5	Processing principles	Purpose limitation, minimisation, integrity and accountability	Were the collection and subsequent uses compatible with the stated purposes?
Article 6	Lawfulness of processing	Requires a valid legal basis for processing	Which legal basis applies to each distinct operation?
Article 9	Special-category data	Applies when processing concerns protected categories under the provision	Did the processing involve protected sensitive information?
Article 25	Data protection by design and default	Relevant to advertising architecture and access controls	Were appropriate protections integrated into system design?
Article 26	Joint controllers	Addresses jointly determined purposes and means	Which entities exercised meaningful decision-making authority?
Article 28	Processors	Governs processing on behalf of a controller	Did the processor act within documented instructions?
Article 32	Security of processing	Appropriate technical and organisational measures	Were security protections proportionate to the processing risks?
Article 33	Breach notification to supervisory authority	Reporting of qualifying personal-data breaches	Did a reportable breach occur, and when was awareness established?
Article 34	Communication to affected individuals	Notification where a qualifying breach is likely to result in high risk	Did the incident create the required level of risk to individuals?
Articles 44–49	International transfers	Transfers of personal data outside the EEA under applicable conditions	What transfer mechanism and safeguards applied?
Article 58	Supervisory powers	Investigation and corrective measures	Which authority has competence over the relevant processing?
Article 83	Administrative fines	Applicable sanctioning framework	Which infringement, undertaking and statutory ceiling are relevant?

Source: General Data Protection Regulation — European Parliament and Council, April 2016.

The table should not be interpreted as establishing that Discover-Tech infringed every identified provision. It identifies the legal questions that competent authorities would need to examine, and the applicable conclusion depends on evidence concerning the specific activities, responsible legal persons, affected individuals and territorial jurisdiction.

The ePrivacy framework and the significance of terminal-equipment access

The ePrivacy rules add an important layer because certain tracking technologies involve storing information on a user’s terminal equipment or obtaining access to information already stored there. Article 5(3) of Directive 2002/58/EC, as amended, establishes a general rule requiring consent for such operations, subject to defined exceptions concerning transmission and services explicitly requested by the user.

The relevance to advertising-based surveillance is substantial because ordinary commercial advertising practices often depend on cookies, identifiers, scripts and other technologies that interact with terminal equipment. However, not every network communication or advertising impression automatically involves an operation governed by Article 5(3), and the legal analysis must identify the actual technical access.

The French data-protection authority, CNIL, has explained that personalised advertising trackers generally require prior consent, whereas certain strictly necessary functions and narrowly defined audience-measurement technologies may qualify for exemptions. In its July 2025 guidance, CNIL clarified that exempt audience-measurement trackers must remain limited to particular functions and must not support cross-site tracking or transmission for unrelated third-party purposes. Its January 2026 guidance concerning multi-device consent further reflects the regulatory complexity introduced when tracking choices are associated with several devices linked to the same user.

These official interpretations demonstrate why the compliance problem cannot be resolved merely by displaying a consent banner. The legal effect of consent depends on its validity, the information given to users, the purposes actually pursued and the subsequent processing performed by participating entities.

The relevant sources are Directive 2002/58/EC — European Parliament and Council, July 2002, Cookies and Other Trackers: What Does the Law Say? — CNIL, Audience-Measurement Cookies: Conditions for Exemption — CNIL, July 2025 and Cross-Device Consent Requirements — CNIL, January 2026.

Digital Services Act: advertising transparency and platform responsibility

Regulation (EU) 2022/2065, the Digital Services Act, adds obligations concerning the operation of intermediary services and online platforms, including transparency requirements applicable to advertising. Article 26 is especially relevant because it establishes requirements for online platforms presenting advertisements, including information allowing recipients to recognise an advertisement, identify on whose behalf it is presented and understand the main parameters used for determining why it is displayed.

The DSA also restricts certain forms of advertising based on profiling involving special-category personal data and imposes further protections concerning advertising to minors. However, its advertising-transparency provisions do not constitute a general cyber-intelligence investigation regime, and not every advertising intermediary is subject to identical obligations under the regulation.

The Discover-Tech case raises a question that goes beyond the conventional visibility of advertisements. A user may receive advertising content whose visible commercial characteristics do not disclose the purpose of secondary data collection or selectively delivered code. Consequently, a platform may satisfy certain presentation requirements while still needing to examine separate obligations concerning illegal content, service integrity, consumer protection or data processing.

The applicable legal framework is Regulation (EU) 2022/2065 — Digital Services Act, European Parliament and Council, October 2022, supplemented by the European Commission’s explanation of Digital Services Act advertising protections — September 2025.

NIS2 and the protection of essential and important entities

Directive (EU) 2022/2555, commonly known as NIS2, establishes a framework intended to strengthen cybersecurity across specified sectors and categories of entities. Its importance to the present subject derives from the obligation on covered entities to implement appropriate and proportionate technical, operational and organisational cybersecurity risk-management measures, including measures addressing supply-chain security, incident handling, business continuity and the security of network and information systems.

The legal architecture is not equivalent to a blanket prohibition on advertising. Instead, it requires covered entities to manage relevant cybersecurity risks, taking account of the applicable legal and organisational circumstances.

A hospital, energy operator, digital infrastructure provider or public administration entity subject to the relevant national implementation may therefore need to assess third-party software dependencies and the risks introduced by external services. Where advertising or embedded tracking technology is present in institutional systems, the question becomes whether the corresponding dependencies are appropriately identified, controlled and monitored under the applicable requirements.

Article 23 addresses the reporting of significant incidents, including an early warning generally required within 24 hours after becoming aware of a significant incident and an incident notification generally required within 72 hours. These requirements apply according to the directive and the relevant national implementation; they should not be confused with the GDPR’s separate breach-notification regime.

Directive (EU) 2022/2555 — European Parliament and Council, December 2022.

DORA and the specific vulnerability of the financial sector

Regulation (EU) 2022/2554, the Digital Operational Resilience Act, establishes a specialised regulatory framework for digital operational resilience in the financial sector and applies from 17 January 2025.

DORA is particularly relevant because financial institutions depend on numerous ICT services and third-party technology arrangements while handling information whose confidentiality, integrity and availability are strategically important. The regulatory framework addresses ICT risk management, incident management and reporting, resilience testing, ICT third-party risk and oversight arrangements for critical ICT third-party service providers.

The presence of advertising or externally supplied web content within financial services does not automatically establish a DORA breach. The institutional significance arises when such components form part of an ICT environment whose security must be governed under the applicable requirements, or where a third-party dependency can affect sensitive operations.

The regulatory objective is therefore broader than detecting known malicious advertisements. Financial institutions need to understand which external components and services are essential to their operations, what information may be transmitted through those components and how a compromise or misuse could affect regulated financial services.

Regulation (EU) 2022/2554 — Digital Operational Resilience Act, European Parliament and Council, December 2022.

Table 9.2 — European regulatory instruments: scope and institutional consequences

Instrument	Primary regulatory object	Relevant actors	Relationship to advertising-mediated surveillance
GDPR	Personal-data processing	Controllers and processors	Governs relevant collection, profiling, disclosure, security and transfers
ePrivacy Directive	Electronic communications confidentiality and terminal-equipment access	Relevant service providers and parties using terminal-equipment technologies	Governs specified tracker and device-access operations
Digital Services Act	Intermediary services and platform obligations	Covered intermediary services and online platforms	Establishes applicable advertising transparency and platform duties
NIS2 Directive	Cybersecurity risk management and incident reporting	Covered essential and important entities	Addresses cybersecurity governance and supply-chain exposure
DORA	Digital operational resilience of financial entities	Covered financial entities and relevant ICT providers	Governs ICT risk, incident management and third-party exposure
Dual-Use Regulation 2021/821	Export control of dual-use items and defined cyber-surveillance items	Exporters, brokers and other covered actors	Can restrict specified transfers of surveillance capabilities
National criminal law	Unauthorised access, interception and related conduct	Persons subject to applicable criminal jurisdiction	May govern malicious exploitation and unlawful computer access
National security legislation	Intelligence authorisation and oversight	Competent state authorities	Determines powers and constraints of government intelligence activity
International law of state responsibility	Attribution and internationally wrongful acts	States	Addresses legal consequences where the requisite state conduct is established

The importance of these distinctions is practical rather than merely doctrinal. A successful institutional response requires the relevant authorities to exchange evidence without presuming that an infringement established under one framework automatically establishes liability under another.

Dual-use export controls and the regulation of commercial cyber-surveillance technology

Regulation (EU) 2021/821 is the principal European dual-use instrument relevant to the international supply of certain surveillance technologies. Article 5 addresses non-listed cyber-surveillance items where the conditions relating to internal repression or serious violations of human rights or international humanitarian law are satisfied.

The regulation creates a mechanism whereby a competent authority’s notification can trigger an authorisation requirement for particular non-listed cyber-surveillance exports. It also establishes obligations concerning exporters’ due diligence findings under defined circumstances.

This is highly significant for commercial spyware because products capable of intrusive surveillance may involve intangible transfers, software updates, technical support and rights held by entities in different jurisdictions. Nevertheless, the legal classification of a specific product must be established by examining its capabilities, applicable control entries, transaction structure and relevant legal provisions.

A company cannot be presumed to have violated the regulation solely because its technology is associated with surveillance. Conversely, a transaction should not be presumed unrestricted simply because the relevant product is marketed as cybersecurity software or is absent from a particular public sanctions list.

Regulation (EU) 2021/821 — European Parliament and Council, May 2021, especially Article 5.

International law and the attribution of commercial surveillance operations to states

The legal distinction between private commercial conduct and state responsibility is particularly important where a spyware vendor is incorporated in one country, a distributor operates from another and the surveillance target is located in a third.

The International Law Commission’s 2001 Articles on Responsibility of States for Internationally Wrongful Acts provide a widely recognised framework for analysing attribution of conduct to states. Article 4 concerns conduct of state organs, while Article 8 addresses conduct carried out on the instructions of, or under the direction or control of, a state under the conditions established by international law.

The mere nationality of a company, the location of its registered office or the presence of former government personnel among its employees does not establish that its acts are attributable to its state of incorporation. Similarly, the presence of malware associated with a commercial supplier does not establish the identity of the government customer responsible for an operation.

In addition, attribution of conduct to a state is conceptually separate from determining whether the attributed conduct breached an international obligation. The application of sovereignty, human-rights obligations, diplomatic protections and other international legal rules to a specific cross-border cyber operation requires analysis of the underlying conduct, jurisdiction and applicable obligations.

The relevant primary record is Draft Articles on Responsibility of States for Internationally Wrongful Acts, with Commentaries — International Law Commission, 2001.

Table 9.3 — Attribution thresholds and legal consequences

Question	Evidence required	Legal or institutional consequence
Did a company process personal data?	Processing records, data flows and identification of the responsible entity	Potential data-protection obligations
Was terminal-equipment information accessed?	Technical evidence of the relevant access or storage	Potential ePrivacy obligations
Was a device unlawfully accessed?	Forensic evidence and applicable domestic criminal law	Potential criminal investigation
Was a regulated surveillance item exported?	Product classification, transaction and licensing records	Potential export-control consequences
Did a designated person participate in a transaction?	Current sanctions records, ownership and transaction evidence	Potential sanctions restrictions
Did a government procure a capability?	Authenticated procurement and contractual documents	Evidence of a governmental commercial relationship
Did a state direct the operation?	Evidence satisfying the relevant international attribution rules	Potential attribution of conduct to the state
Did the state breach an international obligation?	Established conduct, attribution and applicable legal obligation	Potential international responsibility

The institutional gap between regulatory supervision and operational intelligence

The principal legal problem illustrated by advertising-based espionage is that the authorities best positioned to investigate a commercial data-processing failure are not necessarily the authorities possessing the operational intelligence needed to identify the ultimate sponsor of a cyber intrusion.

A data-protection authority may obtain information about controllers, processors, consent mechanisms and commercial transfers, but lack the mandate or classified intelligence necessary to identify a foreign intelligence customer. A national cybersecurity authority may detect malicious infrastructure but lack authority to determine beneficial ownership or compel disclosure of financial records outside its jurisdiction. An export-control authority may review licensing decisions without possessing a complete account of downstream code-delivery arrangements.

Consequently, fragmented investigations can establish different parts of an operation without producing a unified determination of responsibility. The policy challenge is to create legally appropriate mechanisms for sharing evidence and coordinating action while respecting institutional competencies, national-security restrictions, commercial confidentiality and individual rights.

Chapter 9 — Key judgments

The existing international and European legal architecture provides significant regulatory instruments relevant to advertising-derived surveillance, but no single instrument governs the complete progression from commercial data collection to device compromise and ultimate state responsibility. GDPR, ePrivacy, DSA, NIS2, DORA, export controls, sanctions and international law address different conduct and apply different evidentiary standards.

The strongest legal conclusion is that responsibility must be established separately for each processing activity, technical operation, commercial transfer and governmental relationship. Treating all entities appearing in an advertising-delivery chain as jointly culpable would exceed the evidence and risk undermining the legal credibility of an investigation.

What would change the assessment: Competent judicial or administrative decisions directly addressing advertising-mediated spyware delivery could clarify the responsibilities of individual participants and establish more precise interpretations of existing legal obligations.

Open official record: The decisive unresolved questions concern the allocation of controller responsibility within particular advertising chains, the treatment of surveillance-oriented code under platform obligations, the classification of specific spyware-related exports and any competent attribution of particular operations to a state.

Chapter 10. Comparative European Security: Italy, France, Germany, the United Kingdom and European Union Institutions

Principal judgment: European vulnerability arises from the interaction of commercial digital dependencies, fragmented investigative authority and the strategic value of information generated outside classified networks

The European security implications of advertising-derived surveillance cannot be reduced to the protection of classified networks because intelligence about a strategically important institution can emerge from information collected through the ordinary digital activities of its personnel, contractors, business partners and visitors. A defence ministry may apply strong controls to its internal communications while employees continue to use personal devices and public applications in environments where commercial advertising data are exchanged among third parties. Similarly, an industrial enterprise may protect its engineering repositories while disclosing, through otherwise legitimate external services, information that helps an observer understand the presence, movement or working patterns of particular individuals.

This creates a security problem at the boundary between institutional responsibility and commercial infrastructure. Governments can impose security requirements on systems they own, but their ability to control commercial information generated outside those systems is considerably more limited. Private suppliers may operate under national data-protection and cybersecurity laws, while counterintelligence authorities possess different powers and information. Consequently, the effectiveness of a national response depends on coordination among regulators, national cybersecurity bodies, security services, defence institutions and procurement authorities.

The European Union provides a common foundation through GDPR, the dual-use framework and cybersecurity legislation, but implementation and enforcement remain distributed across multiple institutions. Italy, France and Germany operate within this broader European legal structure, whereas the United Kingdom applies its own post-Brexit legislative and regulatory arrangements. NATO responsibilities form another distinct layer because collective defence, alliance information systems and military operational security do not map directly onto the European Union’s regulatory jurisdictions.

The European Union Agency for Cybersecurity’s latest available annual assessment, published on 22 September 2026, reinforces the importance of considering geopolitically motivated cyberespionage alongside cybercrime and other threats. Its underlying observation period covers 1 January–31 December 2025, rather than the 2026 Discover-Tech incidents themselves. The agency’s published threat-landscape material identifies public administration as accounting for 32% of the incidents in its relevant dataset and notes that 73% of targeted organisations belong to sectors classified as essential or important under the NIS2 framework. These percentages are not measures of advertising espionage and should not be used to estimate Discover-Tech’s European reach. They establish the broader institutional environment in which specialised surveillance risks must be assessed.

ENISA Threat Landscape 2026 — European Union Agency for Cybersecurity, 22 September 2026 and ENISA Threat Landscape: Current European Cybersecurity Findings.

Italy: national cybersecurity coordination and the exposure of strategic industrial networks

Italy’s principal challenge is the need to integrate the protection of strategically important industrial and governmental activities with the security of the commercial digital services used by organisations and individuals connected to those activities. The relevant exposure extends beyond governmental websites because Italian industrial capabilities are embedded in international supply chains involving defence technology, aerospace, energy, telecommunications, pharmaceuticals, advanced machinery and financial services. In such an environment, information relating to individual devices and their recurring digital activities can have strategic value even when the underlying information was not originally classified.

The institutional starting point is the Agenzia per la Cybersicurezza Nazionale (ACN), established within Italy’s national cybersecurity governance framework. The agency performs functions concerning national cybersecurity policy, resilience and the implementation of specified European cybersecurity obligations. Italy’s implementation of NIS2 through Legislative Decree No. 138 of 4 September 2024 provides an additional legal framework for relevant covered entities, while the personal-data protection responsibilities of the Garante per la protezione dei dati personali remain distinct.

This separation of competence matters because an incident involving advertising-derived surveillance can raise several questions simultaneously. The cybersecurity authority may examine the technical security of affected systems, the data-protection authority may assess unlawful processing of personal information, sector regulators may investigate the operational consequences for regulated entities, and judicial authorities may investigate conduct falling within applicable criminal provisions. None of these institutional functions automatically establishes that an advertising intermediary committed espionage against an Italian organisation.

The industrial dimension is particularly significant. Manufacturers of defence equipment and advanced technologies increasingly operate through multinational engineering, procurement and logistics networks. Employees, technical consultants and suppliers may use ordinary digital services while travelling between industrial facilities, international exhibitions, research institutions and customer locations. The potential aggregation of commercially generated digital observations can create a counterintelligence exposure outside the direct perimeter of an enterprise’s protected technical systems.

The appropriate response is therefore not to treat every advertising service as a hostile technology, but to distinguish high-sensitivity operating environments from ordinary commercial publishing and consumer contexts. Institutions should assess which devices, applications and external software dependencies can expose information about strategically sensitive personnel or activities, and whether those dependencies are compatible with the organisation’s risk appetite and legal obligations.

Relevant statutory foundations are Italian Legislative Decree No. 138 of 4 September 2024 — Gazzetta Ufficiale and Regulation (EU) 2016/679 — European Parliament and Council.

Italian sectoral assessment

Sector	Principal advertising-intelligence exposure	Institutional concern	Appropriate evidence for assessment
Defence and aerospace	Personal-device activity and externally supplied web content	Exposure of personnel and sensitive organisational patterns	Approved endpoint telemetry, software inventories and supplier records
Energy and utilities	Contractor networks and consumer-facing digital services	Potential profiling of critical-infrastructure personnel	Asset inventories and third-party data-flow assessments
Banking	External digital platforms and customer-facing scripts	Privacy, operational resilience and information-security exposure	ICT third-party registers and independent security testing
Telecommunications	Advertising identifiers, mobile ecosystem relationships and data processing	Subscriber privacy and potential targeting intelligence	Authorised data-flow analysis and compliance records
Public administration	External web components and employee digital activity	Information about institutional personnel and activities	Agency-specific risk assessments and forensic evidence
Advanced manufacturing	International supplier and research networks	Exposure of business relationships and sensitive personnel patterns	Contractual supplier assessments and validated technical observations

The table identifies risk pathways, not verified compromises of the sectors concerned. The distinction is particularly important because a counterintelligence assessment must not be converted into an allegation against named industrial companies without incident-level evidence.

France: privacy enforcement and national-security supervision as complementary institutions

France provides a useful comparison because its data-protection authority, the Commission nationale de l’informatique et des libertés (CNIL), has developed detailed regulatory interpretations concerning cookies, advertising trackers and personalised advertising, while the Agence nationale de la sécurité des systèmes d’information (ANSSI) performs distinct national cybersecurity functions.

This institutional configuration creates opportunities for complementary supervision. The CNIL can examine whether personal-data processing and terminal-equipment access comply with the applicable requirements, while ANSSI’s cybersecurity mission concerns threats to information systems and national resilience. Nevertheless, their powers are not interchangeable, and the existence of a data-protection violation does not establish an offensive cyber operation.

The latest CNIL material available within the adopted cut-off demonstrates that advertising-data governance remains an active regulatory issue. In January 2026, CNIL published a decision concerning a company sanctioned €3.5 million for transferring loyalty-programme members’ email addresses and telephone numbers to a social network for advertising targeting without valid consent. The underlying sanction was imposed on 30 December 2025 and publicly reported on 22 January 2026.

The case is not connected to Discover-Tech, but it has direct methodological relevance because it concerns the transfer of personal identifiers into an advertising ecosystem where matching and audience-targeting functions are central. Its significance is the formal recognition that data originally collected in one commercial relationship cannot necessarily be repurposed for advertising targeting merely because the receiving platform offers a technically convenient matching service.

Transmission de données à un réseau social à des fins publicitaires : la CNIL prononce une sanction de 3,5 millions d’euros — CNIL, 22 January 2026.

For French national security, the consequential distinction concerns the relationship between lawful commercial identity matching and the potential intelligence value of the resulting observations. A database linking an email address or telephone number to advertising identifiers may be commercially useful for customer targeting, but it can also increase the accuracy of identity correlation when combined with additional data. The existence of this capability does not establish malicious intent, although it creates a reason for examining how the data are protected, transferred and restricted.

French policy must therefore address both the legal basis for commercial processing and the resilience of the systems through which personal information is distributed. The regulatory objective should be proportionate: prevent unauthorised collection and dangerous secondary use while preserving legitimate advertising, measurement and security functions that comply with applicable law.

Germany: industrial counterintelligence and the governance of complex technology dependencies

Germany’s strategic exposure is shaped by the importance of its manufacturing economy, industrial research institutions, telecommunications systems and international supplier relationships. Industrial security is particularly relevant because sensitive information may arise not only from proprietary engineering files but also from patterns associated with the individuals and organisations participating in advanced manufacturing programmes.

A company developing semiconductor manufacturing equipment, industrial automation technology, specialised software or defence-related components may have strong controls over its intellectual-property repositories, while employees and contractors still interact with external digital services. Advertising-based identification could therefore become a source of contextual information about commercially important personnel or organisational relationships even without compromising the protected repositories themselves.

The relevant German institutional structure includes the Bundesamt für Sicherheit in der Informationstechnik (BSI), data-protection authorities exercising their respective competencies, and institutions responsible for domestic security and counterintelligence. The precise distribution of responsibilities depends on the organisation, sector and applicable law.

The central technical question is whether German institutions can identify the external data flows and software dependencies that exist outside conventional enterprise network inventories. An organisation may maintain detailed registers of cloud providers, enterprise software and network equipment while having comparatively limited visibility into the advertising and analytics services embedded within public websites or applications used by staff.

This creates an assurance problem rather than proof of an existing breach. Without a documented assessment of third-party digital dependencies, senior management cannot determine whether a claimed improvement in enterprise cybersecurity meaningfully reduces advertising-derived intelligence exposure.

The European cybersecurity framework supplies a common legal foundation through Directive (EU) 2022/2555 — NIS2, while the underlying security-governance challenge is consistent with the supply-chain risk-management principles in ENISA Threat Landscape for Supply Chain Attacks — July 2021.

United Kingdom: an established regulatory record and a practical supply-chain security framework

The United Kingdom offers a particularly relevant institutional comparison because its Information Commissioner’s Office had publicly examined the data-protection concerns surrounding real-time bidding years before the Discover-Tech case, while its National Cyber Security Centre has published detailed guidance on the governance of cybersecurity risks arising from suppliers and third parties.

The ICO’s investigation of real-time bidding identified concerns involving transparency, lawful processing, security and the onward sharing of personal information. Its subsequent work on online tracking continued to examine the compliance of commercial websites and the use of advertising technologies. These developments are important because they demonstrate sustained regulatory attention to the underlying commercial arrangements, independently of the more recent evidence of spyware delivery.

The NCSC’s supply-chain security guidance is relevant to the defensive component because it recommends understanding supplier dependencies, communicating security requirements, checking arrangements and maintaining continuous oversight. Its framework does not claim that conventional supplier assurance is sufficient to detect all malicious advertising activity, but it establishes a governance foundation that can be adapted to the digital advertising supply chain.

The United Kingdom consequently possesses an opportunity to link two previously separate supervisory concerns: the lawful distribution of personal information through advertising systems and the security implications of third-party software dependencies. Such coordination must respect the statutory responsibilities of the authorities involved, particularly where the subject concerns intelligence operations rather than ordinary commercial compliance.

Our Work on Online Tracking — Information Commissioner’s Office and Supply Chain Security Guidance — National Cyber Security Centre, reviewed October 2025.

European Union institutions: the problem of shared infrastructure and separate accountability

European Union institutions face a distinctive security challenge because they coordinate policy and information across member states while also maintaining their own technological systems and administrative responsibilities. The potential intelligence value of advertising-derived observations concerning EU personnel, contractors and associated organisations is therefore not limited to access to official information systems.

The strategic significance arises from the possibility that observations collected across several digital environments might disclose patterns concerning institutional personnel, meetings or relationships without the attacker obtaining direct access to internal EU networks. Whether such profiling actually occurred in a particular case must be established through evidence; the existence of commercially available technical capability does not prove surveillance of a named institution.

The European Commission’s DSA responsibilities, EU data-protection authorities’ supervisory functions, ENISA’s cybersecurity expertise and the EU’s broader cyber-policy structures provide different forms of regulatory and technical competence. However, the ability to coordinate those functions depends on clearly defined information-sharing arrangements and the identification of the authority responsible for each decision.

The principal European governance problem is consequently one of institutional integration: the need to combine findings concerning commercial data flows, vendor security, cyber incidents and international procurement without improperly expanding the legal powers of any single authority.

Table 10.1 — European comparative institutional matrix

Jurisdiction	Privacy and advertising-data dimension	Cybersecurity dimension	Strategic-industrial concern	Principal coordination requirement
Italy	GDPR and national data-protection supervision	ACN and competent sector authorities	Defence, energy, manufacturing and financial services	Integration of privacy, cyber incident and industrial security assessments
France	CNIL oversight of advertising data and trackers	ANSSI and competent sector authorities	Aerospace, defence, telecommunications and advanced industries	Coordination between lawful processing and technical threat investigation
Germany	GDPR with federal and regional supervisory responsibilities	BSI and competent security institutions	Advanced manufacturing, industrial automation and critical technology	Assessment of commercial-data and software dependencies across complex supply chains
United Kingdom	UK GDPR, PECR and ICO supervision	NCSC and competent authorities	Defence, finance, telecommunications and strategic infrastructure	Connecting online-tracking oversight with supplier security assurance
European Union institutions	Applicable EU institutional data-protection rules	Institutional cyber teams, CERT-EU and European cybersecurity coordination	EU administration, policy and sensitive institutional information	Cross-institutional incident correlation and vendor governance
NATO	National and alliance legal arrangements	NATO cyber-defence structures and Allied authorities	Military networks and supporting civilian infrastructure	Military-civilian situational awareness and agreed incident procedures

Comparative consequences for European security policy

The evidence supports a common European strategic concern but not a uniform national exposure profile. Italy’s industrial and telecommunications dependencies, France’s developed advertising-data enforcement practice, Germany’s manufacturing supply chains and the United Kingdom’s established online-tracking oversight create different priorities and institutional starting points.

An effective European response should therefore adopt common definitions for advertising-derived intelligence exposure, while allowing national authorities to select controls appropriate to their statutory responsibilities and strategic assets. A single technical indicator may be relevant to several countries, but the underlying legal determination, affected device population and industrial consequences must be established separately.

Chapter 10 — Key judgments

European exposure to advertising-based intelligence collection arises partly outside conventional institutional network boundaries, particularly through commercial digital services and third-party information flows. The existing European legal framework provides substantial tools for data protection, cybersecurity and digital resilience, but effective application depends on coordination among authorities whose mandates differ.

The national comparisons demonstrate that Italy, France, Germany and the United Kingdom share a structural vulnerability while possessing different institutional arrangements and industrial priorities. A credible response must therefore combine European coordination with nationally specific assessments rather than treating Europe as a single homogeneous security environment.

What would change the assessment: Verified national incident records, sector-specific advertising-dependency audits and competent findings concerning actual surveillance of European institutions would permit a more precise assessment of geographic exposure and regulatory effectiveness.

Open official record: The main gaps concern the prevalence of third-party advertising code within sensitive institutional environments, documented interagency response procedures and comparable national measurements of advertising-data exposure.

Chapter 11. Strategic Exposure of Governments, NATO, Defence Industries, Semiconductor Supply Chains, Financial Institutions and Media Organisations

Principal judgment: the greatest strategic value of advertising-derived intelligence may lie in the reconstruction of institutional relationships and operational patterns, even where no successful spyware compromise occurs

The national-security implications of advertising-derived surveillance extend beyond the technical problem of malicious advertising because commercially generated information can reveal patterns whose significance depends on the institutional role of the individuals concerned. A government employee, defence contractor, semiconductor engineer, central-bank official or investigative journalist may use the same consumer technologies as any other individual, but persistent observations associated with that person’s devices can acquire intelligence value when combined with knowledge of organisational affiliations, locations and professional activities.

This creates a distinction between the confidentiality of the information transmitted by a device and the confidentiality of the patterns generated through its use. A secure enterprise communications system may protect message contents while ordinary commercial services disclose certain metadata or behavioural information. The extent of any actual exposure depends on the devices, services and data available, but the mechanism explains why cybersecurity controls protecting an institution’s internal databases do not necessarily eliminate external profiling opportunities.

The strategic significance is particularly pronounced where individual relationships are themselves sensitive. Information concerning the repeated presence of particular devices near facilities, patterns of travel among institutions or interactions with specific digital services may support analytical inferences even without revealing classified documents. Those inferences can be wrong, and the risk of mistaken attribution increases where devices, identifiers or networks are shared. Nevertheless, an adversary able to collect repeated observations may derive more information than any single commercial transaction would suggest.

NATO and the distinction between military network compromise and intelligence exposure

NATO’s cybersecurity architecture has increasingly emphasised the protection of alliance networks and the relationship between military operations and civilian infrastructure. At the July 2024 Washington Summit, Allied governments agreed to establish the NATO Integrated Cyber Defence Centre, intended to strengthen situational awareness and protection of NATO and Allied networks, including awareness of privately owned civilian critical infrastructure supporting military activities.

The significance of this policy development for advertising-derived intelligence is conceptual rather than evidentiary proof of a specific incident. It acknowledges that modern military security depends on infrastructure and services outside exclusively military ownership or control. Advertising systems represent a different class of commercial dependency, but the underlying governance challenge is comparable: the security of an institution can be affected by privately operated systems whose functions and data flows are not entirely visible to military authorities.

The existence of advertising traffic associated with a NATO network does not establish a successful intrusion into NATO systems, nor does it imply that a particular operation was directed against the Alliance. It creates a reason to examine the affected environment and determine whether identifiable personnel, managed devices or supporting systems were exposed.

NATO has also emphasised that a significant malicious cyber event may, depending on the circumstances, raise questions concerning collective defence. However, not every incident involving commercial spyware, advertising surveillance or a NATO-associated network qualifies as an armed attack. Any Article 5 determination remains political and case-specific, subject to the decisions of the North Atlantic Council.

NATO Cyber Defence — North Atlantic Treaty Organization, updated July 2024 and Allies Agree New NATO Integrated Cyber Defence Centre — NATO, 10 July 2024.

Defence industries and the indirect exposure of technological programmes

Defence manufacturers possess information whose strategic importance extends beyond classified technical specifications. Product-development schedules, engineering teams, international partnerships, procurement relationships and the participation of particular individuals in research programmes can all be valuable within a broader intelligence assessment.

Commercial advertising data may provide only fragmentary observations about these activities, but intelligence analysis often derives value from combining incomplete information across multiple sources. A repeated observation associated with a device cannot independently establish a person’s identity or professional activity; however, a sufficiently reliable sequence may contribute to a broader assessment when combined with other lawfully or unlawfully obtained information.

The resulting defensive challenge is not equivalent to conventional industrial espionage involving direct access to intellectual-property repositories. It concerns the possibility that external commercial systems disclose information about the surrounding organisational environment, including individuals who possess privileged access elsewhere.

For this reason, a defence enterprise’s security programme should distinguish the protection of sensitive engineering systems from the counterintelligence protection of its wider personnel and supplier ecosystem. Strong authentication and encrypted communications remain essential, but they do not directly govern every advertising identifier or third-party data transfer generated through consumer services.

Semiconductor supply chains and the strategic value of personnel intelligence

Semiconductor manufacturing is particularly sensitive to the relationship between technological knowledge and specialised personnel. The industry’s international structure involves design companies, manufacturing facilities, equipment suppliers, material producers, research institutions and customers whose activities are distributed across numerous jurisdictions.

In such a market, intelligence concerning personnel, commercial relationships or activity patterns may have strategic relevance even where the underlying observations reveal no semiconductor design files. An actor interested in a particular technology programme may therefore value information about the relationships among organisations and specialists, although the accuracy of any conclusions depends on the reliability of the observations.

The October 2026 reporting concerning Discover-Tech identified advertising activity associated with networks belonging to companies including Nvidia, Sandisk, Broadcom and Micron. This provides a reason for technical exposure assessments, but it is not evidence that those companies suffered confirmed Candiru infections or that sensitive semiconductor intellectual property was extracted.

The broader national-security implication is that industrial supply chains should incorporate commercial data exposure into risk assessment without conflating it with proven cyber intrusion. Corporate network association must remain distinct from device compromise, and company-level attribution must remain distinct from the identity of individual employees.

Financial institutions and operational resilience

Financial organisations operate under a particularly demanding combination of confidentiality, availability, integrity and regulatory obligations. Their exposure to advertising-derived intelligence can involve customer-facing websites, marketing technology, mobile applications, externally supplied scripts and the personal digital activity of staff.

A financial institution may also be affected by the behaviour of commercial technology providers that perform marketing, identity verification, customer analytics or application measurement. These suppliers do not necessarily handle the institution’s core transaction systems, but their access to personal information or client-facing environments may create risks that must be considered within a wider ICT risk-management framework.

DORA provides a regulatory foundation for financial entities covered by the regulation, particularly through its requirements concerning ICT risk management, third-party risk and incident management. However, the applicability of any individual requirement depends on the entity and service concerned; ordinary advertising services cannot automatically be classified as critical ICT services merely because they involve third-party technology.

A defensible financial-sector assessment therefore needs to establish which externally supplied services actually process personal information, execute code in relevant digital environments or form a material dependency of regulated operations.

Regulation (EU) 2022/2554 — Digital Operational Resilience Act and ENISA Threat Landscape: Finance Sector — European Union Agency for Cybersecurity, February 2025.

Media organisations and the protection of investigative reporting

Media organisations occupy a particularly sensitive position because their security obligations concern not only internal information but also the confidentiality of sources, unpublished investigations and communications with individuals who may face significant risks if identified.

The Al Jazeera investigation provides a concrete example of an advertising-mediated compromise affecting a media organisation, establishing a stronger evidentiary foundation than theoretical discussions of possible targeting. The importance of the case lies in the documented relationship between an ordinary commercial delivery channel and sophisticated spyware activity, not simply in the identity of the affected broadcaster.

For investigative journalism, potential surveillance of professional devices may expose communications, contact networks and unpublished information depending on the capabilities and privileges achieved by an implant. However, the actual information obtained in a particular incident cannot be presumed from the presence of malware alone; forensic findings and victim-specific records are necessary to determine the scope of compromise.

The protective implications extend to freelance journalists, contractors and collaborators who may not operate within a centrally managed corporate security environment. A media organisation’s technical perimeter may therefore be considerably broader than the devices it owns directly.

Sectoral exposure matrix

Table 11.1 — Strategic exposure, intelligence value and required evidence

Sector	Potential intelligence value of advertising-derived observations	Potential consequence of successful spyware infection	Most consequential evidence
National government	Institutional personnel and activity patterns	Unauthorised access to information available on compromised devices	Managed-device telemetry, incident records and validated attribution
NATO and military organisations	Operationally relevant personnel and support relationships	Potential exposure of military-related communications or information	Alliance or national forensic investigations
Defence industry	Personnel, supplier and programme relationships	Potential access to sensitive commercial or technical information	Verified affected devices and incident scope
Semiconductor industry	Research, manufacturing and supplier relationships	Possible exposure of intellectual property accessible to the device	Endpoint evidence and validated corporate incident records
Banking and financial services	Customer relationships, employee patterns and external technology dependencies	Confidentiality, integrity or operational consequences depending on access achieved	DORA-relevant risk assessments and forensic findings
Media organisations	Journalist activity and source-related relationships	Potential compromise of source confidentiality and unpublished reporting	Device forensics and source-protection assessments
International organisations	Diplomatic and institutional personnel patterns	Potential access to protected institutional information	Competent internal investigations
Research institutions	Scientific collaboration and specialised personnel relationships	Exposure of research information available to affected devices	Authorised technical and institutional evidence

The matrix describes plausible intelligence mechanisms and consequences rather than an observed distribution of actual compromises. It is not a ranking of sectors and should not be converted into a quantitative risk score without validated exposure, likelihood and impact data.

Chapter 11 — Key judgments

The strategic importance of advertising-derived intelligence lies partly in information about individuals and institutional relationships generated outside protected enterprise systems. This creates a potential counterintelligence exposure that cannot be fully addressed through conventional perimeter security.

The confirmed compromise evidence concerning Al Jazeera demonstrates that commercial advertising can support a more intrusive surveillance pathway, while the broader advertising exposure associated with sensitive institutions requires separate investigation before any conclusion concerning successful compromise is justified.

What would change the assessment: Authenticated forensic investigations involving governmental, military or industrial devices could establish more precisely which sectors have experienced successful advertising-mediated spyware operations and what information was actually obtained.

Open official record: Important gaps concern the prevalence of advertising-derived intelligence exposure among strategically sensitive personnel, the effectiveness of existing institutional controls and validated information concerning actual compromise consequences.

Chapter 12. Counterintelligence and Defensive Architecture: Detection, Attribution, Vendor Assurance, Advertising-Supply-Chain Controls and Incident Response

Principal judgment: effective defence requires separating advertising-data exposure, suspicious code delivery and confirmed device compromise into distinct detection and response processes

The defensive implications of the Discover-Tech investigation extend beyond blocking particular malicious domains because the underlying commercial advertising architecture can create intelligence exposure before an exploit is attempted. A comprehensive response must therefore address the information distributed through advertising transactions, the execution of third-party content, the security of associated commercial suppliers and the forensic investigation of suspected device compromise.

The operational distinction is fundamental. Measures that prevent a particular malicious script from executing may reduce the likelihood of device compromise while leaving other forms of advertising-derived data collection possible. Conversely, restrictions on tracking identifiers may reduce the ability to correlate user activity without eliminating all risks arising from executable advertising content. No single defensive measure should consequently be represented as a complete solution to the problem.

The appropriate institutional architecture has four mutually reinforcing functions: understanding and reducing data exposure, governing executable third-party content, detecting suspicious activity and preserving the ability to investigate and respond to verified incidents. The implementation requirements differ among public websites, managed mobile devices, industrial systems and highly sensitive institutional environments.

Data-flow visibility as a prerequisite for effective control

The first requirement is to understand which information is transmitted to external services during routine digital activity within systems under the organisation’s control. This includes identifying advertising and analytics dependencies, relevant third-party domains, associated software components and the categories of information processed or transmitted.

An inventory of third-party services is necessary but insufficient. A contract may identify a primary advertising provider while the actual technical service uses additional exchanges, measurement providers or code-delivery endpoints. Effective visibility therefore requires linking the commercial supplier register with observed data flows, software inventories and contractual arrangements.

For public-sector and strategically sensitive organisations, the objective should not be to collect unlimited information about employee browsing. Defensive monitoring must remain proportionate, legally authorised and focused on the protection of relevant systems and information. Excessive collection can create additional privacy and security risks by generating new sensitive datasets within the defending organisation.

Third-party script governance and browser security controls

Advertising and analytics components can introduce executable code supplied by entities that do not operate the primary website. This creates an important trust boundary because the site’s operator may control the initial integration but possess limited visibility into the code subsequently returned by external services.

A defensible security programme should therefore examine whether third-party scripts are necessary, which services control them, whether their privileges can be restricted and how changes are monitored. Relevant technical safeguards may include appropriate browser security policies, isolation of third-party content, restrictions on unnecessary external resources and the reduction of dynamic script dependencies within sensitive digital services.

These controls require careful implementation. Restrictive policies can interfere with legitimate website functionality, while simplistic domain allowlists may be insufficient where an approved provider can dynamically serve different content. A vendor’s appearance on an approved list should therefore be treated as an element of assurance rather than proof that every future response is secure.

The UK NCSC’s supply-chain security principles provide a suitable governance foundation by emphasising understanding the supplier environment, establishing control, checking arrangements and maintaining continuous improvement. ENISA’s technical guidance concerning NIS2 implementation adds a European reference for risk-management practices within applicable sectors.

Supply Chain Security: The Principles of Supply Chain Security — National Cyber Security Centre and NIS2 Technical Implementation Guidance — European Union Agency for Cybersecurity, June 2025.

Vendor assurance: moving beyond contractual declarations

A supplier may provide accurate information about its legal identity and intended commercial function while the technical implementation nevertheless creates substantial security exposure. Contractual due diligence must therefore be connected to verification of actual system behaviour.

An organisation purchasing advertising, analytics or application services should be able to determine which entities receive information, whether those entities may transfer information onward, what code can execute and what controls apply to changes in service delivery. The precise requirements should reflect the nature of the service, the sensitivity of the information and the practical capacity to audit relevant functions.

Assurance should also address the distinction between a supplier’s own systems and those of its subcontractors. A primary contracting entity may rely on downstream infrastructure providers whose security controls and contractual arrangements differ from those described in the original service agreement.

The NCSC’s guidance explicitly recommends building appropriate assurance activities and audit provisions into supplier management arrangements, while recognising that some forms of audit may not be practical or desirable for every type of service. This provides a useful basis for proportionate requirements rather than an indiscriminate demand for unrestricted access to supplier systems.

Supply Chain Security: Check Your Arrangements — National Cyber Security Centre, reviewed October 2025.

Table 12.1 — Vendor assurance requirements for advertising and analytics services

Assurance domain	Required information	Appropriate verification	Principal limitation
Legal identity	Contracting entity and relevant subsidiaries	Corporate records	Does not establish technical behaviour
Beneficial ownership	Relevant persons exercising ownership or control	Competent filings where available	Disclosure varies by jurisdiction
Data recipients	Entities receiving relevant information	Contractual schedules and data-flow testing	Recipients may change
Subprocessors	Entities processing on behalf of the supplier	Supplier register and contractual arrangements	Registers may not capture independent controllers
Script execution	External code and execution conditions	Controlled security testing	Behaviour may be selective
Identifier handling	Collection, matching and retention practices	Technical and contractual evidence	Identity accuracy may vary
International transfers	Transfer mechanisms and destinations	Data-transfer assessments	Legal and operational conditions may change
Incident reporting	Notification responsibilities and procedures	Contractual testing and response exercises	Timeliness depends on detection
Change management	Approval of new integrations and dependencies	Configuration review	Rapid commercial changes can outpace periodic audit
Termination	Revocation of access and handling of retained data	Verified offboarding procedures	Historical copies may remain with lawful or unlawful recipients

Detection: differentiating known indicators from behavioural evidence

Security monitoring should distinguish indicators identifying known infrastructure from observations demonstrating suspicious behaviour. A domain or IP address associated with a published investigation may support targeted retrospective analysis, but such indicators can become obsolete through infrastructure changes and do not necessarily identify every related service.

Behavioural evidence can remain useful where specific domains change. Examples include unusual third-party script execution, unexpected transmission of identifiers, selective differences in code delivery and communications inconsistent with the stated purpose of an advertising or analytics component.

However, none of these observations is automatically proof of malicious activity. Commercial advertising and fraud prevention systems can legitimately perform device profiling and dynamically adjust content. The analytical task is therefore to establish whether the observed behaviour is consistent with an authorised commercial function or instead exhibits additional characteristics supporting a surveillance or exploitation hypothesis.

The appropriate response is evidence-led rather than mechanically rule-based. Automated detections can identify anomalies, but high-consequence conclusions concerning spyware compromise should depend on corroborating forensic and contextual information.

Incident response and preservation of forensic evidence

Suspected advertising-mediated spyware activity requires an incident-response process capable of preserving both ordinary advertising traces and evidence of subsequent malicious behaviour.

A conventional enterprise investigation may begin with network and endpoint logs, while a mobile-device investigation may require specialised forensic expertise and attention to the limitations of the device platform. Where a victim organisation possesses network records linking an advertising request to subsequent suspicious communications, those records can materially strengthen the reconstruction of the event.

The response should preserve timestamps, original log sources, relevant system configurations and the chain of custody for collected evidence. A failure to retain the contextual information surrounding a suspicious request may make it difficult to distinguish ordinary advertising behaviour from a targeted delivery event.

Institutions must also manage the tension between rapid containment and evidentiary preservation. Disconnecting an affected device may reduce exposure, but certain investigative procedures require consideration of volatile information and the state of the device. The correct approach depends on the device, suspected threat and applicable organisational or legal requirements, and should be directed by competent incident responders rather than a universal instruction to perform the same action in every case.

Table 12.2 — Incident classification and response authority

Classification	Evidence threshold	Immediate institutional objective	Appropriate responsible function
Commercial exposure	Advertising or data transfer observed	Assess lawfulness and security relevance	Privacy and digital service governance
Suspicious data collection	Unexplained collection or transfer behaviour	Establish scope and purpose	Security operations and data-protection specialists
Suspicious code delivery	Evidence of unusual or selective executable content	Contain relevant exposure and preserve evidence	Cybersecurity incident response
Possible exploitation	Correlated technical indicators consistent with attempted compromise	Determine whether security boundaries were crossed	Specialised forensic team
Confirmed compromise	Reliable forensic evidence of malicious access	Contain, investigate and assess consequences	Incident command and competent authorities
Suspected state-linked activity	Evidence supporting foreign-government involvement	Coordinate security and attribution assessment	Competent counterintelligence and national authorities
Regulatory breach	Evidence satisfying applicable reporting conditions	Meet statutory obligations	Legal, compliance and relevant supervisory functions

Security controls and residual exposure

Defensive measures should be evaluated according to the specific capability they constrain. Restrictions on advertising code may reduce one delivery pathway without removing information already distributed through bid requests. Limiting identifiers may reduce some correlation opportunities while leaving information associated with network addresses or application context available. Vendor sanctions or account removals may disrupt a known intermediary while other commercial platforms continue operating.

An effective security programme must therefore preserve a clear relationship between the threat mechanism, the selected control and the evidence used to assess its effectiveness.

Table 12.3 — Control-to-threat correspondence

Control	Principal risk addressed	Residual exposure
Reduce unnecessary advertising integrations	Third-party dependencies and code exposure	Necessary external services may remain
Restrict third-party script privileges	Untrusted code execution	Data may still be disclosed through authorised requests
Apply browser and application security updates	Exploitation of known vulnerabilities	Unknown vulnerabilities and non-exploit data collection remain
Limit unnecessary identifiers	Persistent cross-context identity correlation	Alternative identifying signals may persist
Review mobile application dependencies	Third-party SDK and data-flow risk	Personal-device usage may remain outside organisational control
Enforce vendor data-use restrictions	Unauthorised secondary processing	Contractual restrictions require verification
Monitor anomalous data transfers	Suspicious collection behaviour	Monitoring may not observe all external services
Correlate endpoint and network evidence	Detection of possible compromise	Incomplete telemetry can limit certainty
Maintain incident-response procedures	Investigation and containment	Effectiveness depends on preparation and expertise
Conduct supplier assurance	Third-party operational and contractual risk	Periodic assessments may miss subsequent changes

Counterintelligence governance for high-sensitivity organisations

The protection of highly sensitive personnel requires measures extending beyond the corporate website or managed network. Personnel may use consumer devices and digital services outside organisational control, creating information flows that cannot necessarily be eliminated by enterprise technical settings.

A proportionate programme should therefore combine technical protection of managed devices with clear guidance regarding commercial-data exposure, appropriate mobile-device configurations and the security implications of unnecessary application permissions or advertising identifiers. Such guidance must remain compatible with applicable privacy and employment law, avoiding the creation of intrusive organisational surveillance systems under the pretext of counterintelligence protection.

The central policy question is not whether employees should be forbidden from participating in ordinary digital life, but how institutions can reduce the exposure of genuinely sensitive activities while respecting individual rights and practical operational needs.

Chapter 12 — Key judgments

Advertising-mediated surveillance requires an integrated defensive architecture because data exposure, suspicious code delivery and successful exploitation constitute different technical outcomes. Controls must be selected according to the mechanism they address and evaluated through observable evidence rather than assumed effectiveness.

Supplier assurance, third-party script governance, data-flow visibility and forensic readiness are complementary functions. None alone constitutes a complete defence, and the presence of approved commercial vendors does not remove the need for continuing technical verification.

What would change the assessment: Independent evaluations demonstrating the effectiveness of specific advertising-platform controls against selective malicious code delivery would permit more precise comparisons among available defensive architectures.

Open official record: Significant gaps remain concerning standardised detection performance, platform audit results, validated incident-response outcomes and the extent to which commercial advertising intermediaries retain sufficient evidence for competent investigations.

Chapter 13. Strategic Scenarios 2026–2031: Technological Convergence, Surveillance-Market Evolution, Regulatory Responses and Indicators

Principal judgment: the future of advertising-derived intelligence will depend on whether platform-level restrictions reduce the underlying availability of identifiable information or merely displace surveillance activity into alternative commercial channels

The international development of advertising-derived surveillance over the five-year period to October 2031 is likely to be shaped by the interaction of three competing forces: the commercial incentives sustaining large-scale behavioural advertising, the continuing demand for intelligence concerning devices and individuals, and increasingly restrictive legal or technical controls governing personal data and third-party content. These forces do not necessarily operate in the same direction. Improvements in browser isolation and restrictions on traditional advertising identifiers may reduce the effectiveness of some collection or delivery methods, while the growth of alternative identity systems, commercial data intermediaries and complex software supply chains could preserve other opportunities for surveillance.

The Discover-Tech investigation establishes that the combination of advertising access and specialised spyware capability is technically feasible, but it does not establish the frequency with which comparable operations occur globally. Consequently, the available evidence does not support assigning precise numerical probabilities to alternative developments through 2031. A quantitative forecast would require a defined comparison population, historical base rates and evidence concerning the adoption and effectiveness of relevant technologies, none of which is sufficiently established for this specific class of operations.

The appropriate forecasting method is therefore conditional scenario analysis supported by observable indicators. The scenarios below are not presented as mutually exclusive, because different regions, advertising platforms and surveillance suppliers may develop in different directions simultaneously.

Scenario A: regulatory and technical containment of advertising-mediated surveillance

Under the first pathway, advertising exchanges and major platform operators respond to the October 2026 disclosures by strengthening the assessment of third-party executable content, imposing tighter controls on data recipients and developing procedures capable of detecting selectively delivered malicious code. Regulatory authorities place greater emphasis on data minimisation, supplier provenance and restrictions on secondary use, while institutional customers require clearer contractual disclosures of advertising-data dependencies.

Such developments could reduce the attractiveness of advertising infrastructure as a delivery channel for particular kinds of spyware, especially where major platforms control significant portions of accessible inventory and can enforce consistent technical standards.

However, containment would not necessarily eliminate advertising-derived intelligence. Some information might remain accessible through legitimate transactions, separately licensed commercial datasets or services that do not involve malicious code. The strategic effect would therefore depend on whether controls address both executable content and the underlying distribution of potentially identifiable information.

The most useful indicators would be documented changes in advertising-exchange technical requirements, independent evaluations of selective-code detection, verified reductions in relevant data disclosures and enforcement records demonstrating durable exclusion of actors found to have engaged in malicious conduct.

Scenario B: displacement into alternative advertising and data markets

The second pathway involves the migration of surveillance-relevant activity away from platforms introducing stronger controls and towards alternative intermediaries, inventory sources or commercial information services.

This possibility follows from the economic structure of programmatic advertising. An actor denied access to one exchange may attempt to use another authorised commercial relationship, acquire information through a different data provider or alter its technical architecture. Such migration would depend on the availability of suitable intermediaries and the effectiveness of their controls; it should not be assumed to be effortless or universally successful.

The intelligence consequence would be a possible reduction in visibility for defenders if activity moves into less transparent commercial environments. Conversely, greater fragmentation might increase operational costs and reduce the reliability of identity matching or advertising delivery.

The decisive indicators would include authenticated new vendor relationships involving previously identified entities, technical investigations revealing comparable mechanisms on other platforms and changes in the geographical distribution of suspicious advertising behaviour.

Scenario C: convergence of commercial identity intelligence and specialised cyber exploitation

The third pathway involves deeper integration between commercially obtained identity information and offensive cyber capabilities. Under this scenario, surveillance actors increasingly treat advertising-derived data, location intelligence and device characteristics as supporting elements of targeted technical operations rather than as standalone intelligence products.

The underlying mechanism is economically plausible because identity intelligence can help narrow the population of devices requiring specialised exploitation, while offensive capabilities may provide access to information unavailable through commercial data collection alone.

Nevertheless, the available record does not establish that every major spyware supplier is pursuing such integration or that the convergence will proceed at a uniform rate. The strength of the scenario depends on demonstrated adoption, customer demand and the continued availability of technically useful advertising information.

Evidence supporting the pathway would include authenticated contracts combining commercial identity intelligence with offensive capabilities, additional forensic investigations linking advertising-delivery systems to spyware and official procurement records identifying integrated services.

Scenario D: fragmentation of the surveillance market under international regulatory pressure

A fourth pathway concerns changes in corporate structures rather than purely technical capabilities. Export controls, financial sanctions, litigation and restrictions imposed by major platforms may encourage affected companies to reorganise, dispose of assets, transfer technology rights or shift commercial activities among jurisdictions.

Such restructuring can occur for legitimate business reasons, and the creation of a new subsidiary or distributor does not independently establish sanctions evasion. The analytical question is whether the actual ownership, personnel, intellectual property and commercial functions change, or whether the same activities continue through formally different legal entities.

The scenario’s significance is that the effectiveness of regulation depends on identifying the actual persons and assets subject to legal restrictions. Corporate changes may genuinely reduce the capacity of a restricted supplier, but they may also complicate external visibility into continuing commercial relationships.

The relevant indicators include official ownership records, intellectual-property assignments, procurement counterparties, sanctions updates, export decisions and authenticated financial disclosures.

Table 13.1 — Five-year strategic scenario comparison

Scenario	Causal mechanism	Supporting evidence available in 2026	Countervailing force	Decisive indicator
Regulatory containment	Stronger technical controls and data-processing restrictions	Existing EU legal frameworks, FTC enforcement and platform responses	Uneven implementation and alternative data sources	Validated decline in malicious code delivery and unauthorised data disclosure
Market displacement	Restricted actors seek alternative commercial access	Multiple advertising intermediaries and international data markets	Increased cost and reduced inventory access	Verified emergence of comparable activity through alternative suppliers
Technical convergence	Identity intelligence complements specialised exploitation	Discover-Tech/Candiru technical relationship	Technical complexity and exploit scarcity	Additional verified integrated deployments
Corporate fragmentation	Legal and commercial pressure changes supplier structures	Historical multinational spyware structures and sanctions actions	Ownership transparency and regulatory cooperation	Documented changes in control, assets and commercial contracting

These scenarios are intended to identify decision-relevant pathways, not to provide an unsupported ranking or numerical estimate of future outcomes.

The role of automation and artificial intelligence in future surveillance markets

Artificial intelligence may affect the efficiency with which large volumes of commercially generated information are analysed, including the detection of recurring patterns, the correlation of incomplete identifiers and the prioritisation of observations for further investigation. However, such improvements depend on the quality, legality and accessibility of the underlying data, and should not be treated as automatic increases in surveillance accuracy.

The principal risk is that advanced analytical methods may make fragmented commercial observations more useful by identifying relationships that would be difficult to detect manually. At the same time, automated inference can generate false associations, especially where identifiers are unstable or devices are shared.

ENISA’s September 2026 threat-landscape material identifies growing concerns involving the malicious use of artificial intelligence in the wider cyber threat environment. That assessment provides context for technological convergence, but does not establish the deployment of particular AI systems by Discover-Tech or the commercial spyware vendors examined in this dossier.

ENISA Threat Landscape 2026 — European Union Agency for Cybersecurity, September 2026.

Indicators of structural change

The most important future indicators concern the commercial and technical conditions that determine whether advertising infrastructure remains useful for surveillance. Monitoring only known malicious domains would provide an incomplete picture because it would not capture changes in identity-resolution markets, supplier relationships or the distribution of personal information.

Table 13.2 — Strategic watch indicators, 2026–2031

Indicator	Observation required	Significance if observed	Significance if absent
New official cases involving RTB secondary data use	Competent regulatory decisions	Stronger evidence of recurring data-governance problems	Does not establish the absence of undiscovered misconduct
Additional advertising-mediated spyware cases	Forensic technical investigations	Evidence of wider operational adoption	Limited case discovery may reflect monitoring gaps
Platform code-isolation reforms	Published technical requirements and independent testing	Potential reduction in malicious code-delivery opportunities	Continued reliance on existing execution models
Restrictions on cross-platform identity matching	Enforceable platform and regulatory changes	Potential reduction in persistent correlation	Continued availability of certain identity-linking methods
New commercial surveillance procurement	Authenticated public contracting records	Evidence of institutional demand	Classified or undisclosed procurement may remain invisible
Corporate restructuring among restricted vendors	Registry and transaction records	Potential change in ownership or delivery arrangements	Does not prove operational inactivity
Verified improvements in forensic detection	Independent validation studies	Greater ability to identify actual compromises	Continued uncertainty in incident counts
Cross-border supervisory cooperation	Formal agreements and documented joint actions	Potentially stronger enforcement coordination	Persistent jurisdictional fragmentation

Forecasting limitations and decision relevance

The five-year outlook should not be interpreted as a prediction that all surveillance vendors will adopt advertising-mediated exploitation or that the technique will necessarily become dominant. Technical vulnerabilities can be patched, commercial platforms can restrict access, economic incentives can change and individual suppliers may leave or reorganise their markets.

The defensible forecast is narrower: unless the information and execution capabilities available through commercial advertising systems are materially reduced or more effectively controlled, the structural opportunity demonstrated by Discover-Tech will remain relevant to organisations seeking device-level intelligence or selective access.

That assessment follows from the documented architecture and established market incentives, but its future operational consequences will depend on technical, legal and commercial developments that must be observed rather than assumed.

Chapter 13 — Key judgments

The development of advertising-derived surveillance through 2031 is contingent on changes in platform security, data availability, regulatory enforcement and supplier organisation. The most important competition is between the continuing commercial value of identity-related data and efforts to restrict collection, correlation and third-party execution.

The available evidence supports qualitative scenarios and specific watch indicators but does not support invented probabilities or market-size forecasts for advertising-mediated spyware.

What would change the assessment: Verified evidence of widespread adoption, independently measured improvements in advertising-security controls or sustained reductions in access to relevant data would materially alter the outlook.

Open official record: The principal gaps concern comparable adoption measures, validated control effectiveness and authenticated international procurement data.

Chapter 14. Institutional Courses of Action, Intelligence Collection Priorities and Final Net Assessment

Principal judgment: the most effective institutional strategy combines targeted commercial controls, technical verification, legally coordinated investigation and the reduction of intelligence-relevant data exposure

The Discover-Tech investigation demonstrates a weakness in the relationship between commercial digital infrastructure and institutional security that cannot be resolved through a single regulatory decision, vendor exclusion or technical configuration change. A credible response must address the different stages at which advertising infrastructure acquires intelligence value, while preserving distinctions between legitimate commercial operations, unlawful processing, malicious code delivery and state-directed espionage.

The principal policy objective should be to reduce the ability of unauthorised actors to obtain intelligence-relevant information or exploit commercial delivery channels, without treating all advertising technologies or their operators as inherently malicious. Such an approach requires differentiated measures directed towards publishers, advertising exchanges, data brokers, software suppliers, institutional customers and competent national authorities.

The central governance requirement is proportionality based on evidence. Measures should be selected according to the demonstrated security problem, implemented by an authority possessing the relevant competence and evaluated through observable results. Extensive regulation without technical verification may create administrative complexity while leaving the underlying vulnerability intact, whereas aggressive technical restrictions without legal and operational analysis may disrupt legitimate services without materially reducing intelligence exposure.

Course of action A: national advertising-intelligence exposure assessments

Governments should establish a defined process for assessing advertising-derived data exposure within the institutional environments for which they are responsible. The assessment should identify the types of third-party services used, the information potentially disclosed through those services and the categories of personnel or activities whose exposure would be strategically consequential.

The process should distinguish managed devices, public institutional websites, mobile applications and personal-device usage because the authority to impose technical controls and collect monitoring information differs among these contexts.

A national cybersecurity authority may coordinate technical guidance, while each organisation remains responsible for applying the controls appropriate to its systems and statutory obligations. Counterintelligence services should receive information according to legally established mechanisms where evidence suggests national-security relevance.

The expected benefit is improved visibility into risks that conventional enterprise asset registers may not capture. The principal implementation burden concerns technical expertise, supplier cooperation and the need to avoid disproportionate collection of employee information.

Course of action B: advertising-supply-chain security obligations

Advertising platforms and participating commercial organisations should strengthen the controls governing third-party content and the transfer of identifying information. The purpose is to reduce the possibility that ordinary advertising transactions can be used for unrelated surveillance purposes or that approved commercial integrations can deliver selectively malicious code.

Regulatory action should be grounded in existing legal authority. Data-protection regulators can examine relevant personal-data processing, while cybersecurity and digital-services authorities act within their respective mandates. Contractual requirements may also be imposed by public institutions or private enterprises purchasing advertising and analytics services.

The expected effect depends on actual technical implementation. Restrictions concerning data recipients may reduce secondary collection, while stronger review and isolation of executable content may reduce particular exploitation opportunities. Neither measure alone addresses every stage of the threat.

Course of action C: government procurement transparency and supplier accountability

Public procurement authorities should require sufficient information to understand the legal identity of suppliers, material subcontracting arrangements and the relevant data or software dependencies associated with surveillance-capable products.

For especially sensitive procurement, this may require examination of beneficial ownership, licensing rights, export-control status and the identities of entities exercising material technical control. The depth of disclosure should reflect the nature of the contract and applicable confidentiality restrictions.

The principal benefit is the ability to connect the contracting supplier with the actual provider of the capability, reducing the risk that regulatory screening focuses on an intermediary while overlooking the relevant developer, data source or rights holder.

The main burden concerns the complexity of international corporate structures and the practical limitations of public registry disclosure. Procurement transparency cannot automatically reveal classified customer arrangements or information protected by law, but it can improve the quality of the institutional record.

Course of action D: coordinated technical and regulatory incident response

Where evidence suggests advertising-mediated malicious activity, organisations should preserve the technical information needed to distinguish data collection, code delivery, attempted exploitation and confirmed compromise. Competent authorities should establish procedures for determining which legal or regulatory obligations apply without assuming that every suspicious advertising event constitutes a personal-data breach or successful intrusion.

The principal benefit is more reliable incident classification and attribution. A common vocabulary for technical findings can prevent the inflation of incident counts and improve the ability of different authorities to exchange information.

The main risk is fragmentation if organisations use incompatible definitions or retain insufficient contextual evidence. Coordination should therefore include agreed evidentiary categories while leaving formal legal determinations to the competent authority.

Course of action E: international enforcement and export-control cooperation

The international character of surveillance supply chains requires cooperation among export-control authorities, financial regulators, data-protection authorities and national-security institutions.

Such cooperation should focus on authenticated legal entities, technical products, transactions and applicable restrictions rather than general assumptions about companies operating in particular countries. The ultimate objective is to identify the correct legal actor and apply the appropriate authority to the relevant conduct.

The existing U.S. sanctions actions concerning Intellexa and the European dual-use framework demonstrate that significant instruments already exist, although their legal scope and practical enforcement mechanisms differ. Better coordination would improve the ability to evaluate cross-border structures without presuming that one jurisdiction’s administrative findings automatically establish criminal or international responsibility elsewhere.

Institutional decision matrix

Table 14.1 — Recommended courses of action

Course of action	Primary authority	Expected effect	Implementation burden	Time-to-effect	Reversibility	Principal risk
Institutional exposure assessment	National cybersecurity authorities and affected organisations	Improved identification of advertising-data and software dependencies	Medium to high, depending on scope	Near to medium term	High	Excessive monitoring or incomplete coverage
Advertising-data minimisation	Competent regulators and platform operators	Reduced unnecessary distribution of identifying information	High for complex commercial ecosystems	Medium term	Varies by measure	Displacement into alternative tracking methods
Third-party code controls	Platform operators, publishers and institutional IT authorities	Reduced opportunities for malicious code delivery	Medium to high	Near to medium term	Generally high	Disruption of legitimate services
Supplier assurance reform	Procurement and security authorities	Better identification of material vendors and dependencies	Medium	Medium term	High	Administrative burden without sufficient technical verification
Coordinated incident procedures	Competent cybersecurity, legal and regulatory bodies	More reliable classification and investigation	Medium	Near to medium term	High	Jurisdictional and information-sharing conflicts
Financial and corporate transparency	Competent authorities and contracting organisations	Improved understanding of ownership and commercial relationships	High where offshore entities are involved	Medium to long term	Varies	Incomplete records and inaccurate attribution
Export-control cooperation	National export-control authorities	More consistent treatment of regulated technology transfers	High	Medium to long term	Depends on legal measure	Uneven implementation and unintended commercial effects
International intelligence cooperation	Competent national-security institutions	Improved attribution and situational awareness	High	Continuing	Dependent on agreements	Sensitive-information handling and legal constraints

The implementation periods are qualitative policy-planning categories rather than empirically measured project schedules. Their purpose is to compare the relative complexity of the options without inventing budget estimates or completion dates.

Intelligence collection priorities

A coherent intelligence collection programme should concentrate on evidence capable of resolving the most consequential uncertainty rather than accumulating additional material that merely repeats already established technical relationships.

The first priority is the identification of ultimate customers and operational authorities responsible for confirmed spyware campaigns. This requires evidence capable of distinguishing the spyware developer, advertising intermediary, contracting entity and actual operator. The second priority is the establishment of a more reliable global record of successful advertising-mediated exploitation, which requires device-level forensic findings rather than extrapolation from advertising volume.

The third priority concerns the commercial information economy supporting surveillance. Governments need to understand the distribution of identifying information through advertising exchanges, data brokers and related suppliers, including the legal and contractual arrangements that govern onward use. The fourth priority is the effectiveness of technical and regulatory restrictions introduced after public disclosures. Without independent assessment of their effects, vendor exclusions may be interpreted as comprehensive risk reduction even where the underlying commercial pathways remain available through other participants.

Table 14.2 — Final intelligence collection requirements

Priority	Intelligence requirement	Decisive evidence	Decision supported
Critical	Identify the ultimate customer of a confirmed operation	Authenticated contracts, instructions, financial or competent investigative records	Attribution and lawful institutional response
Critical	Establish the number and identity of confirmed compromised devices	Reliable forensic investigations	Incident scope and protective action
Critical	Determine whether comparable advertising-mediated spyware operations are active elsewhere	Independently verified technical incidents	Threat prioritisation
High	Establish significant corporate and financial relationships	Official ownership, contractual and transaction records	Procurement and regulatory assessment
High	Determine whether current platform controls block selective malicious content	Independent security evaluations	Platform assurance and remediation
High	Identify strategically sensitive commercial-data exposure	Authorised data-flow and institutional risk assessments	Counterintelligence protection
High	Evaluate effects of sanctions and export restrictions	Competent regulatory records and verified corporate changes	International enforcement policy
High	Assess legal and regulatory coordination	Official procedures, decisions and audit findings	Governance reform
Medium	Establish comparable international procurement patterns	Verified public contracting records	Market and policy assessment
Medium	Track changes in surveillance technology distribution	Authenticated product, licensing and corporate records	Medium-term strategic forecasting

Final assessment of the Discover-Tech case and its international significance

The cumulative findings of this dossier establish that advertising-derived surveillance represents a strategically significant convergence of technologies and commercial arrangements that were historically governed through different institutional frameworks. The Discover-Tech investigation is especially important because it documents an operational relationship between advertising infrastructure and sophisticated spyware, showing that commercial mechanisms designed to connect advertisers with potential consumers can, under particular conditions, facilitate the identification and technical exploitation of selected devices.

The principal analytical conclusion is not that the entire advertising industry has become an intelligence service, nor that every company supplying surveillance-related technology participates in a common international operation. The available evidence supports a more precise and consequential assessment: commercial advertising systems can provide intelligence-relevant access and information that become substantially more dangerous when combined with specialised surveillance capabilities and selectively controlled code delivery.

The corporate investigation reveals why the industry’s international structure matters. Development companies, intellectual-property holders, distributors, advertising intermediaries, data brokers and financial entities may operate under different legal regimes, while the ultimate customer and operational sponsor remain difficult to establish from public technical evidence alone. This creates a persistent challenge for investigators attempting to connect the identifiable delivery infrastructure with the persons who financed, authorised or directed a particular operation.

The European assessment demonstrates that existing legal instruments already address substantial parts of the problem. GDPR and ePrivacy govern relevant data-processing and terminal-equipment operations; NIS2 and DORA address specified cybersecurity and resilience obligations; the Digital Services Act regulates defined platform responsibilities; and dual-use export controls provide mechanisms for restricting relevant technology transfers under applicable conditions. Yet their coexistence does not automatically create an integrated response capable of following a surveillance operation from commercial data collection to exploitation and ultimate state responsibility.

The strategic consequence is a requirement for institutional coordination supported by technical and documentary discipline. Government authorities must distinguish advertising exposure from surveillance-oriented behaviour, attempted exploitation from confirmed compromise, and commercial association from legal responsibility. These distinctions protect the credibility of intelligence assessments and reduce the risk of imposing consequences on entities whose connection to an incident has not been established.

Through 2031, the effectiveness of the international response will depend less on the creation of additional general statements concerning the dangers of commercial spyware than on measurable improvements in the governance of data flows, the security of third-party executable content, the transparency of material supplier relationships and the forensic investigation of actual compromises. The underlying commercial incentives are unlikely to disappear merely because particular intermediaries are excluded from major advertising platforms, but improvements in technical isolation and the lawful restriction of unnecessary personal-data transfers can reduce the opportunities available to surveillance operators.

The final policy judgment is therefore that advertising-derived intelligence should be recognised as a distinct security concern at the intersection of privacy regulation, cyber defence and counterintelligence. Its significance arises not only from the possibility of device compromise but from the persistent availability of commercially generated information about individuals and organisations whose activities have strategic importance.

The appropriate institutional response must accordingly remain evidence-based, legally differentiated, technically verifiable and internationally coordinated, preserving legitimate commercial functions while reducing the capacity of malicious actors to convert ordinary digital advertising infrastructure into an instrument of covert surveillance.

---

Copyright of debuglies.com – Even partial reproduction of the contents is not permitted without prior authorization Reproduction reserved