Starlink Ad-Traffic Surveillance Allegations: What Researchers Found — and What They Did Not

October 27, 2026 — A new Reuters investigation has raised a question that reaches beyond satellite internet: can the machinery used to buy online advertisements also help locate people who rely on those networks? Cybersecurity researchers documented unusually concentrated advertising activity involving Starlink internet traffic. Reuters reports that six people familiar with the research linked the activity to an Israeli advertising-technology company, Discover-Tech. That company has not publicly responded to the allegations, and the published technical report itself does not identify it by name.

What the researchers actually measured

In an October 15 technical report, TrendAI described a bidder it calls SHADOW-EARTH-79. Within the advertising traffic visible to its researchers, the bidder was the leading winning bidder for Starlink-related ad traffic in 105 countries. It accounted for approximately 13% of observed winning events on Starlink traffic, compared with a roughly 3% baseline for other bidders. The researchers interpreted that concentration and the bidder’s technical infrastructure as consistent with surveillance-oriented tracking rather than ordinary consumer advertising.

Those percentages describe the dataset the researchers could see, not 13% of all Starlink users or all ads worldwide. TrendAI explicitly says its visibility was limited to one demand-side advertising platform. Its aggregate collection window ran from December 31, 2025, to August 15, 2026; this is a newly reported investigation of earlier observed activity, not evidence that a fresh intrusion occurred on October 27.

How an advertisement auction becomes a privacy risk

When a website or app offers an advertising slot, automated bidders can receive technical details about the device or connection before an ad is displayed. Depending on the exchange and its controls, those details may include an IP address, approximate location, device characteristics and other identifiers. By collecting and correlating bid requests over time, a participant may infer patterns about people even if they never click an advertisement. A satellite connection is not itself proof that a user has been tracked; the concern is what information an advertising system exposes about traffic associated with that connection.

Separate research by the Citizen Lab and Confiant, published October 15, named Discover-Tech in investigations of the misuse of advertising infrastructure and alleged spyware delivery. Their findings provide context for the broader ad-technology risk, but should not be confused with independent proof of the specific Starlink attribution in the TrendAI dataset.

What Reuters reported — and what remains unproven

Reuters reported on October 27 that six sources familiar with the research identified SHADOW-EARTH-79 as Discover-Tech. Reuters also reported that TrendAI had chosen not to name the entity publicly, citing attribution concerns. Neither Discover-Tech nor SpaceX responded to Reuters’ requests for comment, according to the report. The reporting does not establish that every targeted user was identified, that every ad led to malware infection, or that Starlink itself knowingly assisted any alleged operation.

Why it matters beyond Starlink

The larger policy problem is that information intended to match advertisements to audiences can potentially be repurposed to map movements, interests and identities. That is particularly consequential for journalists, aid workers and people communicating in conflict zones, where revealing a location can create real-world risks. Limiting unnecessary data passed to bidders, auditing who receives bidstream information and enforcing exchange restrictions are more direct responses than assuming that changing internet providers alone solves the problem.

Video verification: No official exact-report video with confirmed publication date and embedding permission was verified for this article. The linked research reports and Reuters investigation provide the primary material instead; no unrelated footage has been used.

Image note: The featured photograph is an illustrative satellite dish, not a confirmed Starlink terminal or evidence of surveillance. Photo by maks_d via Unsplash, used under the Unsplash License.