Latest / USA Daily News / Spyware Hidden in Online Ads Al Jazeera Journalists Targeted Without a Click

Transcript

Spyware Hidden in Online Ads Al Jazeera Journalists Targeted Without a Click · USA Daily News

• 0:00
  Speaker 1: The discovery that devices used by journalists at Al Jazeera
• 0:04
  Speaker 1: were targeted with sophisticated spyware through online advertisements has raised
• 0:09
  Speaker 1: serious questions about digital security, press freedom, and the growing
• 0:14
  Speaker 1: sophistication of modern surveillance. What makes this case particularly alarming
• 0:19
  Speaker 1: is that the suspected operation did not depend on the
• 0:22
  Speaker 1: traditional methods commonly associated with cyberattacks. Instead of sending journalists
• 0:28
  Speaker 1: suspicious emails or persuading them to click dangerous links, the
• 0:32
  Speaker 1: attackers reportedly exploited the advertising systems that millions of people
• 0:36
  Speaker 1: encounter every day while browsing the internet. An ordinary advertisement,
• 0:42
  Speaker 1: appearing on a legitimate website or within a familiar application,
• 0:46
  Speaker 1: could become the entry point for highly intrusive surveillance software.
• 0:51
  Speaker 1: The investigation has exposed a troubling possibility. The infrastructure designed
• 0:56
  Speaker 1: to connect businesses with consumers can also be manipulated to
• 1:00
  Speaker 1: identify and compromise specific individuals without their knowledge. The findings
• 1:06
  Speaker 1: became public on October 15, 2026, following an investigation by
• 1:11
  Speaker 1: Citizen Lab, a research group based at the University of
• 1:15
  Speaker 1: Toronto that examines digital surveillance, cybersecurity threats, and abuses of technology.
• 1:22
  Speaker 1: Its investigation connected suspicious activity affecting Al Jazeera's devices to
• 1:27
  Speaker 1: spyware developed by Kandaru, an Israeli surveillance software company that
• 1:31
  Speaker 1: has previously attracted scrutiny over its cyber capabilities. Researchers identified
• 1:37
  Speaker 1: the Israeli advertising technology company DiscoverTech as a key intermediary,
• 1:42
  Speaker 1: alleging that its advertising infrastructure was used to deliver malicious
• 1:46
  Speaker 1: content to selected targets. According to the technical findings, at
• 1:51
  Speaker 1: least 45 devices associated with Al Jazeera were targeted and
• 1:55
  Speaker 1: infected during a campaign that unfolded across 2024 and 2025.
• 2:00
  Speaker 1: The revelation transformed what initially appeared to be a technical
• 2:05
  Speaker 1: security concern inside a major news organization into a wider
• 2:10
  Speaker 1: investigation into the possible misuse of the global advertising industry.
• 2:15
  Speaker 1: The events began to take shape when Al Jazeera's internal
• 2:18
  Speaker 1: technology team noticed unusual patterns involving devices used by some
• 2:23
  Speaker 1: of its journalists in 2024. Such irregularities can have several explanations,
• 2:29
  Speaker 1: ranging from ordinary software errors and suspicious network connections to
• 2:33
  Speaker 1: attempts to access confidential information. However, the patterns continued into 2025,
• 2:40
  Speaker 1: prompting greater concern that something more deliberate might be taking place.
• 2:45
  Speaker 1: Because modern spyware can operate quietly and transmit information through
• 2:50
  Speaker 1: encrypted connections, its presence may not produce the obvious warning
• 2:54
  Speaker 1: signs associated with conventional malware. A device can continue functioning
• 2:59
  Speaker 1: normally while sensitive information is being collected in the background.
• 3:04
  Speaker 1: Recognizing the potential seriousness of the activity, Al Jazeera sought
• 3:08
  Speaker 1: assistance from Citizen Lab, which examined available network records and
• 3:13
  Speaker 1: related technical evidence. The subsequent analysis provided what researchers described
• 3:19
  Speaker 1: as a clear pattern connecting the suspicious activity to an
• 3:22
  Speaker 1: advertising-based delivery mechanism. At the center of the investigation is
• 3:27
  Speaker 1: a method researchers named Adfection, which combines targeted digital advertising
• 3:32
  Speaker 1: with the delivery of sophisticated spyware. To understand its significance,
• 3:37
  Speaker 1: it is important to recognize how online advertising works. When
• 3:41
  Speaker 1: someone visits a website or opens an application, automated systems
• 3:46
  Speaker 1: can conduct rapid auctions to determine which advertisement will appear
• 3:50
  Speaker 1: on the user's screen. These systems rely on a complicated
• 3:54
  Speaker 1: network of advertisers, publishers, advertising exchanges, and technology providers. Information
• 4:02
  Speaker 1: associated with the device and its internet connection can help
• 4:05
  Speaker 1: advertising systems decide which content should be delivered. Although this
• 4:10
  Speaker 1: infrastructure is primarily designed for commercial purposes, researchers found evidence
• 4:15
  Speaker 1: that it could also be manipulated to distinguish selected devices
• 4:19
  Speaker 1: and direct them toward malicious code. Under the reported method,
• 4:24
  Speaker 1: a person would not necessarily need to click the advertisement
• 4:27
  Speaker 1: download a file, or open a suspicious message for the
• 4:31
  Speaker 1: attack to proceed. The advertisement itself could provide the opportunity
• 4:36
  Speaker 1: to initiate the infection. This characteristic places the alleged operation
• 4:41
  Speaker 1: within the category of zero-click attacks among the most concerning
• 4:45
  Speaker 1: forms of modern digital exploitation. Traditional phishing attacks generally depend
• 4:51
  Speaker 1: on a victim taking an action, such as opening an
• 4:54
  Speaker 1: attachment following a deceptive link, or entering credentials into a
• 4:59
  Speaker 1: fraudulent website. Zero-click techniques seek to remove that requirement by
• 5:03
  Speaker 1: exploiting weaknesses in software or systems that process incoming content automatically.
• 5:10
  Speaker 1: In the case uncovered by Citizen Lab, researchers linked the
• 5:14
  Speaker 1: delivery of Kandaru spyware to the appearance of targeted advertisements
• 5:18
  Speaker 1: on affected devices. The investigation into the targeting of Al
• 5:22
  Speaker 1: Jazeera journalists has exposed a disturbing weakness in the modern internet.
• 5:27
  Speaker 1: The same advertising infrastructure that allows businesses to reach millions
• 5:32
  Speaker 1: of consumers can also be manipulated to support covert surveillance.
• 5:36
  Speaker 1: Online advertisements are generally viewed as harmless commercial messages, whether
• 5:41
  Speaker 1: they promote a new smartphone, recommend a shopping website, or
• 5:46
  Speaker 1: appear between videos and articles. Yet beneath this familiar experience
• 5:51
  Speaker 1: lies a complex network of companies, automated auctions, tracking technologies,
• 5:56
  Speaker 1: and data exchanges that determine which advertisement appears on a
• 6:00
  Speaker 1: particular device. The investigation suggests that this infrastructure can be
• 6:05
  Speaker 1: repurposed to do far more than display promotional content. In
• 6:09
  Speaker 1: the reported operation, digital advertising became a mechanism for identifying
• 6:14
  Speaker 1: selected devices and potentially delivering highly sophisticated spyware without requiring
• 6:21
  Speaker 1: their users to click anything. To understand how this could happen,
• 6:25
  Speaker 1: it is necessary to examine how online advertising operates. When
• 6:30
  Speaker 1: someone opens a website or launches an application that displays advertisements,
• 6:35
  Speaker 1: the publisher often relies on third-party advertising companies to fill
• 6:39
  Speaker 1: the available space. These companies participate in a process commonly
• 6:43
  Speaker 1: known as real-time bidding, in which advertisers compete to show
• 6:47
  Speaker 1: their messages to particular audiences. The transaction can take place
• 6:52
  Speaker 1: in fractions of a second, allowing advertisements to be selected
• 6:56
  Speaker 1: according to characteristics associated with the user, the device, the website,
• 7:01
  Speaker 1: and the surrounding digital environment. This system supports much of
• 7:05
  Speaker 1: the modern advertising economy because it helps businesses target potential
• 7:10
  Speaker 1: customers rather than displaying the same advertisement to everyone. However,
• 7:14
  Speaker 1: the scale and complexity of the process also create opportunities
• 7:19
  Speaker 1: for abuse. especially when participants collect more information than users
• 7:23
  Speaker 1: realize or fail to adequately examine the intentions of other
• 7:27
  Speaker 1: companies operating within the network. The crucial issue is that
• 7:31
  Speaker 1: advertising systems do not always need a person's name to
• 7:34
  Speaker 1: distinguish one device from another. They may use technical identifiers,
• 7:39
  Speaker 1: internet addresses, browser characteristics, mobile advertising identifiers, or other signals
• 7:46
  Speaker 1: to recognize a device or estimate whether it matches a
• 7:49
  Speaker 1: particular targeting profile. Some of these identifiers are designed to
• 7:53
  Speaker 1: support legitimate advertising functions, while others can become useful tools
• 7:58
  Speaker 1: for tracking behavior across different online environments. When information from
• 8:03
  Speaker 1: multiple sources is combined, it may become possible to distinguish
• 8:07
  Speaker 1: a particular device with considerable precision. That capability becomes especially
• 8:13
  Speaker 1: sensitive when the person using the device belongs to a
• 8:16
  Speaker 1: group that someone might wish to monitor, such as an
• 8:19
  Speaker 1: investigative journalist, government official, human rights researcher, or employee of
• 8:25
  Speaker 1: a strategically important institution. The danger is not simply that
• 8:29
  Speaker 1: a person sees an advertisement. It is that the advertising
• 8:33
  Speaker 1: system can potentially be used to recognize the person behind
• 8:36
  Speaker 1: the device and direct technical activity toward them. According to
• 8:41
  Speaker 1: the findings published by Citizen Lab, the operation involved an
• 8:45
  Speaker 1: advertising technology company called DiscoverTech and a platform identified as Controllium.
• 8:52
  Speaker 1: Researchers described a process in which the company could purchase
• 8:55
  Speaker 1: advertising space and use the resulting advertisements to gather technical
• 9:00
  Speaker 1: information from devices that encountered them. The system would not
• 9:04
  Speaker 1: necessarily deliver the same material to every person who saw
• 9:08
  Speaker 1: an advertisement. Instead, it could distinguish selected devices from the
• 9:12
  Speaker 1: wider audience and determine whether a particular device matched a
• 9:16
  Speaker 1: desired target profile. For most users, the advertisement might appear
• 9:21
  Speaker 1: to be an ordinary commercial message while the surrounding technical
• 9:25
  Speaker 1: activity continued without attracting attention. The important distinction is that
• 9:31
  Speaker 1: the advertisement served as a point of contact between the
• 9:34
  Speaker 1: device and the advertising infrastructure, creating an opportunity to collect
• 9:39
  Speaker 1: identifying information and, under the circumstances documented by researchers, initiate
• 9:45
  Speaker 1: the delivery of malicious code to a selected target. This
• 9:49
  Speaker 1: approach changes the traditional understanding of how cyberattacks reach their victims.
• 9:54
  Speaker 1: For many years, security awareness campaigns have concentrated on warning
• 9:59
  Speaker 1: people against suspicious emails, fraudulent websites, unexpected attachments, and messages
• 10:05
  Speaker 1: designed to steal passwords. These threats remain significant, but they
• 10:10
  Speaker 1: commonly rely on some form of interaction from the user.
• 10:14
  Speaker 1: A person must open a file, follow a link, approve
• 10:18
  Speaker 1: a download, or enter information before the attack can succeed.
• 10:22
  Speaker 1: The advertising-based technique described in the investigation removes that familiar
• 10:27
  Speaker 1: requirement from the equation. At the center of the spyware
• 10:31
  Speaker 1: operation targeting Al Jazeera journalists are two Israeli companies whose
• 10:35
  Speaker 1: alleged roles reveal how commercial technology can be repurposed for
• 10:40
  Speaker 1: covert surveillance. The first is DiscoverTech, an advertising technology company
• 10:45
  Speaker 1: that researchers identified as a key intermediary in the delivery
• 10:50
  Speaker 1: of malicious advertisements. The second is Kandaroo, a controversial spyware
• 10:55
  Speaker 1: developer whose surveillance software was reportedly installed on devices associated
• 11:00
  Speaker 1: with the International News Network. Although the two companies operated
• 11:04
  Speaker 1: in different areas of the technology industry, The investigation by
• 11:08
  Speaker 1: Citizen Lab connected their activities through an advertising-based system that
• 11:13
  Speaker 1: researchers said could identify selected devices and direct them towards
• 11:17
  Speaker 1: sophisticated spyware. Understanding the relationship between these companies is essential
• 11:23
  Speaker 1: to understanding how an ordinary-looking advertisement could become part of
• 11:27
  Speaker 1: a highly targeted digital espionage operation. DiscoverTech presented itself as
• 11:33
  Speaker 1: a company operating within the digital advertising industry. a sector
• 11:37
  Speaker 1: built around helping businesses reach particular audiences across websites and
• 11:42
  Speaker 1: mobile applications. Its operations involve the purchasing and distribution of
• 11:47
  Speaker 1: online advertisements through a platform known as Controllium. In a
• 11:52
  Speaker 1: conventional advertising business, such systems help determine where promotional messages
• 11:57
  Speaker 1: should appear and which audiences are most likely to respond. However,
• 12:02
  Speaker 1: Citizen Labs' investigation described a significantly more troubling use of
• 12:07
  Speaker 1: this infrastructure. Researchers found that Discover Tech's systems could collect
• 12:12
  Speaker 1: technical information from devices that encountered its advertisements, distinguish selected
• 12:17
  Speaker 1: devices from the broader audience, and direct those matching particular
• 12:22
  Speaker 1: targeting requirements toward additional technical activity. According to the investigation,
• 12:28
  Speaker 1: The company acted as a bridge between the legitimate advertising
• 12:31
  Speaker 1: ecosystem and providers of commercial spyware, allowing technology normally associated
• 12:38
  Speaker 1: with marketing to support surveillance and device exploitation. The significance
• 12:43
  Speaker 1: of DiscoverTecha's alleged role lies in its position within the
• 12:47
  Speaker 1: advertising supply chain. The modern internet depends on an extensive
• 12:51
  Speaker 1: network of intermediaries that distribute advertisements across an enormous range
• 12:56
  Speaker 1: of digital services. A company purchasing advertising space does not
• 13:00
  Speaker 1: necessarily have a direct relationship with every website or application
• 13:05
  Speaker 1: on which its advertisements appear. Instead, automated exchanges and third-party
• 13:11
  Speaker 1: platforms connect advertisers with publishers through rapid transactions that take
• 13:16
  Speaker 1: place largely outside the user's view. This arrangement makes advertising efficient,
• 13:22
  Speaker 1: but it also creates opportunities for abuse when a participant
• 13:25
  Speaker 1: uses the system for purposes that publishers and users do
• 13:29
  Speaker 1: not anticipate. Researchers concluded that DiscoverTech used advertising placements to
• 13:34
  Speaker 1: collect device information and facilitate the delivery of spyware to
• 13:39
  Speaker 1: selected targets. In practical terms, The infrastructure allowed the operation
• 13:44
  Speaker 1: to reach potential victims through ordinary internet activity rather than
• 13:48
  Speaker 1: relying exclusively on conventional hacking attempts or direct contact with
• 13:53
  Speaker 1: the intended targets. A particularly important element of the investigation
• 13:58
  Speaker 1: was Controllium, the platform associated with DiscoverTech. Researchers described its
• 14:04
  Speaker 1: ability to help identify devices using technical information and direct
• 14:08
  Speaker 1: selected devices toward malicious payloads. This capability is central to
• 14:13
  Speaker 1: the technique they named adfection. When an advertisement appeared on
• 14:17
  Speaker 1: a compatible device, the advertising infrastructure could collect information that
• 14:22
  Speaker 1: helped determine whether the device met the attacker's targeting criteria.
• 14:27
  Speaker 1: Most devices encountering the advertisement would not necessarily receive the spyware,
• 14:32
  Speaker 1: but selected devices could be directed toward the next stage
• 14:36
  Speaker 1: of the operation. The result was a system that combined
• 14:39
  Speaker 1: the broad reach of digital advertising with the precision associated
• 14:43
  Speaker 1: with targeted cyber espionage. Rather than treating every internet user
• 14:48
  Speaker 1: as an equal target, the mechanism could use a large
• 14:51
  Speaker 1: advertising network to identify a smaller group of people or
• 14:55
  Speaker 1: devices for more intrusive surveillance. Kandaru occupied a different position
• 15:00
  Speaker 1: in this arrangement. Unlike DiscoverTech, which researchers linked to the
• 15:05
  Speaker 1: advertising and targeting infrastructure, Kandaroo is known for developing advanced
• 15:10
  Speaker 1: surveillance software designed to exploit vulnerabilities in digital devices. The
• 15:15
  Speaker 1: company's technology belongs to a controversial commercial spyware industry in
• 15:20
  Speaker 1: which sophisticated hacking tools are developed and sold to customers
• 15:24
  Speaker 1: capable of deploying them against selected individuals. Such tools can
• 15:28
  Speaker 1: be substantially more intrusive than ordinary tracking software because they
• 15:32
  Speaker 1: may allow an operator to gain access to information stored
• 15:35
  Speaker 1: on a compromised device. The most disturbing aspect of the
• 15:39
  Speaker 1: spyware operation targeting Al Jazeera is the way an ordinary
• 15:43
  Speaker 1: online advertisement could become the starting point for a highly
• 15:47
  Speaker 1: sophisticated cyberattack. Unlike conventional hacking attempts, which often depend on
• 15:52
  Speaker 1: stolen passwords, suspicious email attachments, or deceptive links, the method
• 15:58
  Speaker 1: identified by researchers relied on the routine process of displaying
• 16:02
  Speaker 1: advertisements on websites and applications. A journalist could be browsing
• 16:07
  Speaker 1: an otherwise legitimate website, researching a story, or accessing an
• 16:13
  Speaker 1: everyday online service without realizing that the advertising content being
• 16:17
  Speaker 1: delivered to the device might have been selected for surveillance purposes.
• 16:21
  Speaker 1: The investigation found that at least 45 Windows computers associated
• 16:26
  Speaker 1: with Al Jazeera were targeted and infected with spyware attributed
• 16:30
  Speaker 1: to Kandaru during 2024 and 2025. These findings exposed a
• 16:35
  Speaker 1: dangerous gap between the way people understand online advertising and
• 16:40
  Speaker 1: the security risks hidden within the systems responsible for delivering it.
• 16:45
  Speaker 1: The process began when DiscoverTech purchased advertising placements through the
• 16:49
  Speaker 1: digital advertising ecosystem. When a website or application won an
• 16:54
  Speaker 1: advertising transaction and displayed one of the company's advertisements, the
• 16:59
  Speaker 1: advertisement could initiate a request to infrastructure controlled by DiscoverTech.
• 17:04
  Speaker 1: That request allowed the system to collect certain technical information
• 17:08
  Speaker 1: from the device and its browsing environment. Depending on the circumstances,
• 17:13
  Speaker 1: the information could include the device's public internet address, browser-related details,
• 17:19
  Speaker 1: and other data that helped distinguish one device from another.
• 17:23
  Speaker 1: In some situations, advertising technologies can also access information associated
• 17:29
  Speaker 1: with the webpage on which an advertisement appears. The collection
• 17:33
  Speaker 1: of these signals helped create an opportunity to identify devices
• 17:37
  Speaker 1: that matched particular targeting requirements. Although the majority of people
• 17:42
  Speaker 1: encountering an advertisement would not necessarily be selected for further activity,
• 17:47
  Speaker 1: researchers found that the system could be used to distinguish
• 17:50
  Speaker 1: potential targets from the much larger audience exposed to the advertisements.
• 17:56
  Speaker 1: The next stage involved determining whether a particular device should
• 18:00
  Speaker 1: receive additional content. According to the investigation, DiscoverTech operated a
• 18:05
  Speaker 1: platform called Controllium, which enabled targeted advertising activity to be
• 18:10
  Speaker 1: connected to surveillance operations. The system could use information gathered
• 18:15
  Speaker 1: when advertisements appeared to recognize devices that matched the desired profile.
• 18:21
  Speaker 1: For ordinary users, the advertisement might simply display a commercial
• 18:25
  Speaker 1: message or operate without attracting any attention. When a device
• 18:30
  Speaker 1: matched the targeting criteria, however, the infrastructure could direct it
• 18:34
  Speaker 1: toward the next stage of the operation. Researchers identified technical
• 18:39
  Speaker 1: connections between Discover Teca's advertising systems and infrastructure associated with
• 18:44
  Speaker 1: Kandaru's spyware. Their analysis of network records provided by Al
• 18:49
  Speaker 1: Jazeera showed a sequence of activity consistent with devices first
• 18:53
  Speaker 1: contacting DiscoverTech infrastructure through advertisements and then being directed toward
• 18:58
  Speaker 1: the systems used to deliver the spyware. This relationship formed
• 19:02
  Speaker 1: the technical foundation of the attack described in the investigation.
• 19:07
  Speaker 1: One of the most significant features of this method was
• 19:10
  Speaker 1: that it did not require the targeted journalist to click
• 19:12
  Speaker 1: on the advertisement. Cybersecurity specialists describe attacks that succeed without
• 19:18
  Speaker 1: deliberate action by the victim as zero-click attacks. The term
• 19:22
  Speaker 1: does not mean that every advertisement automatically infects every device
• 19:27
  Speaker 1: that displays it. Rather, the process can be designed to
• 19:31
  Speaker 1: identify selected devices and exploit them without requiring their users
• 19:35
  Speaker 1: to open a link, download a file, or approve a
• 19:39
  Speaker 1: suspicious request. In the case documented by Citizen Lab, The
• 19:43
  Speaker 1: advertisement provided the initial technical contact, while the remaining stages
• 19:48
  Speaker 1: depended on the targeting system. and the spyware's ability to
• 19:52
  Speaker 1: compromise the device. This distinction is essential because it explains
• 19:56
  Speaker 1: why the operation was more serious than an ordinary malicious
• 20:00
  Speaker 1: advertisement designed to redirect someone to a fraudulent website. Instead
• 20:05
  Speaker 1: of attempting to trick a person into making a mistake,
• 20:08
  Speaker 1: The method sought to exploit the technology processing the advertisement itself.
• 20:13
  Speaker 1: A journalist following familiar online safety practices could therefore be
• 20:18
  Speaker 1: exposed without seeing an obvious warning or recognizing that an
• 20:22
  Speaker 1: attack was underway. Once spyware successfully compromises a device, the
• 20:27
  Speaker 1: potential consequences become far more extensive than the initial advertising
• 20:31
  Speaker 1: interaction might suggest. Kandaru's surveillance software has been associated with
• 20:37
  Speaker 1: capabilities designed to obtain sensitive information from infected systems. The
• 20:42
  Speaker 1: investigation into the spyware targeting Al Jazeera journalists has revealed
• 20:47
  Speaker 1: that the potential reach of the operation extended far beyond
• 20:50
  Speaker 1: a single media organization. While the targeting of journalists attracted
• 20:55
  Speaker 1: immediate attention because of its implications for press freedom, the
• 20:59
  Speaker 1: wider advertising network uncovered by researchers raised concerns about exposure
• 21:04
  Speaker 1: across thousands of websites. tens of thousands of applications, and
• 21:09
  Speaker 1: devices used within sensitive institutions around the world. The central
• 21:14
  Speaker 1: question is no longer limited to how spyware reached individual journalists.
• 21:19
  Speaker 1: It is also how a system capable of distributing advertisements
• 21:23
  Speaker 1: on such a vast scale could be used to identify
• 21:25
  Speaker 1: devices belonging to people who might be valuable targets for surveillance.
• 21:30
  Speaker 1: The findings suggest that commercial advertising infrastructure can provide access
• 21:35
  Speaker 1: to a much broader pool of potential targets than would
• 21:38
  Speaker 1: be possible through attacks directed at individual accounts or a
• 21:42
  Speaker 1: small number of websites. Researchers at Citizen Lab analyzed billions
• 21:46
  Speaker 1: of advertising records associated with DiscoverTech to understand the company's
• 21:51
  Speaker 1: activities and the extent of its advertising distributions. During a
• 21:56
  Speaker 1: four-month period in 2026, the records indicated that its advertisements
• 22:01
  Speaker 1: appeared across nearly 200,000 unique websites and mobile applications. Other
• 22:07
  Speaker 1: reporting based on the investigation highlighted approximately 120,000 websites and 75,000
• 22:14
  Speaker 1: applications during the period examined. Although the precise figures vary
• 22:19
  Speaker 1: according to the reporting and categories counted, the scale is striking.
• 22:24
  Speaker 1: It demonstrates how a relatively obscure advertising technology company could
• 22:28
  Speaker 1: distribute content across a vast digital environment without necessarily operating
• 22:33
  Speaker 1: the websites or applications displaying it. The advertisements reached users
• 22:38
  Speaker 1: through an existing commercial system that already connects advertisers, publishers,
• 22:44
  Speaker 1: and technology platforms across national borders. This widespread presence created
• 22:49
  Speaker 1: opportunities to collect technical information about devices and potentially direct
• 22:54
  Speaker 1: selected users toward more intrusive surveillance activity. The numbers, however,
• 22:59
  Speaker 1: require careful interpretation. The appearance of an advertisement on a
• 23:04
  Speaker 1: website or inside an application does not automatically mean that
• 23:08
  Speaker 1: the website itself was compromised, that its operator knowingly participated
• 23:13
  Speaker 1: in espionage. or that everyone who encountered the advertisement was
• 23:17
  Speaker 1: infected with spyware. Advertising networks routinely distribute content through complex
• 23:23
  Speaker 1: arrangements in which publishers may have limited visibility into every
• 23:27
  Speaker 1: advertiser and intermediary involved. In the operation described by researchers,
• 23:33
  Speaker 1: the important distinction was between the broad distribution of advertisements
• 23:37
  Speaker 1: and the narrower process of identifying devices for additional technical activity.
• 23:43
  Speaker 1: The advertisement could reach thousands of ordinary users while the
• 23:46
  Speaker 1: targeting system concentrated on a much smaller group. Consequently, the
• 23:51
  Speaker 1: size of the advertising network illustrates the potential reach of
• 23:55
  Speaker 1: the infrastructure rather than providing a direct count of victims
• 23:58
  Speaker 1: whose devices were successfully compromised. Beyond the advertising figures, investigators
• 24:05
  Speaker 1: identified evidence that the infrastructure was used to direct large
• 24:09
  Speaker 1: numbers of devices toward servers associated with Kandaroo. Citizen Lab
• 24:14
  Speaker 1: described millions of devices as being directed to contact the
• 24:17
  Speaker 1: spyware company's infrastructure, activity that researchers believed was likely associated
• 24:23
  Speaker 1: with large-scale tracking and reconnaissance. This distinction is important because
• 24:29
  Speaker 1: collecting information about a device, attempting to exploit it, and
• 24:33
  Speaker 1: successfully installing spyware are separate stages of a surveillance operation.
• 24:38
  Speaker 1: A device might contact a suspicious server without becoming infected,
• 24:42
  Speaker 1: while another might be subjected to a more targeted exploit.
• 24:46
  Speaker 1: Establishing whether the attack succeeded requires more detailed technical evidence
• 24:51
  Speaker 1: than simply showing that an advertisement appeared or that a
• 24:55
  Speaker 1: device connected to an unfamiliar domain. Nevertheless, the reported scale
• 25:00
  Speaker 1: of the connections raises serious questions about how many people
• 25:04
  Speaker 1: may have been profiled, how their devices were selected for
• 25:07
  Speaker 1: further attention, and whether the same infrastructure could support additional
• 25:12
  Speaker 1: surveillance campaigns. The investigation also raised concerns because the advertisements
• 25:17
  Speaker 1: appeared within digital environments associated with sensitive government and international institutions.
• 25:24
  Speaker 1: Separate analysis by advertising security company can find identified DiscoverTech
• 25:29
  Speaker 1: advertisements on networks connected to organizations, including the United Nations
• 25:35
  Speaker 1: International Atomic Energy Agency and The International. criminal court. Other
• 25:40
  Speaker 1: reporting linked the advertising activity to networks associated with military
• 25:45
  Speaker 1: and government institutions, including the Pentagon and NATO. Al Jazeera's
• 25:50
  Speaker 1: response to the discovery of spyware targeting its employees has
• 25:54
  Speaker 1: brought the issue of digital surveillance into a much broader
• 25:57
  Speaker 1: debate about press freedom, the protection of journalists, and the
• 26:02
  Speaker 1: right of the public to receive independent information. Following the
• 26:06
  Speaker 1: publication of the investigation, the International News Network condemned the
• 26:10
  Speaker 1: targeting of devices belonging to several employees and pledged to
• 26:15
  Speaker 1: continue protecting its staff and systems. The network described the
• 26:19
  Speaker 1: targeting of journalists as an assault on press freedom and
• 26:22
  Speaker 1: the public's right to knowledge, while calling for those responsible
• 26:26
  Speaker 1: to be held accountable. Its response reflected the seriousness of
• 26:30
  Speaker 1: an operation in which digital advertising infrastructure was allegedly used
• 26:35
  Speaker 1: to deliver advanced surveillance software without requiring the intended targets
• 26:39
  Speaker 1: to click on suspicious links or knowingly download malicious files.
• 26:44
  Speaker 1: For a news organization whose employees handle sensitive information every day,
• 26:49
  Speaker 1: the incident was not simply a technical problem. It raised
• 26:53
  Speaker 1: fundamental questions about the safety of journalists, and the ability
• 26:57
  Speaker 1: of media institutions to investigate important issues without interference. The
• 27:03
  Speaker 1: discovery followed an internal investigation that began in 2024 when
• 27:08
  Speaker 1: Al Jazeera's technology team identified unusual patterns involving devices used
• 27:14
  Speaker 1: by some journalists. Rather than dismissing the activity as an
• 27:18
  Speaker 1: isolated technical irregularity, the team continued examining the problem as
• 27:23
  Speaker 1: suspicious patterns persisted into 2025. The network subsequently sought assistance
• 27:29
  Speaker 1: from Citizen Lab, a research group at the University of
• 27:33
  Speaker 1: Toronto specializing in digital security and surveillance. This cooperation enabled
• 27:39
  Speaker 1: outside researchers to examine network records and reconstruct the sequence
• 27:43
  Speaker 1: of events associated with the suspected attacks. Their findings connected
• 27:48
  Speaker 1: the suspicious activity to advertising infrastructure associated with DiscoverTech and
• 27:53
  Speaker 1: spyware attributed to Kandaroo. The technical investigation ultimately documented what
• 27:59
  Speaker 1: researchers described as a zero-click spyware operation affecting at least
• 28:03
  Speaker 1: 45 devices associated with Al Jazeera. The collaboration between the
• 28:08
  Speaker 1: network and independent researchers was therefore central to transforming an
• 28:13
  Speaker 1: internal security concern into a publicly documented case, with implications
• 28:18
  Speaker 1: for the wider technology industry. The incident also demonstrates the
• 28:22
  Speaker 1: growing importance of digital forensics in protecting modern newsrooms. Journalists
• 28:28
  Speaker 1: can no longer rely exclusively on physical security, secure office facilities,
• 28:33
  Speaker 1: or conventional information technology protections to safeguard their work. Their
• 28:38
  Speaker 1: professional activities depend on computers, smartphones, cloud services, messaging platforms,
• 28:45
  Speaker 1: and online research tools. each of which can introduce additional
• 28:49
  Speaker 1: security risks. When unusual activity appears on a device, identifying
• 28:54
  Speaker 1: the cause may require specialized analysis that goes beyond the
• 28:58
  Speaker 1: capabilities of ordinary technical support teams. Detailed network logs, suspicious connections,
• 29:05
  Speaker 1: device records, and traces of malicious software can help investigators
• 29:09
  Speaker 1: establish whether an attack occurred and how it may have progressed.
• 29:13
  Speaker 1: In the Al Jazeera case, the preservation and examination of
• 29:17
  Speaker 1: technical records helped researchers connect the suspicious activity to the
• 29:22
  Speaker 1: advertising-based delivery mechanism. This illustrates why media organizations need both
• 29:28
  Speaker 1: internal monitoring capabilities and access to independent cybersecurity expertise, confronting
• 29:34
  Speaker 1: sophisticated threats. The stakes are particularly high because journalists frequently
• 29:40
  Speaker 1: hold information that belongs not only to them, but also
• 29:43
  Speaker 1: to the people who trust them. A reporter's computer or
• 29:47
  Speaker 1: phone might contain the name of a confidential source, notes
• 29:51
  Speaker 1: from a sensitive interview, photographs taken in a dangerous environment,
• 29:55
  Speaker 1: or communications with people who face intimidation because of what
• 29:59
  Speaker 1: they know. Investigative journalists may also retain documents that reveal misconduct, corruption,
• 30:06
  Speaker 1: human rights abuses, or activities that powerful individuals and organizations
• 30:11
  Speaker 1: would prefer to keep private. If spyware gains access to
• 30:15
  Speaker 1: such material, the consequences can extend beyond the loss of
• 30:19
  Speaker 1: personal privacy. An exposed source may face pressure or retaliation,
• 30:25
  Speaker 1: an unfinished investigation may become visible to the people being investigated,
• 30:29
  Speaker 1: and a journalist's future reporting plans may be revealed before
• 30:33
  Speaker 1: the public has an opportunity to see the findings. Even
• 30:37
  Speaker 1: when there is no evidence that particular information was subsequently
• 30:40
  Speaker 1: used against a source, the possibility of such exposure creates
• 30:44
  Speaker 1: a serious security concern. This is why surveillance can undermine
• 30:49
  Speaker 1: journalism even when the stolen information never appears publicly. An
• 30:53
  Speaker 1: operator who obtains access to a reporter's device may be
• 30:57
  Speaker 1: able to observe communications, identify professional contacts, or gain insight
• 31:03
  Speaker 1: into the subjects being investigated. The investigation into spyware targeting
• 31:08
  Speaker 1: Al Jazeera journalists has triggered a significant response across the
• 31:12
  Speaker 1: digital advertising industry. forcing major technology companies and industry organizations
• 31:18
  Speaker 1: to reconsider their relationships with DiscoverTech. Once researchers connected the
• 31:23
  Speaker 1: company's advertising infrastructure to the delivery of sophisticated spyware, attention
• 31:29
  Speaker 1: shifted from the technical details of the attacks to the
• 31:32
  Speaker 1: systems that had allowed the company to operate within the
• 31:35
  Speaker 1: advertising ecosystem. Google, Comcast-owned advertising platform Beeswax, advertising technology company Eskimi,
• 31:43
  Speaker 1: and mobile advertising provider Vungle, operated by Liftoff, all took
• 31:48
  Speaker 1: action affecting Discover Tech's access to their services. IAB Europe,
• 31:53
  Speaker 1: a major industry association, also suspended the company from its
• 31:57
  Speaker 1: approved vendor list. These measures represented an important response to
• 32:02
  Speaker 1: the allegations. but they raised a larger question about whether
• 32:06
  Speaker 1: the existing safeguards governing online advertising are strong enough to
• 32:10
  Speaker 1: prevent commercial infrastructure from being exploited for covert surveillance. Google's
• 32:15
  Speaker 1: response was particularly significant because of its central position in
• 32:20
  Speaker 1: the digital advertising market. The company's advertising systems connect advertisers
• 32:25
  Speaker 1: with websites and applications across an enormous range of online services.
• 32:30
  Speaker 1: Before the findings became public, DiscoverTech had appeared on advertising
• 32:35
  Speaker 1: vendor registries that helped establish its standing within the commercial
• 32:39
  Speaker 1: advertising ecosystem. According to Citizen Lab, Google cooperated with the
• 32:44
  Speaker 1: investigation and subsequently removed DiscoverTech from its advertising vendor registries,
• 32:50
  Speaker 1: terminating the company's access to Google's advertising exchange platforms in
• 32:55
  Speaker 1: early October 2026. The move was consequential because access to
• 33:00
  Speaker 1: major advertising exchanges can provide companies with the ability to
• 33:04
  Speaker 1: purchase advertising placements at considerable scale. Removing a company from
• 33:08
  Speaker 1: those systems can sharply limit its ability to distribute advertisements
• 33:13
  Speaker 1: through particular channels and reduce the opportunities available to exploit
• 33:17
  Speaker 1: them for malicious purposes. Nevertheless, The action against DiscoverTech also
• 33:23
  Speaker 1: raised questions about how a company associated with such serious
• 33:26
  Speaker 1: allegations had been able to participate in these systems for
• 33:30
  Speaker 1: an extended period. The response extended beyond Google. Beeswax, an
• 33:35
  Speaker 1: advertising buying platform owned by Comcast, removed DiscoverTech from its
• 33:40
  Speaker 1: platform after reviewing information related to the investigation. Its response
• 33:46
  Speaker 1: emphasized that malicious advertising was prohibited and that it would
• 33:50
  Speaker 1: continue working with security partners and other industry participants to
• 33:54
  Speaker 1: identify and remove abusive actors. Eskimi also reported that it
• 33:59
  Speaker 1: had blocked Discoverteca's accounts and domains after its monitoring systems
• 34:03
  Speaker 1: identified suspicious behavior. According to the company's explanation, the advertiser's
• 34:09
  Speaker 1: technical tags could load different code depending on characteristics, such
• 34:13
  Speaker 1: as the device, internet address, and location of the person
• 34:17
  Speaker 1: viewing an advertisement. Campaigns could also be configured to reach
• 34:21
  Speaker 1: very narrow groups of internet addresses, making automated advertising verification
• 34:26
  Speaker 1: more difficult. These details illustrate a central problem confronting the industry.
• 34:32
  Speaker 1: An advertisement may appear harmless during an ordinary inspection while
• 34:36
  Speaker 1: delivering different behavior to a specifically selected device. Detecting such
• 34:41
  Speaker 1: activity requires systems capable of examining not just the advertisement's
• 34:45
  Speaker 1: visible content, but also its technical behavior under different conditions. Vungle,
• 34:51
  Speaker 1: which operates under the Liftoff advertising business, took a different
• 34:55
  Speaker 1: approach by pausing DiscoverTech's access while conducting a review. That
• 35:00
  Speaker 1: distinction matters because suspending access during an investigation is not
• 35:05
  Speaker 1: necessarily the same as making a final determination about every allegation.
• 35:10
  Speaker 1: Different providers may adopt different measures depending on their contractual arrangements,
• 35:15
  Speaker 1: available evidence, and internal security procedures. Nevertheless, the coordinated actions
• 35:22
  Speaker 1: by several advertising companies indicated that the allegations had consequences
• 35:27
  Speaker 1: across multiple parts of the advertising supply chain. The response
• 35:31
  Speaker 1: also demonstrated that the companies involved did not all occupy
• 35:35
  Speaker 1: the same position in the suspected operation. Some provided advertising
• 35:40
  Speaker 1: exchange services, others facilitated the purchase or distribution of advertisements,
• 35:46
  Speaker 1: and DiscoverTech was identified by researchers as the intermediary allegedly
• 35:51
  Speaker 1: linking targeted advertising to spyware delivery. Recognizing these distinctions is
• 35:56
  Speaker 1: important when determining which companies had the ability to prevent
• 35:59
  Speaker 1: the activity and what responsibilities they should bear. IAB Europe
• 36:04
  Speaker 1: also took action against DiscoverTech. The spyware investigation involving Al
• 36:09
  Speaker 1: Jazeera has exposed a growing challenge for governments, technology companies,
• 36:14
  Speaker 1: media organizations, and ordinary internet users. The infrastructure that makes
• 36:19
  Speaker 1: modern digital life convenient can also become a vehicle for
• 36:23
  Speaker 1: sophisticated surveillance. The alleged use of online advertising to identify
• 36:28
  Speaker 1: devices and deliver spyware demonstrates how the boundaries between commercial
• 36:32
  Speaker 1: data collection and cyber espionage can become dangerously blurred. As
• 36:37
  Speaker 1: investigators continue examining the operation, the central issue is no
• 36:42
  Speaker 1: longer limited to the activities of DiscoverTech or the capabilities
• 36:46
  Speaker 1: of Kandaroo. It is whether the digital systems used by
• 36:49
  Speaker 1: billions of people can be made sufficiently secure to prevent
• 36:53
  Speaker 1: legitimate commercial services from becoming tools for covert intrusion. The
• 36:58
  Speaker 1: answer will influence future approaches to cybersecurity, privacy regulation, national security,
• 37:04
  Speaker 1: and the protection of independent journalism. One of the most
• 37:08
  Speaker 1: immediate implications is the need to reconsider the security of
• 37:12
  Speaker 1: the online advertising ecosystem. For years, Advertising companies have focused
• 37:18
  Speaker 1: primarily on delivering relevant messages, measuring audience engagement, preventing fraud,
• 37:24
  Speaker 1: and ensuring that commercial campaigns comply with platform policies. The
• 37:29
  Speaker 1: investigation suggests that these priorities may not adequately address situations
• 37:34
  Speaker 1: in which advertising infrastructure is deliberately manipulated to identify specific
• 37:39
  Speaker 1: devices or facilitate the delivery of malicious software. Future security
• 37:44
  Speaker 1: standards may therefore need to examine not only what an
• 37:47
  Speaker 1: advertisement displays, but also what happens technically when it appears
• 37:52
  Speaker 1: on a device. This could involve more extensive behavioral analysis,
• 37:56
  Speaker 1: stronger verification of advertising intermediaries, closer examination of unusual network connections,
• 38:04
  Speaker 1: and faster cooperation between advertising providers and cybersecurity researchers. The
• 38:10
  Speaker 1: objective would be to identify suspicious activity before it develops
• 38:14
  Speaker 1: into a successful surveillance operation, rather than relying primarily on
• 38:19
  Speaker 1: removing a company after evidence of abuse becomes public. Stronger
• 38:24
  Speaker 1: controls would also require a clearer understanding of how responsibility
• 38:28
  Speaker 1: is distributed throughout the advertising supply chain. An advertisement can
• 38:33
  Speaker 1: pass through several companies before appearing on a website or
• 38:36
  Speaker 1: within an application. and each participant may have only partial
• 38:40
  Speaker 1: visibility into the activities of the others. This fragmented structure
• 38:45
  Speaker 1: makes it difficult to determine where suspicious conduct originated and
• 38:49
  Speaker 1: which organization had the ability to prevent it. Technology companies
• 38:54
  Speaker 1: may need to strengthen the checks they perform on advertisers,
• 38:57
  Speaker 1: retain appropriate technical records, and establish more effective procedures for
• 39:02
  Speaker 1: investigating credible warnings. Publishers and application developers could also face
• 39:08
  Speaker 1: greater pressure to review the companies authorized to place advertisements
• 39:12
  Speaker 1: within their services. These measures would not guarantee that every
• 39:16
  Speaker 1: malicious campaign could be detected, particularly when attackers deliberately change
• 39:22
  Speaker 1: their methods to evade scrutiny. However, a more accountable system
• 39:26
  Speaker 1: could make it harder for surveillance operators to exploit legit
• 39:30
  Speaker 1: commercial relationships without attracting attention. The investigation could also accelerate
• 39:36
  Speaker 1: changes in the way privacy regulators assess digital advertising. Traditional
• 39:41
  Speaker 1: privacy protections often concentrate on how personal information is collected, processed, shared,
• 39:48
  Speaker 1: and retained. Those questions remain important, but the reported operation
• 39:53
  Speaker 1: demonstrates that technical information collected through advertising can potentially serve
• 39:58
  Speaker 1: purposes far more intrusive than consumer profiling. Data that helps
• 40:03
  Speaker 1: identify a device or distinguish one user from a larger
• 40:06
  Speaker 1: audience may become useful in selecting targets for surveillance. If
• 40:11
  Speaker 1: that information is combined with an advanced exploitation tool, The
• 40:15
  Speaker 1: consequences can move from unwanted tracking to unauthorized access to
• 40:20
  Speaker 1: private communications and files. Regulators may therefore face pressure to
• 40:25
  Speaker 1: consider how advertising systems should be governed when their technical
• 40:28
  Speaker 1: capabilities can support targeted cyber operations. The challenge will be
• 40:33
  Speaker 1: to create enforceable protections that address malicious activity without treating
• 40:38
  Speaker 1: every advertising company, data exchange, or instance of automated targeting
• 40:43
  Speaker 1: as inherently harmful. Device manufacturers and software developers will also
• 40:49
  Speaker 1: play a critical role in reducing the risks associated with
• 40:52
  Speaker 1: zero-click attacks. Operating systems, browsers, and applications routinely process material
• 40:59
  Speaker 1: from external sources, including advertisements, images, scripts and embedded content.
• 41:06
  Speaker 1: Because this processing frequently happens automatically, vulnerabilities in the relevant
• 41:11
  Speaker 1: software can sometimes be exploited without a user deliberately opening
• 41:15
  Speaker 1: a suspicious file.