5 July, 06:05 PM
Google sold data of Ukrainian users to Russia even after sanctions
The incident points to there being a real crisis in the work of advertising platforms, which are losing control over the flow of user data.
In the immediate aftermath of Russia's full-scale invasion of Ukraine, US Senate Intelligence Committee Chairman Mark Warner told Google to be on alert for “exploitation of (their) platform by Russia and Russian-linked entities."
In April, a group of U.S. senators sent another letter to Google and other major adtech companies, saying that "user data is a goldmine for foreign intelligence services," which could use the information to spread propaganda, hack attacks, and blackmail.
Despite all warnings, Google shared potentially sensitive user data with the sanctioned Russian advertising company RuTarget, owned by Sberbank. According to a study by the digital advertising analytics company Adalytics, among the users whose data went to Russia were also residents of Ukraine.
Google’s cooperation with Russian company
The company was not deterred by the fact that RuTarget is a Russian company that was sanctioned by the U.S. Department of the Treasury, nor that it belongs to the largest Russian state-owned bank, which was sanctioned by the U.S. on April 6. Moreover, the U.S. Treasury specifically mentioned RuTarget as a company that should be subject to sanctions and a ban on cooperation.
However, Adalytics analysts counted about 700 cases where RuTarget received user data from Google after the start of the full-scale invasion.
The company only stopped sharing data with the Russians on June 23, when ProPublica reached out to the company for comment.
Among these data were unique identifiers of mobile phones (the IMEI code, which is unique for each device and allows to identify a specific phone among others), IP addresses, information about the location of users, their interests, and activity on the Internet: which products are viewed, which websites are visited, etc. Such data is sufficient for the Russians to track specific people, experts say.
Google representative Michael Aciman noted that the company banned RuTarget from using software products back in March. Since then, Russians have stopped buying advertising directly through Google. However, he admitted that despite all the bans, RuTarget continued to receive user data before journalists approached the company.
According to him, now RuTarget cannot buy advertising either on its own or using a third party, which could act as an intermediary and thus allow itto bypass sanctions. However, Aciman refused to comment on whether this ban works in practice. In addition, he did not say whether data about Ukrainian users was transferred to RuTarget.
Krzysztof Franaszek, head of Adalytics, notes that the volume of data at Google's disposal, along with information that may come from other data sources such as military intelligence or hackers, can actually be a “great danger.”
The looming ad war
American Senator Mark Warner said he considers it "disturbing" that Google could not immediately sever all relations with the Russian company. He is sure that all companies are obliged to check their activities to make sure that they do not cooperate with companies that support the war in Ukraine.
Adalytics analysts note that their research illustrates the complexity of such inspections and, especially, obtaining honest information about the companies' activities. For advertisers, media, and even platforms like Google and Meta, it may not be so easy to identify and track everyone with whom they directly or indirectly work.
And this is actually one of the main problems of the Internet. It has given free rein to tech companies that have established their dominance, gradually expanding their influence beyond the online world. As a result, they increasingly evade control. For example, in 2021, when six US senators asked Google's CEO to provide a list of foreign companies that had obtained the data of American users, the company refused to do so, citing a non-disclosure agreement. When the journalist Joseph Cox of Motherboard reached out to Google with another request, the company did not respond to him at all.
Most users find it difficult to grasp the technicalities of how online advertising works. However, many will probably be surprised that by clicking "Agree" on another cookie consent box that pops up, you may agree to share your data with a sanctioned company.
Many websites, in particular mass media, actively cooperate with Google and its advertising platform. And so, due to the fact that Google does not check its partners well enough, the information about users that is collected on these sites can be transferred even to companies like RuTarget.
For example, Adalytics analysts discovered that several large American and European publications and websites asked users for permission to send their data to a sanctioned Russian company. Among them are Reuters, ESPN, Tripadvisor, IGN, The Atlantic, National Geographic and many others.
Why these websites offer users to send their data to a Russian company is unknown.
Reuters Senior Communications Director Heather Carpenter said this was a standard list of Google ad providers provided by the company. She stresses that user data collected on Reuters has not been shared with RuTarget since April 6.
On the RuTarget website, BMW, Audi, Nintendo, AliExpress, Master Card, Sony, and many other large companies from completely different market segments are listed among the brands that cooperated with the company.It is unknown whether the brands themselves know that their logos are placed on the website of a sanctioned Russian company, whether they worked with it in the past or are currently working with it. All declined to comment on the findings except for Pfizer, whose spokesman said the company had already severed all "working relationships with the aforementioned organization."
Adalytics experts point out that companies may not suspect such cooperation if it was carried out with the help of branches or subsidiaries. The opaque policy of Google and digital advertising in general will lead to the fact that sooner or later any website that works with Google could be involved in such "cooperation" with the Russians.
"Metadata absolutely tells you everything about somebody’s life. If you have enough metadata, you don’t really need content." This quotation from NSA counsel Stewart Baker in 2013 shows just how important personal data can be.
The words of the former director of the NSA and CIA, General Michael Hayden, sound even more threatening: "We kill people based on metadata." The Washington Post previously reported how the NSA used cookies to identify its next targets for hacking.
User data is a huge database that can be used for various non-advertising purposes. In the hands of an enemy, they can help sow discord in society, change people's behavior, track them, and their interests, and manipulate that information to their advantage, the Army Cyber Institute writes.
Due to technical difficulties, many users are not in a hurry to understand how metadata works, why it is actually important, and how to keep yourself safe on the Internet. For this, you do not need to read every popup about cookies, constantly use a VPN or download the Tor browser – it is enough to spend at least 5 seconds to turn off the optional trackers that the platform offers you to connect.
Google now transfers information about users to hundreds of companies around the world, and at least 16 of them are Russian.
If neither regulators, nor consumers, nor publishers, nor advertisers, nor – most importantly – platforms, can monitor exactly what happens to user data and where it is sent, then are privacy and transparency really the basic principles of the work of advertising services, as Google and Meta claim?