For years I’ve noted that while Elon Musk’s low-Earth-orbit (LEO) Starlink satellite broadband system can be very useful for people with no other options (war zones, RVs, boats, rural Americans), the network has struggled to maintain performance as it grows into more mainstream markets, resulting in not only widespread slowdowns, but also the company socking users with massive “congestion surcharges.”

These surcharges are actively designed to deter use because the network is struggling to handle the load. They started at around $100 a few years ago, then jumped to $750. Then suddenly $1500. And because Musk’s companies historically don’t invest in customer service, calling up to complain doesn’t really help.

Now Musk’s Starlink has jumped on the “dynamic pricing” trend, charging users more money in more congested markets, and ideally less money in less congested areas. But since companies aren’t keen to charge you less and lose money historically, the shift toward such pricing (especially in telecom) generally always involves most people paying more:

“The Missouri-based Reddit user who received the email said their Residential 100 Mbps plan is increasing from $50 per month to $60.50, effective in their next billing cycle on or after Nov. 30. Another user on Facebook, also in Missouri, reported their Residential Max plan increasing to $156 per month, up from $130.”

Many of the users seeing new dynamic pricing increases had just seen price hikes, as Starlink increasingly raises prices and imposes annoying new restrictions on usage. Because we’ve gutted our telecom consumer protection regulators (you know, for innovation), there’s really nobody left to ensure that Starlink’s calculations are consistent or fair.

Last year, a study from researchers at X-Lab showed that Starlink struggles to manage the load as the network grows, making it ill-suited as serious game changer for U.S. access. So as the network scales up, Starlink will be forced to impose more and more limits and restrictions on usage to ensure that most people have an acceptable experience. The laws of physics are kind of annoying like that.

That a niche broadband option gets congestion normally wouldn’t be that big of a deal; the problem is Trump Republicans have hijacked and retooled the $42.5 billion infrastructure bill broadband grant program to throw what could be billions of dollars — and millions of new customers — at Musk’s Starlink as a personal favor to one of the U.S. president’s biggest donors.

This is, to be clear, immense taxpayer subsidization for a satellite network Musk planned to deploy anyway without subsidies. As front-line cheerleaders in the cult of Musk, Republicans genuinely believe that Starlink is akin to some sort of connectivity magic — and can just be sprinkled around generously to quickly fix the entirety of U.S. connectivity woes. It doesn’t work that way.

Musk’s fraud-riddled SpaceX IPO prospectus “predicts” that Starlink is going to quickly grow from its current 13.6 million subscribers to something more akin to 300 million. But the service simply isn’t capable of scaling in this way; and the company’s purported push into trying to compete with cellular wireless with small femtocells is broadly being maligned as a very costly mess (one telecom analyst recently stated it was “one of the top three dumbest ideas in my four decades of being in this industry“).

Musk’s own erratic and treasonous behavior is also heavily incentivizing more LEO competitors to come to market, which will also erode per-subscriber revenues in the years to come as the company is finally forced to try and take pricing seriously.

In the interim, as federally-subsidized users are driven toward Starlink as an illusory quick fix for the U.S. digital divide, the congestion, price hike, and capacity issues will only get worse. And that’s not great news for a country where broadband affordability continues to be the biggest impediment to adoption, and the federal government has completely abandoned any pretense of caring.

The midterms are over and the Republicans got their asses waxed. We can point to any number of reasons why the country delivered a stinging rebuke to the GOP across the union. It was a slap to Donald Trump. It was about the economy. It was the war in Iran. It was all of the ICE antics as they cosplayed as the Gestapo in major American cities.

All of those are, to one degree or another, true. You don’t get this kind of result without a panoply of valid complaints about the party in power. But part of what occurred is also a repudiation of many MAHA movement leaders that were in government.

Tuesday was a particularly brutal night for MAHA Republicans in Iowa, where several Kennedy-backed candidates were swept up in the seismic blue wave.

Republican Iowa gubernatorial candidate Zach Lahn, who shared Kennedy’s concerns about pesticides in farming, lost to Democratic State Auditor Rob Sand on Tuesday. At a campaign rally last week, Kennedy described Lahn’s race as “the most important election going on in this country.”

The names keep piling up from there.

Iowa Reps. Mariannette Miller-Meeks and Zach Nunn, both of whom Kennedy campaigned for, also lost their re-election bids as Democrats flipped dozens of House seats. Another MAHA advocate and Kennedy pick, Joe Mitchell, lost his Iowa House race to Democratic opponent Lindsay James. The seat is being vacated by Ashley Hinson, who was among several Republican Senate candidates to lose their races in red states on Tuesday.

And, tangentially, one of the most stunning upsets of the midterms, in which Dr. Annie Andrews defeated Darline Graham, the late Lindsay Graham’s sister and handpicked Trump candidate, primarily came about because of RFK Jr.

“The day that RFK Jr. was nominated to lead HHS was the day that I really seriously started considering running for this seat,” Andrews told The New Republic in July.

“RFK Jr. has been my professional archnemesis for decades, and there are thousands of pediatricians across the country who would say the same thing.”

To be clear, nobody is claiming that opposition to Kennedy or the MAHA movement is why all of these candidates, and others, lost their races. It also isn’t some primary reason for the election results overall.

But Kennedy and MAHA was embraced by Trump because they were supposed to be a differentiator on the political landscape. Kennedy was no MAGA Republican before joining the administration. Far from it. And the MAHA movement is in many ways apolitical. The theory was that both would bring independents, and even some Democrats, into the GOP voting bloc.

As we now know, that didn’t happen. And it makes Kennedy’s continued presence in Trump’s cabinet fairly pointless.

Ctrl-Alt-Speech is a weekly podcast about the latest news in online speech, from Mike Masnick and Everything in Moderation‘s Ben Whitelaw.

Subscribe now on Apple Podcasts, Overcast, Spotify, Pocket Casts, YouTube, or your podcast app of choice — or go straight to the RSS feed. To get extended episodes with additional coverage, support us on Patreon.

In this special bonus episode for our Patreon supporters, Mike and Ben share their reactions to The Social Reckoning, Aaron Sorkin’s much anticipated (but it seems not much loved) followup to his acclaimed 2010 movie The Social Network. 

This free teaser covers the beginning of their conversation, but there’s much more in the full episode. Become a Ctrl-Alt-Speech supporter on Patreon to hear the whole thing, and to get extended episodes of the regular podcast every Thursday.

Also be sure to check out our recent regular episode with guest co-host Jeff Horwitz, whose reporting on the Facebook Files was a driving force of the story, where he shares some of his own reactions to the movie and being portrayed by Jeremy Allen White.

Follow us on Instagram, YouTube, and Bluesky!

If you’re already a Patreon supporter, you can get the extended episode on Patreon.

Recently, two federal appeals courts issued opinions that will allow Florida and Georgia to start enforcing laws that will age-gate and block young people from accessing social media. The laws do not adequately respect minors’ rights to play, speak, and learn online. More fundamentally, these laws don’t help young people stay safe online—a goal that lawmakers should pursue.

Because of the new laws, some young people will lose their ability to access lawful information, find their online communities, and even engage with school board members. Others will need parental permission to stay online. And adults will face increased demands to prove their age, which will put their privacy at increased risk simply to continue to use the services they already use. 

We opposed these laws because they threaten the free expression and privacy of both minors and adults.  Even though these lawsuits are not over, the injunctions that paused enforcement have been lifted, and the states of Florida and Georgia will now be able to enforce broad restrictions on social media use. 

The restrictions that these states will start enforcing are a setback for the rights of all internet users, but they are not written in stone. That’s why EFF is encouraging internet users – and particularly young people – to start keeping a record of how they are affected. If you are a teenager who loses access to an online discussion, can’t participate in a political campaign, or stop seeking information because you don’t want to upload personal information, document what happened. The same is true for adults who may be mistakenly blocked by age checks, and parents who may encounter obstacles to authorizing their children’s use of online services. These experiences matter. They can help us show courts, policymakers, and the public what government restrictions on online expression actually cost the people who live under them. 

Hopefully, with enough proof of the expressive harms these laws cause, we can push lawmakers to rescind them. That’s why we’re encouraging folks to reach out to EFF once they’ve documented these harms. You can write to us about this issue at the email address agegates@eff.org. 

The Decisions

These two opinions, issued by the same panel from the U.S. Court of Appeals for the 11th Circuit, allow Florida and Georgia to enforce restrictions on social media accounts for people under 16 years old. The requirements differ by state. 

In Florida, the judges allowed that state’s H.B. 3 to move forward, which requires covered platforms to ban anyone under 14 from opening or keeping accounts—even with parental permission. Teenagers who are 14 or 15 can have accounts only with parental consent. To be covered, a platform has to use algorithms, allow content uploads or the viewing of other peoples’ content, and have at least one feature on a list of features the state considers bad, including livestreaming, engagement metrics, autoplay, infinite scrolling, or push notifications. These requirements effectively apply to every major social media service that young people use.

To the extent there is a silver lining in the ruling on Florida’s law, it’s that the panel recognized that H.B. 3 targets expression protected by the First Amendment. The problem is that the ruling uncritically accepts the idea that a social media service is addictive in a clinical sense, even if just 10% of users under 16 are using the platform for two or more hours per day (the standard set in H.B. 3). The court simply accepts that time spent online is a proxy for harm. The bill doesn’t distinguish doomscrolling or compulsive use from organizing a campaign, making art, or talking with friends. 

In Georgia, S.B. 351 can now be enforced. That law requires parental consent for anyone under 16 to hold an account on social media platforms. It also requires platforms to make “commercially reasonable efforts” to check users’ ages, which creates a hurdle for adults as well as under-16s. 

The ruling acknowledges that S.B. 351 “overwhelmingly applies to platforms that overwhelmingly host protected speech.” But the ruling faults the plaintiffs for not being able to show that “invalid applications substantially outweigh the valid ones.” That asks the groups challenging the law to meet a virtually impossible standard—to make their case, they would have to measure and evaluate the content hosted by all online services affected by the law. 

Both of these cases may be further appealed, and are likely to continue in the lower courts. But people in Georgia and Florida can no longer count on court injunctions to protect their access to the web. What the effects will be going forward depends on how platforms implement these new restrictions, including how they check ages and parental consent, as well as state officials’ views on these efforts. 

If you hit an age-gate while online, check out our blog post about how you might want to proceed, and our age-gating resource hub. If you want to speak out about your experience, you can talk to us at agegates@eff.org.

What is Lost

Some youth who lose their social media accounts will lose contact with friends. Others will lose access to a support group, the ability to speak out on current issues, or an audience for their artwork. More young people will be shut out of discussions about what’s going on in their school and their community. U.S. law has long recognized that people under 18 have their own rights to speak and receive information. These new laws interfere with those rights. 

The Florida opinion suggests that young people can browse the internet without an account, or use a parent’s account. But that doesn’t help those who might participate in a private group, send a personal message, or speak to an audience they have built up. Nor does it recognize the reality that in many households, young people may not have the ability to use a parent’s device, or even have healthy relationships with their parents. For parents of children under 14, the Florida law also overrides parental autonomy—even if parents wanted to allow their child on these services, they cannot do so by law. 

These laws won’t just harm younger kids. Adults and older teens will bear the cost of the new rules. In order to figure out who is young enough to not be able to join, or who needs parental consent to join, services will have to check users’ ages. That likely means asking people to submit ID or other sensitive information. Some people will be mis-classified as too young; others will decide that they’d simply rather stop participating instead of handing over even more personal data. 

Keep A Record

Between the recent Meta settlement and these 11th Circuit decisions, despite widespread opposition, age-gating is becoming a reality for the American internet. As these laws are enforced, we need to understand what they mean for the people who have to deal with them. And we need to create a record of their effects on everyone’s speech so we can push to repeal them.

If you encounter a restriction due to these laws that affects you, keep a record, ideally while the details are still fresh in your mind. Screenshots, along with notes about the date and time, the service involved, and the task you were trying to accomplish, will all be helpful. 

Did you lose an account or can’t participate? Describe what you lost. Were you using a group to organize a club, volunteer in your community, or keep in touch with friends? Did losing your account cut you off from people you wouldn’t otherwise be able to be in touch with? Even if you just used the account to access local news or follow your favorite content creator, that’s still a significant loss of your right to access information online.

Record problems with age checks and parental consent. What information did the service request from you? Were you able to provide it? Did it reject your age proof, or classify you incorrectly? If you’re a parent, were you able to give permission, and what did you have to provide? What promises did the service make about what it did with the data it collected from you? Save explanations given by the platforms or any services they employ to age gate, including any law they cite. If you are to appeal a result and choose to, keep track of those attempts as well. 

You can also document choosing to drop out. If you abandon an account or service because you’re unwilling to provide ID or other personal data, write down what you gave up, and why. You don’t need to submit sensitive information to show that you are burdened by new rules. 

You Can E-Mail agegates@eff.org

If these restrictions affect you, we encourage you to reach out to EFF by emailing agegated@eff.org and telling us more about what happened. 

EFF will continue to oppose laws that prevent adults and minors from expressing themselves online, or that push people to give up their privacy to participate in the digital world. These recent court decisions are setbacks, but they don’t settle the debate. By keeping track of people who lose access, age-check failures, and the online conversations that can no longer happen, we’ll be in a better position to challenge the worst of these restrictions, in both legislatures and courts. 

And in the meantime, EFF will keep fighting for laws that actually make us safer online—like stopping social media companies’  harmful surveillance of all internet users. We’ll continue to push for laws that empower parents, children, and all internet users to have meaningful choice and control over their online services. Those goals can make everyone safer online, while preserving our ability to speak and access information. 

Republished from the EFF’s Deeplinks blog.

We all know ICE officers can’t be trusted. Neither can the agency that heads up most of Trump’s anti-migrant activities. Every murder by immigration officers is immediately greeted with self-justifying lies about “threats” to officers. Every assault gets the same treatment. Every recorded instance of abuse is immediately rebutted by bullshit claims about violent resistance or, at the very least, that any actions the officers took were justified because the person deserved to be arrested.

The DOJ has been dangling by several threads for months now. Federal court judges have made the point (repeatedly!) that it can no longer trust the government to be acting in good faith. The “presumption of regularity” — the ideal that states that both sides of a court case are doing their honest best under the law — is no longer a privilege the DOJ can expect to avail itself of.

It gets so much worse when the topic shifts to Trump’s mass deportation programs. The government has renditioned people to torture prisons in foreign countries, actively dodged court orders with late-night flights and other fuckery, eliminated due process for migrants by both misquoting the law and shuffling detainees from prison camp to prison camp to ensure they’ll never have standing to sue due to filing a lawsuit in the “wrong” jurisdiction.

ICE has done more than most to earn the distrust of federal courts. It’s something that begins with the masks and the refusal to properly identify themselves and ends with the lies officers put in their reports and, on rare occasions, repeat in court when asked to testify.

A federal judge in Oregon (Mustafa T. Kasubhai) is sick of this shit. Whether or not his personal sickness will infect the rest of the court system remains to be seen, but at least he’s doing everything he can to talk other courts into treating ICE officers as inherently unreliable witnesses. (h/t Kyle Cheney)

This order [PDF], handed down in a case involving a violation of a previous court order forbidding warrantless arrests by ICE officers in Oregon, gets right to the point in the opening paragraphs, saying what needs to be said about ICE and its officers:

An ICE officer fabricated facts in official records to justify an arrest. This Court knows this because at an evidentiary hearing on Plaintiffs’ Motion to Enforce Preliminary Injunction, he testified under oath that what he wrote in the official records of the arrest were incorrect. On the witness stand he minimized the error as mere oversight. This Court found he lied after evaluating his live testimony and the documentary evidence.

Evaluating live testimony is a time-tested method for truth finding. Written declarations are convenient, but insufficient on their own when witnesses are willing to lie. This enforcement action is a powerful reminder of two principles.

First, uncovering truth is not a passive activity. Developing a robust evidentiary record
worthy of telling the story of what really happened can never fully materialize from a stack ofsigned written statements. Live testimony is necessary. Examination and cross-examination are necessary. The trial courts are the uniquely specialized forum in which building a full evidentiary record is possible.

Second, this case underscores what happens if people were not called to testify under oath in a courtroom, if as a society we do not demand that government agents explain their actions, and if the public fails to shine a spotlight on what is happening under cover—people with authority know they will not be held to account.

What follows are multiple examples of the lies told by ICE officers to justify warrantless arrests they had already been forbidden to perform. How did the court determine this? By putting officers on the stand and forcing them to talk their way out of their web of lies — something that rarely happened.

CIP #1:

Based on the substance of H-D-G-H-’s testimony and his demeanor, the Court finds that
H-D-G-H-’s account is credible and that Officer J.G.’s testimony is false.

[…]

The I-213 for H-D-G-H-’s arrest describes a series of events that Officer J.G. now admits
never occurred.

Featured in this testimony as well: ICE stating it performed only 13 warrantless arrests, despite performing 504 “non-custodial” arrests, which were exactly the sort of arrests that tended to be warrantless and led to the injunction blocking these arrests, which ICE apparently chose to ignore. Also: the officer testifying that he and his fellow officers kept a bunch I-200 forms in their vehicles, with “pre-printed probable cause determinations[s]” on them, apparently in order to expedite warrantless arrests.

In another case, ICE officers claimed that a warrant for which a migrant had already been arrested, detained, and released justified their own warrantless arrest. That claim again results in the ignition of righteous anger from the judge:

The 2023 warrant states that an ICE officer served the warrant on J-C-C-V- in McAllen,Texas, on April 25, 2023. ICE detained J-C-C-V- for eight days in 2023. Now, Defendants contend that the same warrant would have permitted officers to rearrest J-C-C-V- in 2026. Under 8 U.S.C. § 1226(b), the Attorney General can rearrest individuals based on previously executed warrants.

However, a key detail Defendants ignore is the Attorney General must first “revoke a bond or parole” before rearresting. 8 U.S.C. § 1226(b). Defendants presented no evidence of revocation. Instead, Defendants argue through their counsel, that the I-213 form for J-C-C-V- “indicates there was an intention to revoke the bond or parole.” Tr. 250. Intention does not constitute revocation, and the Court admonishes counsel that they are expected to make good faith arguments as officers of the court. Real people’s lives and liberties are at stake and they should remember that. Evidentiary hearings are not first-year law school examinations where one can score points with a scattershot strategy.

From there, the court moves on to point out how absolutely necessary it is to put officers on the stand, especially when the government has repeatedly shown it is not to be trusted.

The more insidious problems with Defendants’ documentation are the errors not apparenton the face of the documents. For example, and as discussed above in greater detail, Officer J.G. testified during the evidentiary hearing that the I-213 for H-D-G-H- failed to accurately describe the circumstances of H-D-G-H-’s arrest. Tr. 163. Officer J.G. lied in the I-213 by copying the language that he wrote in the report for driver M-T-M-, the initial target of Officer J.G.’s investigation. Tr. 163; Pls.’ Ex. 112. Anyone reading the I-213 for H-D-G-H- would believe that
Officer J.G. had identified H-D-G-H- before conducting the investigatory stop, yet Officer J.G. admitted that he had no idea who H-D-G-H- was or that H-D-G-H- was even in the car until after
the stop occurred. Tr. 163. Had this Court not conducted an evidentiary hearing, and had OfficerJ.G. never testified, Officer J.G.’s falsification of H-D-G-H-’s I-213 form would have been left unchallenged and never corrected.

That’s the damage done by just a single warrantless arrest that federal officers lied about in both the initial report and while testifying in court. There’s more in the order, but this is how it’s all summed up:

The presumption of regularity directs the courts to assume, unless clear evidence indicates differently, that government officials have properly discharged their duties, acted in good faith and followed required procedures. This presumption no longer holds for Defendants. The evidence in this case proves as much.

That points directly back to the opening paragraphs of the decision. This court is stating plainly that the government cannot be taken at its word. Since that’s the new normal, courts need to respond by putting as many ICE officers on the stand as possible during cases like these. What was seen here will be seen elsewhere: that when officers are ordered to explain the deficiencies in their warrants, narratives, or whatever else, they’re going to expose themselves for the liars they are. And if they aren’t actually lying, that much will be made apparent through direct testimony and cross-examination. Allowing the government to get away with lying by refusing to challenge the boilerplate just makes things worse for Americans and better for the bitter, bigoted facists who think they should just be able to get away with all of this.

Take your design skills to the next level with the 2026 Canva Creator Mastery Course. This program teaches you how to use Canva effectively to produce professional-quality visuals for any purpose. You’ll explore practical design techniques, creative workflows and branding strategies that make your content stand out. It removes the complexity of design and replaces it with simple, actionable steps. With hands-on learning, you’ll quickly gain the ability to create scroll-stopping graphics for any platform. This bundle is perfect for anyone ready to upgrade their digital presence and design skills. The course is available to new and existing users of Canva for $30.

Note: The Techdirt Deals Store is powered and curated by StackSocial. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Well it’s now been a couple days since the Democrats obliterated Donald Trump and MAGA in the midterm. It turns out that the messaging of “price hikes, soldiers in the street, new forever wars, and diarrhea for everyone, with a side of enriching the rich while protecting pedophiles” somehow failed to resonate. Which is how you end up with absolutely historic midterm results.

As happens after every election, no matter how narrow or lopsided, lots of people rush in to explain how it proves their own pet worldview. I’m not going to do that because I don’t think a single election can ever show any long term support for any particular worldview, and most elections are decided by a variety of factors, mostly based on the vibe of “do I think things are heading in the right direction or wrong direction” which is a very subjective thing.

But, I will note that for those who bought into the MAGA gains of 2024 as some sort of permanent shift in the American outlook, you played yourself. And I will highlight specifically those goons (mostly among the VC and tech billionaire class) who seemed to assume that this was an invitation to go all in on supporting fascism.

We warned you.

Last year, in a post called Fascism for First Time Founders, I pointed out to the tech bros embracing MAGA-style fascism in the short-sighted belief that this was their moment to become the permanent overlords of the tech world… that it would not end well. Fascism never does. And as for the idea that Silicon Valley as a whole (beyond the VC bro / tech bro set) had gone all MAGA, well:

Of course, there is still likely to be a real reckoning for all the tech companies that cozied up to Trump, thinking that donating to his ballroom or suddenly deciding to call AI “Super Intelligence” because Trump said so, would somehow set them up to be the new leaders of the next tech revolution. And it would have been nice if the bozos with billions had thought literally any of this through. I mean, they have these AI tools now, couldn’t they have asked them how this might play out?

But, no, the billionaire tech bros decided this was their chance to go all in for fascism, and now the entire tech industry will almost certainly pay the regulatory price.

Though, arguably, after all the handwringing about Mark Zuckerberg, Elon Musk, Jeff Bezos, Marc Andreessen, and Peter Thiel “putting their thumbs on the scales” for Trumpian fascism, the fact that their side still got walloped this badly — even with all the money they spent as well — suggests their power to manipulate minds through their platforms isn’t nearly as strong as some commenters make out.

My fear is that the good parts of the internet — the parts that empower individuals against billionaire control — get destroyed as collateral damage by those in power who will now seek (understandably) to exact revenge on the billionaire tech bros who took their shot at becoming new fascist overlords and missed. Knocking them all down a peg should be the goal, and the way to do that is by backing decentralized, user-controlled tools. We can take away their power by giving it to the actual users of the internet.

That means we should avoid tech policies that “punish” big tech companies in a way that just inherently gives them more power and more control over our lives. The “easy” path is “regulating” social media and AI, but done badly (like most current proposals) and in a way that actually gives those jackasses more power by making sure that only they and their giant bank accounts can afford to comply. Instead, we need policies that make it more difficult for big tech to have so much control over our lives. Keep Section 230 strong (which protects small forums and internet users way more than the giants). Fix the DMCA 1201 and the CFAA, both of which big tech companies keep using to try to stifle competition. While we’re at it, we can still do more to fix patent law to prevent troll lawsuits that harm competition. And make sure that decentralized offerings — in both social media and AI — can actually function without needing government sign-off on every move, even when the real goal of a regulation is to hamstring the giants.

Now I know that there are some who worked at the big companies who got in line behind Trump, saying some variation on “we needed to do so just to keep our business going,” and that is, indeed, different than those (listed above) who seemed positively eager to support and promote Trump’s MAGA agenda. But to me that’s little excuse. Have a backbone. Stand up for what’s right. Isn’t that what “free thinkers” in the wild west of the tech world keep claiming is so important?

Anyway, there’s no doubt that a reckoning is coming to Silicon Valley and the tech bros who tried to use the last two years in pursuit of a technocratic fascist network state. And they totally deserve it. But it would be nice if we didn’t take down the rest of the internet — especially the parts that actually are empowering to users — with it.

Israeli spy outfit Discover-Tech spied on internet users through a sprawling network of dodgy online ads ​that it used to track, surveil, and geolocate internet users. In some instances simply having the firm’s “zero click” spyware ads displayed by devices resulted in infection. The company seemed particularly interested in using ads to surveil and geolocate Starlink users, according to a new Reuters report:

“Researchers at TrendAI, a unit of Tokyo-based cybersecurity company Trend Micro (4704.T)
, opens new tab, ‌concluded the Israeli company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX’s Starlink service and that the ads were likely being used to geolocate or otherwise surveil them, according to the six people.”

For some reason TrendAI and Trend Micro originally didn’t formally name Discover-Tech; something only disclosed after follow up reports by both Citizen Lab and New York ad security firm Confiant. According to Citizen Lab, Discover-Tech posed as a legitimate vendor on ad exchanges, but was really just a proxy for outfits like Israel’s Candiru — a spyware company blacklisted by the U.S. government.

Being broadly declared as “certified” and “approved” by unregulated establishment ad vendors and markets allowed Discover-Tech to target people with zero-click malware across more than 120,000 websites and 75,000 apps.

“The totality of information gleaned from ad auctions is quite valuable. A company with access to auction data can track users without their knowledge as they move around in physical space, or switch between cellular, Wi-Fi, and VPNs, by observing how bid requests tied to a specific identifier change location or IP address over time. In fact, the surveillance industry sells access to so-called ad intelligence (ADINT) platforms that leverage this sort of data, often combined with third-party tracking data. In recent years, several investigations and media reports have uncovered vendors that sell ADINT to defense, intelligence, and law enforcement agencies.”

Citizen Lab goes on to detail advancements in “zero click” ad-based malware, where simply having the ad displayed is enough to begin the infection process:

“Advertisers or DSPs may run HTML and JavaScript code when an ad is shown to the user. That code retrieves additional JavaScript code, which may, in turn, load further code, such as a browser exploit to install spyware. Since the code can contain identifiers for the user or their device, arbitrary JavaScript code can be sent precisely to a single user’s device. Our research in this report indicates that this architecture is indeed abused to facilitate the delivery of zero-click targeted spyware, and that the simple display of a targeted ad is enough for infection.”

Last May, Israeli newspaper Haaretz reported that numerous Israeli spyware vendors had begun specifically advertising their ability to locate and spy on Starlink users, of obvious importance in military conflicts in Ukraine.

We’ve noted repeatedly how the U.S. has failed to regulate data brokers and online ad markets for two primary reasons. One, the country is corrupt and repeatedly places online ad revenues above public safety, national security, and even the safety of U.S. troops. And two, the U.S. government also enjoys being able to bypass warrants by buying much of this unregulated data itself.

The end result is an ecosystem poised for widespread exploitation and abuse by a long parade of unethical predators. And despite decades of constant scandal, little seems to change. In fact, U.S. regulators under Trump have actively made life easier on these sorts of bad actors by rolling back even the more modest efforts to regulate online data brokers.