ProPublica is a Pulitzer Prize-winning investigative newsroom. Join The Big Story newsletter to obtain tales like this one in your inbox.
The day after Russia’s February invasion of Ukraine, Senate Intelligence Committee Chairman Mark Warner despatched a letter to Google warning it to be on alert for “exploitation of your platform by Russia and Russian-linked entities,” and calling on the corporate to audit its promoting enterprise’s compliance with financial sanctions.
However as lately as June 23, Google was sharing probably delicate consumer knowledge with a sanctioned Russian advert tech firm owned by Russia’s largest state financial institution, in accordance with a brand new report offered to ProPublica.
Google allowed RuTarget, a Russian firm that helps manufacturers and businesses purchase digital advertisements, to entry and retailer knowledge about individuals looking web sites and apps in Ukraine and different components of the world, according to research from digital ad analysis firm Adalytics. Adalytics recognized near 700 examples of RuTarget receiving consumer knowledge from Google after the corporate was added to a US Treasury listing of sanctioned entities on Feb. 24. The info sharing between Google and RuTarget stopped 4 months in a while June 23, the day ProPublica contacted Google concerning the exercise.
RuTarget, which additionally operates below the title Segmento, is owned by Sberbank, a Russian state financial institution that the Treasury described as “uniquely vital” to the nation’s financial system when it hit the lender with preliminary sanctions. RuTarget was later listed in an April 6 Treasury announcement that imposed full blocking sanctions on Sberbank and different Russian entities and other people. The sanctions imply US people and entities are usually not presupposed to conduct enterprise with RuTarget or Sberbank.
Of specific concern, the evaluation confirmed that Google shared knowledge with RuTarget about customers looking web sites based mostly in Ukraine. This implies Google could have turned over such important data as distinctive cell phone IDs, IP addresses, location data, and particulars about customers’ pursuits and on-line exercise, knowledge that US senators and specialists say may very well be utilized by Russian army and intelligence providers to trace individuals or zero in on areas of curiosity.
Final April, a bipartisan group of US senators despatched a letter to Google and different main advert expertise corporations warning of the nationwide safety implications of knowledge shared as a part of the digital advert shopping for course of. They mentioned this consumer knowledge “could be a goldmine for overseas intelligence providers that would exploit it to tell and supercharge hacking, blackmail, and affect campaigns.”
Google spokesperson Michael Aciman mentioned that the corporate blocked RuTarget from utilizing its advert merchandise in March and that RuTarget has not bought advertisements straight by way of Google since then. He acknowledged the Russian firm was nonetheless receiving consumer and advert shopping for knowledge from Google earlier than being alerted by ProPublica and Adalytics.
“Google is dedicated to complying with all relevant sanctions and commerce compliance legal guidelines,” Aciman mentioned. “We’ve reviewed the entities in query and have taken acceptable enforcement motion past the measures we took earlier this 12 months to dam them from straight utilizing Google promoting merchandise.”
Aciman mentioned this motion consists of not solely stopping RuTarget from additional accessing consumer knowledge, however from buying advertisements by way of third events in Russia that might not be sanctioned. He declined to say whether or not RuTarget had bought advertisements by way of Google techniques utilizing such third events, and he didn’t touch upon whether or not knowledge about Ukrainians had been shared with RuTarget.
Krzysztof Franaszek, who runs Adalytics and authored the report, mentioned RuTarget’s skill to entry and retailer consumer knowledge from Google may open the door to severe potential abuse.
“For all we all know they’re taking that knowledge and mixing it with 20 different knowledge sources they bought from God is aware of the place,” he mentioned. “If RuTarget’s different knowledge companions included the Russian authorities or intelligence or cybercriminals, there’s a large hazard.”
In an announcement to ProPublica, Warner, a Virginia Democrat, referred to as Google’s failure to sever its relationship with RuTarget alarming.
“All corporations have a accountability to make sure that they don’t seem to be serving to to fund and even inadvertently assist Vladimir Putin’s invasion of Ukraine. Listening to that an American firm could also be sharing consumer knowledge with a Russian firm—owned by a sanctioned, state-owned financial institution no much less—is extremely alarming and albeit disappointing,” he mentioned. “I urge all corporations to look at their enterprise operations from prime to backside to make sure that they don’t seem to be supporting Putin’s struggle in any manner.”