ProPublica is a Pulitzer Prize-winning investigative newsroom. Join The Big Story newsletter to obtain tales like this one in your inbox.
The day after Russia’s February invasion of Ukraine, Senate Intelligence Committee Chairman Mark Warner despatched a letter to Google warning it to be on alert for “exploitation of your platform by Russia and Russian-linked entities,” and calling on the corporate to audit its promoting enterprise’s compliance with financial sanctions.
However as just lately as June 23, Google was sharing doubtlessly delicate consumer knowledge with a sanctioned Russian advert tech firm owned by Russia’s largest state financial institution, in response to a brand new report offered to ProPublica.
Google allowed RuTarget, a Russian firm that helps manufacturers and businesses purchase digital advertisements, to entry and retailer knowledge about folks searching web sites and apps in Ukraine and different components of the world, according to research from digital ad analysis firm Adalytics. Adalytics recognized near 700 examples of RuTarget receiving consumer knowledge from Google after the corporate was added to a US Treasury checklist of sanctioned entities on Feb. 24. The information sharing between Google and RuTarget stopped 4 months afterward June 23, the day ProPublica contacted Google concerning the exercise.
RuTarget, which additionally operates below the title Segmento, is owned by Sberbank, a Russian state financial institution that the Treasury described as “uniquely necessary” to the nation’s financial system when it hit the lender with preliminary sanctions. RuTarget was later listed in an April 6 Treasury announcement that imposed full blocking sanctions on Sberbank and different Russian entities and other people. The sanctions imply US people and entities will not be purported to conduct enterprise with RuTarget or Sberbank.
Of specific concern, the evaluation confirmed that Google shared knowledge with RuTarget about customers searching web sites primarily based in Ukraine. This implies Google might have turned over such vital info as distinctive cell phone IDs, IP addresses, location info, and particulars about customers’ pursuits and on-line exercise, knowledge that US senators and consultants say might be utilized by Russian army and intelligence providers to trace folks or zero in on areas of curiosity.
Final April, a bipartisan group of US senators despatched a letter to Google and different main advert expertise corporations warning of the nationwide safety implications of information shared as a part of the digital advert shopping for course of. They mentioned this consumer knowledge “could be a goldmine for international intelligence providers that would exploit it to tell and supercharge hacking, blackmail, and affect campaigns.”
Google spokesperson Michael Aciman mentioned that the corporate blocked RuTarget from utilizing its advert merchandise in March and that RuTarget has not bought advertisements immediately through Google since then. He acknowledged the Russian firm was nonetheless receiving consumer and advert shopping for knowledge from Google earlier than being alerted by ProPublica and Adalytics.
“Google is dedicated to complying with all relevant sanctions and commerce compliance legal guidelines,” Aciman mentioned. “We’ve reviewed the entities in query and have taken acceptable enforcement motion past the measures we took earlier this 12 months to dam them from immediately utilizing Google promoting merchandise.”
Aciman mentioned this motion contains not solely stopping RuTarget from additional accessing consumer knowledge, however from buying advertisements via third events in Russia that might not be sanctioned. He declined to say whether or not RuTarget had bought advertisements through Google methods utilizing such third events, and he didn’t touch upon whether or not knowledge about Ukrainians had been shared with RuTarget.
Krzysztof Franaszek, who runs Adalytics and authored the report, mentioned RuTarget’s capacity to entry and retailer consumer knowledge from Google may open the door to critical potential abuse.
“For all we all know they’re taking that knowledge and mixing it with 20 different knowledge sources they acquired from God is aware of the place,” he mentioned. “If RuTarget’s different knowledge companions included the Russian authorities or intelligence or cybercriminals, there’s a big hazard.”
In an announcement to ProPublica, Warner, a Virginia Democrat, referred to as Google’s failure to sever its relationship with RuTarget alarming.
“All corporations have a accountability to make sure that they aren’t serving to to fund and even inadvertently assist Vladimir Putin’s invasion of Ukraine. Listening to that an American firm could also be sharing consumer knowledge with a Russian firm—owned by a sanctioned, state-owned financial institution no much less—is extremely alarming and albeit disappointing,” he mentioned. “I urge all corporations to look at their enterprise operations from prime to backside to make sure that they aren’t supporting Putin’s struggle in any method.”