As part of our new report on RTB as a security threat and previously unreported, we reveal 'Patternz', a private mass surveillance system that harvests digital advertising data on behalf of 'national security agencies'.
5 billion user profiles, data from 87 adtech firms. Thread:
'Patternz' in the report by @johnnyryan and me published today:
Patternz is operated by a company based in Israel and/or Singapore. I came across it some time ago, received internal docs. Two docs are available online.
Here's how Patternz can be used to track and profile individuals, their location history, home address, interests, information about 'people nearby', 'co-workers' and even 'family members', according to information available online:
Most of today's digital advertising is based on real-time bidding (RTB) which involves uncontrolled data flows to many entities who bid on user profiles.
Patternz states its system is "built on the extensive knowhow of operating a Realtime bidding platform for the last 5 years".
Patternz claims to operate a "fully commercial and operational AdTech arm that actually trades in media" to obtain RTB data from 87 ad exchanges and SSPs.
An earlier version of its website named Google, Yahoo and adtech firms like MoPub, AdColony and OpenX as data sources.
According to the source linked above, the Patternz system is sold by ISA Security, an Israeli firm.
Here's another publicly available doc from Sovereign Systems, a Singapore-based firm with offices in UAE, New Zealand and Ireland:
Patternz claims to operate "6 data centers around the world" for real-time data collection.
I've seen internal Patternz docs which describe the IAB's OpenRTB protocol in digital advertising in detail. They also explain that the smartphone became a 'de-facto tracking bracelet'.
Although we cannot verify the claims, the documents suggest that Patternz turns the intrusive global surveillance infrastructure that has been built to serve digital advertising into a system for mass+targeted surveillance for national security agencies and perhaps other actors.
I think it's the best-documented example of how personal data that is routinely processed to provide consumer services and enable digital advertising is exploited for completely unrelated purposes at scale.
The commercial data industry, publishers and advertisers are complicit.
Whenever someone visits a website or uses a mobile app that displays digital ads, profile data is broadcasted to dozens or hundreds of companies and other entities.
This occurs billions and billions of times a day. Billions of people are affected, hundreds of millions in Europe.
It was a deliberate decision to create the RTB system in this way, and even worse, to delay GDPR enforcement and lobby hard against criticism for years.
Thousands of adtech firms and myriads of publishers and advertisers have no control over who they share personal data with.
As such, the digital advertising industry, and specifically Google and the IAB, enable the worst possible kind of decontextualized misuse of everyone's personal information.
Of course, it's ridiculous to believe that only 'Western' state actors would access RTB bidstream data.
When they have no control over who they share data with they cannot have a legal basis to do so under the GDPR.
GDPR enforcement is broken. Otherwise, uncontrolled personal data sharing via the RTB bidstream would have been shut down years ago. Regulators must take action now.
RTB does not only undermine the rights of hundreds of millions of Europeans and trust into digital tech at large, but is also a national security threat.
In our report published today we call for the European Commission, ENISA and EEAS to take action: iccl.ie/wp-content/upl…
To my knowledge, this 2020 Forbes article provided evidence for the first time that a firm who sells surveillance tech to governments was running its own DSP to harvest personal data from RTB bid requests in digital advertising. Not much detail, though:
This recent Bloomberg article provided more detail about Rayzone, a shady surveillance vendor that reportedly acquired data from the RTB bidstream by operating a DSP and directly owns two adtech firms (, ): impulsedsp.com oxillon.com bloomberg.com/news/articles/…
This recent WSJ article by @ByronTau found that a shady consumer data broker accessed bidstream data via SSPs and ad exchanges like OpenX, AdColony and Smaato and sold it to surveillance contractors who sold it to US defense/intel agencies:
This Haaretz investigation addresses a number of firms that exploit advertising data for surveillance purposes and for targeted attacks on devices.
The article states that some surveillance firms are 'connected to ad firms' or even 'operate an ad firm': haaretz.com/israel-news/20…
Ok, received a tip. It appears that 'Patternz' is closely affiliated or even identical to NUVIAD, an adtech firm, DSP and consumer data broker based in Israel.
As of today, Google lists Nuviad as a vendor "eligible to receive bid requests compliant with US states privacy laws": support.google.com/adsense/answer…
Btw. Patternz does not only offer monitoring based on advertising data, but also targeted attacks by sending "targeted messages, ads or trojans directly through the AdTech stack".
And, these 'profile keywords' and 'hobbies and interests' sections may refer to RTB segment info.
Some more pointers.
In 2017, the president of NUVIAD joined the board of Ability Inc. (), a spytech/surveillance firm specializing in tapping phones via SS7 (), which soon went down (employee arrests, NASDAQ delisting) /cc @iblametomsec.gov/Archives/edgar… forbes.com/sites/thomasbr…
@iblametom The CEO of the Singapore-based firm Sovereign Systems, who sells Patternz according to its website, is quoted to have said that Sovereign Systems was a "front" for PICSIX (), an Israeli firm that sells all kinds of surveillance tech. haaretz.com/world-news/asi… pic-six.com
Xandr/Microsoft also lists Nuviad as a "partner which may receive Platform Data":
Investigative journalist? Would be great to get more solid evidence on who operates Patternz, links to other firms (spytech/adtech/Nuviad), resellers, clients.
You have insights into Nuviad or other firms (adtech, 'adint')? Reach out to trustworthy journalists, e.g. @josephfcox
Another public source confirms that Nuviad, the digital advertising firm, and Patternz, the secretive global mass surveillance tool, are identical.
In this video, Rafi Ton, the CEO of the adtech firm Nuviad, introduces himself as the 'CEO of Patternz':
The video includes a Patternz demo. An archived version should be soon available here:
It seems to be a sales pitch to a Peruvian firm and the government for covid tracking but it also addresses 'homeland security'.
Weird that this is publicly available.
There's talk about Peru's 'state of emergency' (2020/21/22?) and its military as a potential client.
The Patternz/Nuviad CEO also states that the Israeli 'security forces' were 'running' the platform, and an 'East European' country even linked Patternz with mobile operator data.
According to the video, Patternz was originally 'designed and built' as a 'homeland security platform', for 'anti-riot and protesting'.
The system also shows apps which the location/profile data comes from. As behaviors from >100k apps are analyzed, it cannot be mobile SDK data.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Some more findings from our investigation of LiveRamp's ID graph system (), which maintains identity records about entire populations in many countries, including name, address, email and phone, and aims to link these records with all kinds of digital IDs:crackedlabs.org/en/identity-su…
Identity data might seem boring, but if a company knows all kinds of identifying info about everyone, from home address to email to device IDs, it is in a powerful position to recognize persons and link profile data scattered across many databases, and this is what LiveRamp does.
LiveRamp aims to provide clients with the ability to recognize a person who left some digital trace in one context as the same person who later left some trace elsewhere.
It has built a sophisticated system to do this, no matter how comprehensive it can recognize the person.
, a 'social risk intelligence platform' that provides digital profiles about named individuals regarding financial strain, food insecurity, housing instability etc for healthcare purposes.
"It calculates risk scores for each risk domain for each person", according to the promotional video, and offers "clarity and granularity for the entire US".
Not redlining, though. They color it green.
Making decisions based on these metrics about individuals and groups seems to be highly questionable and irresponsible bs.
Bazze, a US data broker that purchases smartphone location data from mobile apps and advertising firms, and sells to the US Dept of Defense, according to the WSJ (), openly promotes a commercial location mass surveillance system for 'government customers'. wsj.com/tech/cybersecu…
I extracted information about mobile location data they claim to sell per country from their website:
New WSJ report found that 'Near', a consumer data broker based in India, Singapore and the US with an office in France, obtained massive location data via digital advertising firms like OpenX, Smaato and AdColony and sold it to US defense/intel agencies: wsj.com/tech/cybersecu…
Near's general counsel and chief privacy officer:
The US govt "gets our illegal EU data twice per day", a "massive illegal data dump".
"We sell geolocation data for which we do not have consent to do so", "we sell data outside the EU for which we do not have consent to do so"
If this isn't reason for EU data protection authorities to take urgent action than I don't know what is.
Yesterday, I published a case study that examines enterprise software for process mining, workflow automation and algorithmic management.
I identified a list of mechanisms that involve personal data processing and can affect workers individually (right) or collectively (center).
I guess rarely anyone has ever examined this kind of software at such a level of detail, from a worker perspective.
The case study explores how employers can exploit worker data based on enterprise software docs. The chart is an excerpt from section 7: crackedlabs.org/en/data-work/p…
The case study is largely based on an analysis of enterprise software docs from a single vendor and its partners, which has its limitations. It's the third in a series of case studies, which are part of a larger project that aims to map how employers use personal data on workers.
NEW by me: "Monitoring Work and Automating Task Allocation in Retail and Hospitality"
A case study on software systems and technologies for worker surveillance, performance monitoring and algorithmic management in retail stores, restaurants and hotels: crackedlabs.org/en/data-work/p…
…the second in a series of case studies, which are part of a larger project that aims to maps how companies use personal data on (and against) workers in Europe, led by Cracked Labs, together with @algorithmwatch, @JeremiasPrassl, @UNI_Europa, funded by Austrian @Arbeiterkammer.
This case study examines how retailers, restaurants and hotels can use digital technology to direct, monitor and control work carried out by cashiers, salespersons, shelf stockers, servers, kitchen workers, hotel room attendants and other service workers.
https://t.co/c6ibV7ElxAcrackedlabs.org/en/data-work/p…