ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for The Big Story newsletter to get stories like this delivered to your inbox.
The day after Russia invaded Ukraine in February, Senate Intelligence Committee Chairman Mark Warner sent a letter to Google warning it to be on high alert for “the exploitation of your platform by Russia and Russian-related entities,” and calling on the company to review its advertising business for compliance with economic sanctions.
But as recently as June 23, Google was sharing potentially sensitive user data with a sanctioned Russian ad tech company owned by Russia’s largest state bank, according to a new report provided to ProPublica.
Google allowed RuTarget, a Russian company that helps brands and agencies buy digital ads, to access and store data about people browsing websites and apps in Ukraine and other parts of the world, according to a study by digital advertising analytics firm Adalytics. Adalytics identified nearly 700 instances of RuTarget receiving user data from Google after the company was added to a US Treasury list of sanctioned entities on February 24. Data sharing between Google and RuTarget ceased four months later on June 23, the day ProPublica contacted Google about the activity.
RuTarget, which also trades as Segmento, is owned by Sberbank, a Russian state bank that the Treasury described as “particularly important” to the country’s economy when it hit the lender with initial sanctions. RuTarget was later listed in an April 6 Treasury announcement that imposed full blocking sanctions on Sberbank and other Russian entities and individuals. The sanctions mean that US individuals and entities are not supposed to do business with RuTarget or Sberbank.
Of particular concern, the analysis showed that Google shared data with RuTarget about users browsing websites based in Ukraine. This means that Google may have provided critical information such as unique mobile phone identifiers, IP addresses, location information and details of user interests and online activity, data which according to the US senators and experts, could be used by Russian military and intelligence services to track people or zero in on places of interest.
Last April, a bipartisan group of U.S. senators sent a letter to Google and other major ad tech companies warning of the national security implications of data being shared as part of the ad buying process. digital. They said this user data “would be a gold mine for foreign intelligence services who could exploit it to inform and energize hacking, blackmail and influence campaigns”.
Google spokesman Michael Aciman said the company blocked RuTarget from using its advertising products in March and that RuTarget has not purchased ads directly through Google since then. He acknowledged that the Russian company still received user purchase and ad data from Google before being alerted by ProPublica and Adalytics.
“Google is committed to complying with all applicable sanctions and trade compliance laws,” Aciman said. “We have reviewed the entities in question and have taken appropriate enforcement action beyond the steps we took earlier this year to prevent them from directly using Google’s advertising products. »
Aciman said that this action is not only to prevent RuTarget from further accessing user data, but also from buying advertisements through third parties in Russia who cannot be sanctioned. He declined to say whether RuTarget purchased ads through Google’s systems using such third parties, and he did not comment on whether any data on Ukrainians was shared with RuTarget.
Krzysztof Franaszek, who runs Adalytics and authored the report, said RuTarget’s ability to access and store Google user data could open the door to serious potential abuse.
“As far as we know, they take this data and combine it with 20 other data sources they got from God knows where,” he said. “If RuTarget’s other data partners included the Russian government, intelligence services or cybercriminals, there is a huge danger. »
In a statement to ProPublica, Warner, a Democrat from Virginia, called Google’s failure to sever its relationship with RuTarget alarming.
“All companies have a responsibility to ensure that they do not inadvertently help fund or even support Vladimir Putin’s invasion of Ukraine. To hear that an American company mShared user data with a Russian company – owned by a sanctioned state bank no less – is incredibly alarming and frankly disappointing,” he said. “I urge all companies to examine their business operations from top to bottom to ensure that they are in no way supporting Putin’s war. »