4 ms·

> This means Google may have turned over such critical information as unique mobile phone IDs, IP addresses, location information and details about users’ inter

> This means Google may have turned over such critical information as unique mobile phone IDs, IP addresses, location information and details about users’ interests and online activity Can someone help me to understand this? I thought Google kept this kind of user-preference (interests/activity) data to itself, and used that as the sauce powering its ad auctions. If you run a site, GA will give you IP, location, etc. for inbound traffic, but I didn't think they would give you data on other users. Does Google actually sell user preference data and IPs in bulk? What product are they referring to here?

jonny_eh 4y ago
> Google allowed RuTarget, a Russian company that helps brands and agencies buy digital ads, to access and store data about people browsing websites and apps in Ukraine and other parts of the world In other words, they collected data via websites and apps, just like any other JS or native ad library does. This wasn't data that Google collected, then handed over. It's a misleading headline IMO.
- amelius 4y ago
  Imagine a Russian agent starting an ad campaign targeted at Ukrainian people who are interested in weapon systems. But... the actual ads are about an innocent thing, like cat food. An Ukrainian clicks the cat food ad, is directed to the Russian agent's fake cat food shop, places an order and fills in their address. How is Google not leaking information here?
  - freeflight 4y ago
    The whole "Google is not selling your data" excuse never held up to practical reality, it was always only a semantics argument along the lines of "They sell it, but not directly!". This whole case exemplifies that very much, but it only garners attention due to who did it, Russia, not due to why and how this is actually possible.
    - theptip 4y ago
      I think it’s materially different though. Particularly when you contrast with the FB graph API and the Cambridge Analytica scandal where they were actually giving out the raw data. There is a LOT more you can do with the raw data than with ads targeted on specific categories. Like, I personally am never going to click the cat ad in the example above, but I very well could have had all my info leaked by a neighbor in my friend graph in the CA dump. So your ad-harvested data will always be sparse.
  - theptip 4y ago
    Is that even an AdWords category? Can we get more specific on exactly what level of targeting is possible? I see there is an attack here, but I’m still not exactly clear on the scope. I can’t see them getting very many conversions with a random cat food company. So did they dox 10 people? Or was this something that could actually get a meaningful amount of data?
- burkaman 4y ago
  The line you quoted is just a slight rephrasing of the headline with a little more detail. What are you finding misleading? Google allowed [a Sanctioned Russion Ad Company = RuTarget, a Russian company that helps brands and agencies buy digital ads], to [Harvest = access and store] [User Data = data about people browsing websites and apps]
yunohn 4y ago
> you run a site, GA will give you IP, location, etc. for inbound traffic, but I didn't think they would give you data on other users. This is not “provided” by Google. It’s normal web server traffic data, collected by Google Analytics instead of your own scripting.
theptip 4y ago
Ok, I found some answers. The original research is linked in the OP: https://adalytics.io/blog/sanctioned-ad-tech-user-data https://adalytics.io/blog/sanctioned-ad-tech-user-data -- this is much more informative than the ProPublica writeup. It includes a technical explanation of what's going on. Basically, the accusation is that a sanctioned Russian company is listed as an advertiser ("Demand Side Platform") on Google's real-time bidding platform for ads. This means they get a blob of data for each impression that there is a bid on (this is "the bidstream data"): > These can include: The URL, website, or app the consumer is on, Information about the consumer’s device, The consumer’s geo-location, The consumer’s IP address, Various demographic or behavioral attributes about the consumer (as supplied by the ad exchange or third party data brokers), such as gender, age range, or job occupation These user IDs are anonymized but there's machinery to link the bid data to a cookie that the advertiser already has in their own system ("cookie matching"). They provide some evidence that even though RuTarget was OFAC sanctioned in April, Google may still be providing them the bidstream (and therefore presumably is selling services to an OFAC-sanctioned entity). This would be quite surprising if so, since a company like Google surely has processes to monitor the OFAC watchlist and automatically deactivate companies that are sanctioned. My summary here is that the ProPublica article is incomplete and that makes it a bit misleading; reading the article one would assume the Russians were getting a dump of de-anonymized data, whereas in fact the finding is around them getting access to the bidstream, which is provides anonymized user data, that may in some cases be hypothetically de-anonymizable, or assist with other de-anonymization efforts.

jonny_eh 4y ago

> Google allowed RuTarget, a Russian company that helps brands and agencies buy digital ads, to access and store data about people browsing websites and apps in Ukraine and other parts of the world In other words, they collected data via websites and apps, just like any other JS or native ad library does. This wasn't data that Google collected, then handed over. It's a misleading headline IMO.

amelius 4y ago
Imagine a Russian agent starting an ad campaign targeted at Ukrainian people who are interested in weapon systems. But... the actual ads are about an innocent thing, like cat food. An Ukrainian clicks the cat food ad, is directed to the Russian agent's fake cat food shop, places an order and fills in their address. How is Google not leaking information here?
- freeflight 4y ago
  The whole "Google is not selling your data" excuse never held up to practical reality, it was always only a semantics argument along the lines of "They sell it, but not directly!". This whole case exemplifies that very much, but it only garners attention due to who did it, Russia, not due to why and how this is actually possible.
  - theptip 4y ago
    I think it’s materially different though. Particularly when you contrast with the FB graph API and the Cambridge Analytica scandal where they were actually giving out the raw data. There is a LOT more you can do with the raw data than with ads targeted on specific categories. Like, I personally am never going to click the cat ad in the example above, but I very well could have had all my info leaked by a neighbor in my friend graph in the CA dump. So your ad-harvested data will always be sparse.
- theptip 4y ago
  Is that even an AdWords category? Can we get more specific on exactly what level of targeting is possible? I see there is an attack here, but I’m still not exactly clear on the scope. I can’t see them getting very many conversions with a random cat food company. So did they dox 10 people? Or was this something that could actually get a meaningful amount of data?
burkaman 4y ago
The line you quoted is just a slight rephrasing of the headline with a little more detail. What are you finding misleading? Google allowed [a Sanctioned Russion Ad Company = RuTarget, a Russian company that helps brands and agencies buy digital ads], to [Harvest = access and store] [User Data = data about people browsing websites and apps]

yunohn 4y ago

> you run a site, GA will give you IP, location, etc. for inbound traffic, but I didn't think they would give you data on other users. This is not “provided” by Google. It’s normal web server traffic data, collected by Google Analytics instead of your own scripting.

theptip 4y ago

Ok, I found some answers. The original research is linked in the OP: https://adalytics.io/blog/sanctioned-ad-tech-user-data https://adalytics.io/blog/sanctioned-ad-tech-user-data -- this is much more informative than the ProPublica writeup. It includes a technical explanation of what's going on. Basically, the accusation is that a sanctioned Russian company is listed as an advertiser ("Demand Side Platform") on Google's real-time bidding platform for ads. This means they get a blob of data for each impression that there is a bid on (this is "the bidstream data"): > These can include: The URL, website, or app the consumer is on, Information about the consumer’s device, The consumer’s geo-location, The consumer’s IP address, Various demographic or behavioral attributes about the consumer (as supplied by the ad exchange or third party data brokers), such as gender, age range, or job occupation These user IDs are anonymized but there's machinery to link the bid data to a cookie that the advertiser already has in their own system ("cookie matching"). They provide some evidence that even though RuTarget was OFAC sanctioned in April, Google may still be providing them the bidstream (and therefore presumably is selling services to an OFAC-sanctioned entity). This would be quite surprising if so, since a company like Google surely has processes to monitor the OFAC watchlist and automatically deactivate companies that are sanctioned. My summary here is that the ProPublica article is incomplete and that makes it a bit misleading; reading the article one would assume the Russians were getting a dump of de-anonymized data, whereas in fact the finding is around them getting access to the bidstream, which is provides anonymized user data, that may in some cases be hypothetically de-anonymizable, or assist with other de-anonymization efforts.