Here is the source document outlining the scope of the study: http://www.zyn.com/sbir/sbres/sbir/dod/darpa/darpasb133-002.htm http://www.zyn.com/sbir/sbres/sbi

Here is the source document outlining the scope of the study: http://www.zyn.com/sbir/sbres/sbir/dod/darpa/darpasb133-002.htm http://www.zyn.com/sbir/sbres/sbir/dod/darpa/darpasb133-002.... They are right to be worried about the attack surface presented by the mobile & display ad ecosystem. The key to any attack, of course, is de-anonymizing the data, in the sense of being able to identify corresponding entities across disparate sources of data. This is the technical challenge that a large chunk of the ad-tech industry has been working on. This is difficult to do reliably --- but the reliability (or otherwise) of a particular technique may be moot if you have a population of several thousands of individuals that you can target -- sooner or later somebody will carry out the actions that your attack assumes, and you will be able to make the connections that you need. The attacker needs only think of the problem in terms of "matched filters" to make headway -- just discard anything that does not match. Of course, characterising the target is only part of the story -- exploiting the information advantage comes next. Funnily enough, the proliferation of open communications channels also offers a potential attack vector - the use of individually crafted messages and disinformation to direct attention and manipulate behaviour of the target -- similar in concept to the social engineering techniques that are used in spear phishing attacks.