Penlink's Webloc ad-surveillance tool spreads globally
Bloomberg and Citizen Lab research shows government agencies in at least a dozen countries use Penlink's Webloc to mine ad-tech data for mass surveillance.
Sourcecitizenlab.ca — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Citizen Lab highlights a Bloomberg investigation that builds on its own April 2024 research into Penlink's Webloc, an ad-based surveillance system that harvests advertising identifiers and location data to track individuals. Citizen Lab's original report, based on open-source research, FOIA requests, and infrastructure mapping, identified Webloc customers in the US, El Salvador, and Hungary, with Austria's Ministry of the Interior confirmed as a customer afterward. The Bloomberg follow-up expands the known customer list to include the UK, Netherlands, Germany, Mexico, Singapore, Saudi Arabia, UAE, and Israel.
Researcher Wolfie Christl describes Webloc as a mass surveillance capability that is diffusing from military and intelligence agencies down to federal and even local law enforcement. The article raises legal concerns about the use of such ad-tech-derived surveillance in Europe and the UK, and flags heightened risk where it is deployed by authoritarian governments. There is no technical exploitation, malware, or compromise described here — this is a disclosure of a commercial surveillance product's proliferation among state security and law enforcement bodies, relevant to privacy, policy, and civil-liberties risk assessments rather than network defense.
Defenders and organizations with privacy or compliance responsibilities should be aware that ad-tech data broker ecosystems can be leveraged by government customers for location and identity tracking at scale, independent of traditional cyber intrusion techniques. There are no IOCs, CVEs, or detectable TTPs associated with this reporting.
Mentioned in this report
Source reporting: https://citizenlab.ca/security-agencies-worldwide-found-to-use-ad-based-surveillance-system
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs