The innovation at the heart of the advertising technology industry is automated auctions to trade real-time data about mobile phone users—including their physical location and browsing habits, but not their real names. The primary purpose of this activity, known as real-time bidding, is to put digital ads in front of the people most likely to click on them. But it’s also possible to purchase this data with other goals in mind.
One notable nonadvertising participant is Rayzone Group Ltd. The Tel Aviv-based surveillance company for years has quietly harvested advertising data and repurposed it to help governments track individuals through their mobile phones. As part of these efforts, Rayzone has acquired companies specializing in ad technology and established relationships with brokers that resell data from major advertising exchanges, including the one owned by Alphabet Inc.’s Google.
Rayzone feeds advertising data it obtains into a service called Echo, which it sells to governments around the globe. Echo is among the first known commercially available surveillance systems to exploit advertising data this way, according to industry experts. Rayzone positions the product as an all-seeing technology that’s more or less impossible to avoid or disable. As its marketing materials say: “You can run, you can hide, but you can’t escape your own echo.”
When not talking directly to clients, Rayzone has worked to keep details about Echo private, making employees who work on it sign nondisclosure agreements. Its website doesn’t mention Echo by name, referring only to a “location investigation platform” it sells. A company spokesperson declined to answer specific questions on the record, instead providing a statement saying the company and its subsidiaries “supply government agencies with passive tools to combat terror and crime in line with local and international regulations, alongside our cybersecurity division defending against cyberattacks.”
In an email, a Google spokesperson said that the company was investigating the matter, and that it had not identified any relationship between Rayzone and its ad exchange, known as Authorized Buyers. Google’s policies “strictly prohibit” any effort to identify people based on its real-time bidding data, the spokesperson said, adding that it doesn’t share “precise location or sensitive personal” information.
Privacy experts for years have been warning about the dangers of real-time data exchanges. “What everyone on the internet is reading, watching and listening to, and where they move in the real world, is being broadcast to thousands of companies all of the time,” says Johnny Ryan, a senior fellow at the Irish Council for Civil Liberties. “This is the biggest data breach ever recorded—and it’s repeated every day.”
In 2021 six users filed a proposed class-action lawsuit against Google in federal district court in California, claiming the company had “misled consumers into believing that it does not sell their personal information.” (Google has sought to have the case dismissed, saying the data on its ad exchange shouldn’t be considered private because people share it with websites through their internet use.) In an April 2021 letter, a bipartisan group of US senators also expressed concerns about data shared through real-time bidding, saying it “would be a goldmine for foreign intelligence services that could exploit it to inform and supercharge hacking, blackmail, and influence campaigns.”
The US government itself has purchased mobile location data to track people, as have private entities looking to conduct their own surveillance. Forbes reported in December 2020 that Rayzone and another Israeli company, Bsightful, were selling surveillance technology based on location data gathered from smartphone apps. This account, based on interviews with people familiar with Rayzone—all of whom asked not to be named discussing confidential matters—as well as internal documents, provides new information about its operations, technology and client base. (Representatives for Bsightful didn’t respond to a request for comment.)
Rayzone was founded in 2010. One of the co-founders, President Yohai Ben-Zakai, is a former deputy director of Unit 8200, the electronic surveillance unit of the Israel Defense Forces sometimes likened to the US’s National Security Agency. The company first made a name for itself by selling to governments technology that tracked the location of mobile devices by exploiting weaknesses in a telecommunications protocol known as SS7, or Signaling System 7, a sort of switchboard for the global telecom industry dating to the 1970s. As network operators improved SS7’s security, Rayzone began developing Echo in 2017, according to people familiar with the company. It’s been selling the service since at least 2018.
To feed Echo, Rayzone obtains data directly from some ad exchanges as well as from other companies that trade in location and other information gathered from mobile phones, according to four people familiar with the company’s operations. Rayzone and its affiliates have at times posed as prospective advertisers to acquire data through a system known as a demand-side platform, the people say. It owns two companies specializing in ad technology: Impulse Programmatics and Oxillon, the latter of which says it’s “trusted by the world’s top advertising agencies.” Both operate out of the same eastern Tel Aviv office building as Rayzone, according to business records.
Surveillance through ad tech has some regulatory advantages. The government of Israel, where many surveillance firms are located, has export controls on certain digital surveillance products that rely on hacking into devices or installing technology within telecom networks. Because Echo simply interprets commercially available data, it’s not subject to those controls, say people familiar with the business.
Rayzone offers governments custom installations of Echo, priced according to the country or region where the customer wants to track people and how much data it requires. The company looks to charge as much as $10 million for its most expensive licenses, according to people familiar with its sales. Dozens of law enforcement and intelligence agencies in Europe, the Middle East, Asia, and North and South America have purchased Echo, according to four people familiar with Rayzone’s operations. The company has partners that sell its technology in countries including Thailand, the Philippines and Mexico, those people say.
Advertising technology generates data every time a person uses a phone to carry out a routine function, such as browsing the internet or using an app to check the weather. These data don’t include people’s names, but researchers have shown it’s possible to de-anonymize them by combining various data sets.
Rayzone’s marketing explains that the company “collects information from each internet user worldwide,” with one document boasting that “the target is not aware of the monitoring and can’t avoid it.” From there, Rayzone tells clients its technology can retrieve information about phones that have been in specific locations, then connect them to profiles that include a person’s name, gender, age, address, hobbies and browsing history, according to company documents. Rayzone says it can provide up to six months’ worth of mobile phone records, allowing governments to peer back in time to find out who was at a particular location and when.
In a demonstration for prospective clients in April 2022, a Rayzone representative showed how the technology could track people’s whereabouts across Mexico, analyzing almost 2 billion location records that he said had been gathered from the advertising industry. The system could home in on a particular building and identify who was there on a given day or time going back several months.
Privacy advocates say products such as Rayzone’s pose a particular threat because they sidestep limits on government spying. Regulations in many countries make it hard for phone providers to share personal data with foreign governments, says Paul Vines, a security and privacy researcher who’s studied the advertising industry. Surveillance that utilizes advertising data, he says, “represents a loophole around protections—some third-party company can go and get the data, and the government will just buy it.”
Rayzone sells several other tracking tools. It claims that one of them, called Optimus, can deploy fake social media profiles—or “avatars”—to gather information on web forums while masking the user’s true identity. Another tool, known as Sprinter, can be carried in a suitcase and used remotely to eavesdrop on phone calls and text messages.
Such services are inherently controversial, and Israel’s surveillance sector in particular has been subject to increased scrutiny as its tactics have come to light in recent years. During a November 2021 conference in Tel Aviv, Rayzone’s former chief cybersecurity officer, Guy Mizrahi, offered a full-throated defense. “I want to say that as a private individual, I want that my government will be able to spy on people, even on me, if they think that I have done something wrong,” he said. “Other countries should have those capabilities also, and not all of them can develop it on their own. So if we can sell those kinds of things and help them to do it, then it’s great.”Read next: VPNs Are Going Mainstream, and So Are Their Trust Issues
©2023 Bloomberg L.P.
