ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for The Big Story’s newsletter to get these kinds of stories delivered to your inbox†
The day after Russia’s invasion of Ukraine in February, Mark Warner, chairman of the Senate Intelligence Committee, sent a letter to Google warning the company to be alert to “exploitation of your platform by Russia and its affiliates”. and called on the company to monitor its ads for the company’s compliance with economic sanctions.
But it wasn’t until June 23 that Google shared potentially sensitive user data with a sanctioned Russian ad technology company owned by Russia’s largest state bank, according to a new report provided to ProPublica.
Google allowed RuTarget, a Russian company that helps brands and agencies buy digital ads, to access and store data about people browsing websites and apps in Ukraine and other parts of the world, research shows Adalytics, a company that analyzes digital advertising. Adalytics identified nearly 700 examples of RuTarget receiving user data from Google after the company was added to a US Treasury list of sanctioned entities on Feb. 24. Data sharing between Google and RuTarget stopped four months later on June 23, the day ProPublica contacted Google about the activity.
RuTarget, which also operates under the name Segmento, is owned by Sberbank, a Russian state-owned bank that the Treasury described as “uniquely important” to the country’s economy when it hit the lender with initial sanctions. RuTarget was later mentioned in an April 6 announcement from the Ministry of Finance imposing full blocking sanctions on Sberbank and other Russian entities and people. The sanctions mean that US individuals and entities are not allowed to do business with RuTarget or Sberbank.
In particular, the analysis found that Google shared data with RuTarget about users browsing websites in Ukraine. This means that Google has passed on critical information such as unique cell phone identifiers, IP addresses, location information, and details about users’ interests and online activities, data that US senators and experts say could be used by Russian military and intelligence agencies to follow people or zoom in on points of interest.
Last April, a bipartisan group of US senators sent a letter to Google and other major ad technology companies warning about the national security implications of data shared as part of the digital ad purchase process. They said this user data would be “a gold mine for foreign intelligence agencies that could exploit it to inform and incentivize hacking, blackmail and influence campaigns.”
Google spokesperson Michael Aciman said the company blocked RuTarget from using its ad products in March and that RuTarget has not purchased ads directly through Google since then. He acknowledged that the Russian company was still receiving user and ad purchase data from Google before being warned by ProPublica and Adalytics.
“Google is committed to complying with all applicable sanctions and trade compliance laws,” Aciman said. “We have assessed the affected entities and have taken appropriate enforcement action beyond those we took earlier this year to prevent them from using Google ad products directly.”
Aciman said this action not only prevents RuTarget from further accessing user data, but also from purchasing ads through third parties in Russia that may not be sanctioned. He declined to say whether RuTarget had bought ads through Google systems using such third parties, and he did not comment on whether data about Ukrainians had been shared with RuTarget.
Krzysztof Franaszek, head of Adalytics and author of the report, said RuTarget’s ability to access and store Google user data could open the door to serious potential abuse.
“As far as we know, they take that data and combine it with 20 other data sources that they got from God knows where,” he said. “If RuTarget’s other data partners were the Russian government or intelligence agencies or cyber criminals, there is a huge danger.”
In a statement to ProPublica, Warner, a Virginia Democrat, called Google’s failure to cut its relationship with RuTarget alarming.
“All companies have a responsibility to ensure that they do not help finance or even inadvertently support Vladimir Putin’s invasion of Ukraine. It is incredibly alarming and frankly disappointing to hear of a US company sharing user data with a Russian company owned by a sanctioned state bank. “I urge all companies to scrutinize their operations from top to bottom to ensure they are not supporting Putin’s war in any way.”
