Australia’s nuclear research agency is now on the list of places Discover-Tech’s ads reached. The company that put them there spent six years on IAB Europe’s vendor list. IAB Europe now says that list was never a certification.

Last Thursday ADOTAT reported that Discover-Tech sat on Google’s certified vendor lists and IAB Europe’s Global Vendor List from 2020 until this month. According to the University of Toronto’s Citizen Lab and the ad security firm Confiant, its ads were used to hit at least 45 Al Jazeera devices in 2024 and 2025 with Candiru spyware. The researchers also say the ads pulled readable cookies from more than 1,000 publishers and showed up on networks tied to NATO, the UN and the European Parliament.

Four days later, the map has grown, and the gatekeepers have explained themselves.

ABC News in Australia reported Monday that Discover-Tech advertising reached networks belonging to the Australian Nuclear Science and Technology Organisation and its Australian Synchrotron research campus. Other Australian government agencies, critical infrastructure operators and major media organisations were on the list too.

Nobody had to read between the lines of a dataset to get this. Citizen Lab’s own report names it. The researchers found a substantial cluster of impressions in Australia, including networks tied to grid and power companies and to entities working on nuclear research. iTnews counted more than 10 million Discover-Tech bids for impressions geolocated to Australia.

ANSTO told ABC: “We are adhering to standard response protocols and have not observed any impact on our facilities, systems, or information from the described techniques.”

Be precise about what that means. An ad impression is not an infection, and nothing published says ANSTO was compromised. What the impression does mean, in Citizen Lab’s assessment, is that at minimum the devices that loaded those ads were profiled by Discover-Tech. Each one sent its ad ID and IP address to a company that, by the researchers’ account, sold exactly that pairing to spyware vendors.

A nuclear research agency’s devices ended up in a spyware broker’s targeting file, and they got there through an ad auction.

The story has crossed into Australia’s own ad trade press. AdNews walked readers through the ordinary programmatic machinery involved: MyDSP, Beeswax, Eskimi, Google and Yandex. In London, Ollie Whitehouse, chief technology officer of the UK’s National Cyber Security Centre, put both reports in his October 17 weekly roundup and filed Citizen Lab’s under “cyber proliferation.” His roundup carries a standing note that attribution comes from others, not the UK government. Even so, a national cyber agency’s CTO is reading an ad tech story.

Here is what it took for Discover-Tech to get onto the list that consent banners across Europe used to name it as a legitimate vendor, in IAB Europe’s own description.

Lauren Wakefield of IAB Europe told ADOTAT that onboarding involves “verifying that information provided in a registration form” is correct. That form, she said, is geared toward transparency, “not validation of business practices.” The second step checks that the applicant belongs to an industry association or is a company in good standing, for example through “evidence of registration with whichever national registry of undertakings may be relevant.”

That is the whole gate: a form, plus proof the company is registered.

The national registry that would have been checked is the same one Citizen Lab used. According to Citizen Lab, Israeli company records showed Eric Banoun, co-founder of the NSO affiliate Circles and of Senpai Technologies, joining Discover-Tech’s board weeks after it was founded. IAB Europe’s process confirmed the company existed. It did not read who ran it.

IAB Europe does not pretend otherwise. “The listing of an entity in the GVL does not mean that a company has been certified by IAB Europe as compliant with the GDPR across all its activities,” Wakefield wrote. On spyware: “IAB Europe is neither equipped nor mandated to conduct forensic or criminal investigations of such activities.”

That is honest. It also means every consent banner that named Discover-Tech as a vendor was vouching for a registration number.

The audit that caught Discover-Tech did not come from routine monitoring. It came “following a report of non-compliance.” IAB Europe suspended the company on October 8, a week before the research went public. The suspension stands “until the identified violations have been fully remedied.” IAB Europe says the published findings “could also justify a definitive expulsion.”

Could. For a company accused of delivering spyware to journalists, it is still a suspension.

Keep reading free with your email: what Google’s statement covers and what it leaves open, AppLovin’s pushback, the Canadian broadcaster whose logs say the ads never ran, and why the people who found this weren’t the people paid to.