GumGum says it has nothing to do with Discover-Tech. Then it said the most interesting sentence anyone in ad tech has volunteered about this story so far.

“GumGum does not work with any of these vendors,” the company told ADOTAT on Monday. “We partnered with one of the companies listed, but ended our relationship with them nearly a decade ago.”

That is the whole statement. It is clean, it is short, and it is probably true. It also answers a question nobody in this business likes to ask out loud: how long does an ad tech relationship last after it ends?

Here is why the sentence matters. ADOTAT’s question named exactly five companies: Discover-Tech, its buying platform MyDSP, and MyDSP’s earlier owners Matomy, Marketcom and Glispa. Discover-Tech was not founded until March 2020. “Nearly a decade ago” puts GumGum’s exit around 2016 or 2017. In 2016, Matomy launched MyDSP.

So GumGum’s one partner almost certainly was not Discover-Tech. It was the family Discover-Tech came from. GumGum did not say which branch. ADOTAT has asked.

And on Monday afternoon, the U.S. Commerce Department’s Bureau of Industry and Security answered ADOTAT the question sitting under this entire story: what happens when a blacklisted spyware company gets a new name, a new owner and a seat at the auction?

The short version: Washington says a front for a blacklisted company may be breaking the law. Washington’s export rules may not reach an ad auction at all. Both things are true at once, and the space between them is where Discover-Tech lived for six years.

Last week’s reporting laid out the lineage. It is worth having in one place, because GumGum just walked into the middle of it.

Look at what changed at every step: the owner, the name, the cap table. Look at what did not: the domains, the Google ID, the integrations. The pipes stayed plugged in while the hands holding them changed.

That is what makes GumGum’s sentence useful. GumGum left the house a decade ago. Its name was still in the house’s code. MyDSP’s admin code, undated, listed thirteen connections: MobFox, Inneractive, MoPub, PulsePoint, RhythmOne, GumGum, PubMatic, Smaato, Sonobi, NativeAds, Unity, Q1Media and AppLovin. Several of those names no longer exist as independent companies. The config file outlived the businesses in it.

AppLovin told ADOTAT last week, on background, that a company can list any entity it likes in its own code, enabled or not. That is fair. GumGum’s answer shows the other half of the same truth: sometimes the name is there because the relationship really existed, ten years and three owners ago, and nobody ever took it out.

Every ad tech company carries some of this. Integrations inherited in an acquisition. A seat nobody remembers approving. A partner that changed hands twice and kept the same endpoint. Ad tech does not forget a partner. It just stops checking who the partner became.

On October 15, ADOTAT put three questions on the record to BIS. Does the Bureau consider Integrity Labs, the company now running Candiru’s business, covered by Candiru’s 2021 Entity List designation as a successor or alias? Is BIS reviewing whether Discover-Tech, or the U.S. companies that supplied its ad infrastructure, engaged in transactions subject to export rules with a listed entity? Does BIS plan to list Discover-Tech or related companies?

The answer arrived Monday from a BIS spokesperson, after our deadline. Here it is in full:

“BIS does not comment on future Entity List actions.”

“In general, if a separately incorporated subsidiary, partially owned subsidiary, or a sister company of a listed entity acts as an agent, a front, or a shell company to facilitate a transaction that would not otherwise be allowed, then that may be a violation. BIS’s enforcement of export control violations is stronger today than ever, and we will aggressively pursue any and all violations.”

The Bureau then pointed exporters to two documents: its Entity List FAQ and its “Know Your Customer” guidance and red flags.

Read it twice. BIS did not say Integrity Labs is covered. It did not say it isn’t. It declined to discuss future listings, and then volunteered the one principle that matters most for a company built to carry on a blacklisted company’s work: a front can be a violation even when the front itself appears on no list.

The language is not new. It closely tracks question 23 of BIS’s own Entity List FAQ, which says the list’s obligations do not automatically pass to subsidiaries, sister companies or other legally separate affiliates. One difference is worth flagging. The FAQ says a company acting as a front is “likely violating” the rules. The spokesperson said it “may be” a violation.

That is the sound of an agency describing something real without describing anyone in particular.

Whether BIS says so or not, Candiru is who the statement is about.

On November 3, 2021, the Commerce Department put Candiru on the Entity List alongside NSO Group. The stated reason: it developed and supplied spyware that foreign governments used against officials, journalists, businesspeople, activists, academics and embassy workers.

Then came the restructuring. A new Israeli company, Integrity Labs Ltd., was set up in December 2024. In April 2025, Israeli media reported that Integrity Partners, a U.S. investment firm, had bought Candiru’s operations for about $30 million, moving the assets and staff into the new company. That reporting described the deal as a way around the U.S. listing. Recorded Future’s Insikt Group later found Candiru’s spyware infrastructure still active, with clusters tied to Hungary and Saudi Arabia.

Candiru is on the Entity List. Integrity Labs is not.

Citizen Lab’s October 15 report does not dwell on the distinction. It says Candiru now operates as Integrity Labs, and it attributes the Al Jazeera attacks of 2024 and 2025 to Candiru’s spyware, delivered through Discover-Tech ads. The documented attacks straddle the sale.

So here is the question BIS will not answer about any specific company, laid out plainly: when a listed spyware firm’s people, code and servers move into a fresh legal entity, and that entity keeps buying targeting through an ad platform, is the new company a successor, a front, or a clean start?

BIS’s general answer: it turns on whether the company acts as a front “to facilitate a transaction that would not otherwise be allowed.” Its specific answer: no comment.

Here is the part nobody in ad tech wants to hear, and it cuts both ways.

The Entity List governs exports of “items.” Commodities, software, technology. A listed company needs a license to receive them. BIS’s own FAQ says the list sets license requirements for items subject to the Export Administration Regulations, and only those.

An ad impression is not a crate on a loading dock. An auction win is a service. Access to a buying platform is, in most cases, software running on somebody else’s servers. Whether any piece of Discover-Tech’s buying, through Google, through Beeswax, through Yandex, involved an item subject to the export rules is a genuine legal question. ADOTAT is not a law firm, and we are not going to pretend to answer it. BIS did not answer it either.

The FAQ itself points in that direction. It tells companies that some activity, services included, may fall outside the export rules, and that they should check other agencies’ lists for those. That is the gap, described by the agency that owns half of it.

Now line up who was responsible for what:

Every gate was real. Every gate faced a different direction. A spyware broker did not have to sneak past anybody. It walked through the one door nobody was assigned to watch.

Citizen Lab’s John Scott-Railton put how a spyware operation lasts six years inside advertising into four words: “It gets certified.” After Monday, there is a longer answer. It also gets lucky on jurisdiction.

None of this means the ad tech companies in the chain broke a law. It means something more uncomfortable for an industry that sells safety by the thousand: the strongest legal tool the U.S. has against a blacklisted spyware firm was written for a world of shipments, and programmatic was never inside it. The only thing standing between Candiru’s successor and an Al Jazeera reporter’s laptop was the curiosity of the companies running the auction.

ADOTAT+ members get the rest: the two BIS red flags that read like they were written about this story, the sanctioned name tied to Discover-Tech’s shareholder register and the day Treasury quietly took her off its list, why Washington’s new 50 percent rule would not have caught any of it, what the other twelve names on MyDSP’s list owe their buyers, and the nine-point check every SSP, DSP and publisher should run this week.

ADOTAT built this installment from on-record statements GumGum and a BIS spokesperson sent ADOTAT on October 19, BIS’s published Entity List FAQ (last updated November 10, 2025) and its “Know Your Customer” guidance, the Citizen Lab and Confiant reports of October 15, Treasury and Federal Register records on the Intellexa designations, and reporting by Calcalist, Haaretz, Recorded Future News and law firms tracking the BIS Affiliates Rule. Technical findings about Discover-Tech are the researchers’ and have not been independently tested by ADOTAT. This is not legal advice, and ADOTAT is not saying any company named broke export control or sanctions law; whether any Discover-Tech transaction was subject to the Export Administration Regulations is an open question BIS did not address. GumGum’s statement came from its corporate communications team, and ADOTAT has asked which company it meant; the answer will be added with a dated update. ADOTAT profiled GumGum executive Katy Loria on October 13. The Incremental banner in this issue is an advertisement; Incremental had no role in this story and did not see it before publication. ADOTAT has no financial relationship with any company named in this story, and no subject reviewed this piece before publication. Pesach Lattin ran an ad network in the 2000s and has known executives at several companies named here for years. ADOTAT is reader-supported, with no paid placement in editorial.