Wyden and Booker cite Citizen Lab research to call targeted ads a security risk

Democratic Sens. Ron Wyden and Cory Booker cited Citizen Lab and Confiant research to argue that targeted advertising is a national security risk, according to reporting published by CyberScoop.

Researchers at Citizen Lab and Confiant found Oct. 16, 2026, that the AdFection technique delivered mercenary spyware through targeted ads without requiring any action by the user. The two groups recommend that ad vendors vet partners, audit supply chains and ban vendors in high-risk jurisdictions. Their report argues that current industry practices lack due diligence, leaving gaps for malicious actors to exploit the ad supply chain.

Wyden labeled ad-tech a national security threat and pressed the government to stop ads on government browsers and switch off mobile ad IDs. He cited Discover-Tech, which is most closely tied to AdFection, noting that its ads had appeared on government networks in letters referenced by the Citizen Lab report. Wyden argues that allowing targeted ads on government devices creates vulnerabilities for espionage and criminal exploitation. Discover-Tech ads appearing on government networks underscore the security risks Wyden has warned about.

Booker said the AdFection report points to a rising spyware threat and the need for stronger privacy protections to counter changing surveillance dangers. Booker stresses the need to move quickly on spyware risks through new legislation. Wyden and Booker, both Democrats, sponsored a 2023 bill that would have stopped targeted ad networks from using personal data to target users, though the measure never advanced. They point to the report as proof that the industry needs stronger privacy rules and reform.

Before the AdFection report came out, Google and IAB Europe had placed Discover-Tech on certified or approved vendor lists. The report indicates the industry failed to vet vendors properly even though Discover-Tech was on approved lists. When Google worked with Citizen Lab and Confiant on a joint investigation, it barred Discover-Tech and kept blocking malicious ads from the company. The company says it took Discover-Tech off its platform once it identified its part in spyware distribution.

Google said its automated systems stopped over 99% of policy-violating ads before delivery to users in 2025. The company cites that figure as proof of its focus on user security.

IAB Europe says the report does not show that the digital advertising infrastructure has failed, instead pointing to misuse of existing technologies. The trade group minimizes the seriousness of the findings and blames potential misuse rather than a systemic failure. The group also says responsibility for investigating unlawful activities such as spyware deployment lies with competent authorities rather than the advertising industry, moving responsibility for addressing spyware to regulators instead of taking proactive industry steps.

The association backs industry spending on tools and processes to reduce cybersecurity risks but rejects uniform regulatory recommendations and favors proportionate security measures built around each company’s specific risks.

Beeswax, Vungle and Eskimi blocked Discover-Tech from the digital advertising ecosystem once Citizen Lab and Confiant published the report. The move distanced the networks from Discover-Tech after the report came out. Xandr, Microsoft’s ad system, did not answer Citizen Lab’s report or CyberScoop’s requests for comment. Xandr’s silence stands apart from steps taken by other ad networks and firms.

The AdFection technique delivered spyware without user interaction, exposing both individual users and government networks to risk.