Google allowed sanctioned Russian ad company to harvest user data for months

ProPublica won a Pulitzer Prize. If you sign up for The Big Story newsletter, you'll get stories like this one.

The day after the invasion of Ukraine, Senate Intelligence Committee Chairman Mark Warner sent a letter to Google warning it to be on alert for exploitation of its platform by Russia and Russian-linked entities.

According to a new report provided to ProPublica, a Russian ad tech company owned by Russia's largest state bank was sharing potentially sensitive user data with the search engine.

According to research from a digital ad analysis firm, a Russian company that helps brands and agencies buy digital ads was able to access and store data about people in Ukraine and other parts of the world. The company was added to a U.S. Treasury list of entities that are subject to sanctions. The data sharing between the two companies stopped four months later after ProPublica contacted the internet giant.

Sberbank is a Russian state bank that the Treasury described as being important to the country's economy when it hit it with initial sanctions. The Treasury imposed full blocking sanctions on Sberbank and other Russian entities. U.S. individuals and entities are not allowed to do business with Sberbank.

The analysis showed that the data was shared between the two companies. U.S. senators and experts believe that Russian military and intelligence services could use this information to track people or zero in on their locations.

In April of last year, a bipartisan group of U.S. senators sent a letter to major ad technology companies warning of the national security implications of sharing data as part of the digital ad buying process. This user data could be used by foreign intelligence services to inform and influence campaigns.

According to Michael Aciman, the company blocked the company from using its ad products in March. He admitted that the Russian company was still receiving user and ad buying data from the internet giant.

Aciman said that the company is committed to complying with all applicable laws. We have reviewed the entities in question and have taken appropriate enforcement action beyond the measures we took earlier this year.

Aciman said that this action includes preventing RuTarget from accessing user data, as well as preventing them from purchasing ads through third parties in Russia. He didn't say if data about Ukrainians had been shared with RuTarget or if they had purchased ads through third parties.

The author of the report, Krzysztof Franaszek, said that the ability to access and store user data from the internet search engine could lead to serious abuse.

He said that God knows where they are combining that data with 20 other data sources. There is a huge danger if the Russian government is included.

Warner, a Virginia Democrat, said in a statement to ProPublica that he was alarmed by the lack of a severing of the relationship between the two companies.

All companies have a responsibility to make sure that they don't support the invasion of Ukraine. He said that hearing that an American company may be sharing user data with a Russian company that is owned by a state-owned bank is disappointing. All companies should examine their business operations to make sure they don't support Putin's war.