Governments don’t need Pegasus to find a reporter’s confidential sources. They just buy the ad data.

The Committee to Protect Journalists report shows a brutal reality for journalists: state actors do not need expensive spyware to burn confidential sources anymore. Commercial data brokers sell location feeds scraped directly from ordinary mobile apps. A Belgian newsroom proved this by grabbing a free broker sample and tracking a colleague's physical movements over two weeks. A German reporter found his own historical coordinates in a commercial dataset just because he enabled location on a weather app.

When a reporter meets a source in secret, their mobile advertising ID (MAID) broadcasts GPS coordinates through embedded SDKs and real-time bidding auctions. Foreign governments or local police buy these datasets legally off the shelf. They cross-reference the device pinging outside a whistleblower's home with the device pinging at a news office. The pseudonymous ad ID gets mapped to a real name in minutes.

The risks go way beyond simple leak hunting. In high-conflict zones or repressive regimes, this telemetry gives hostile agencies exact physical targets. An arrest or physical harassment of a source often starts with an automated location hit bought from a commercial broker. When state actors track a reporter's daily route, they can intercept them or threaten their families without ever hacking a phone.

Standard browser extensions do not stop mobile app background noise. If an app runs third-party ad SDKs, location data exits the device long before any banner renders. Zeroing out location permissions and resetting Advertising IDs at the OS level matter far more than browser tweaks. Combining that with network-wide DNS filtering like NextDNS is the minimum baseline.

Are newsrooms actually training reporters on mobile SDK telemetry, or are they still pretending a browser plugin solves this?

Source: Committee to Protect Journalists, link in comments.