Apple's ID Block Is Cybersecurity, Not Just Privacy: The Spyware Lesson

By Tom Whitfield

Ads that ran on more than 120,000 websites and 70,000 apps carried zero-click mercenary spyware that was used to spy on staff at Al Jazeera. On October 15, ad security firm Confiant and the University of Toronto's Citizen Lab confirmed the attack, which deployed technology from two Israeli companies: ad tech vendor Discover-Tech and the spyware firm Candiru.

Wolfie Christl, a senior researcher at Citizen Lab and one of the report's authors, told Forbes: "It's difficult, if not almost impossible, to consistently protect yourself from malicious ads. Ad blocking must now be considered a cybersecurity best practice."

That report landed while ad tech was still fighting Apple. Since the release of iOS 27, Apple WebKit — the software that powers Safari and every other iPhone browser, including Google Chrome — has blocked requests to a set of ad tech domains handling cross-site tracking. The macOS 27 Golden Gate update did the same for desktop Safari. On October 19, a WebKit blog post explained what the blocked domains share: they are all "identity resolution infrastructure."

The spyware episode reframes the dispute. If ad blocking is now cybersecurity table stakes, can the industry really blame Apple?

What gripes does ad tech have against Apple?

Ad tech's complaints are real. The industry has faced a month of silence from Apple, with no published list of blocked domains and no appeal process. In at least one documented case, Google could bid on iOS ad inventory while The Trade Desk could not. Enforcing measures bluntly and silently is counterproductive, unfair and unprofessional.

Accusations that Apple uses privacy as a Trojan horse for its own advertising empire also circulate. They seem petty next to ad tech's cybersecurity failures.

Apple's own concerns are legitimate, and the Discover-Tech case proves the point.

Can we blame Apple for treating identity as a security matter?

Mathieu Roche, CEO of ID5 — one of the ID vendors blocked by WebKit — called the move "an attack against the business model of the web." De Zanche disagrees, noting these arguments date back to at least 2021, when the programmatic open marketplace rebranded itself as the open web.

Ad tech's role is to provide tools in the background, under media owners' own standards and consent. That role does not require finding one person across 120,000 websites and 70,000 apps. But the open marketplace is built on recognizing the same individual — and those who want to exploit ad tech to target specific people can.

The WebKit post draws the same line. First-party personalization "is not tracking, and is not what our technologies seek to prevent," the WebKit team writes. But Apple considers a central identity resolver a third party acting as a "clearinghouse," even when it holds a single company's data.

The exploitation was concrete. Discover-Tech bought ads through Google's and Yandex's exchanges and Comcast's Beeswax. Those ads "covertly directed millions of devices to contact Candiru's servers, likely for large-scale tracking and reconnaissance," according to Citizen Lab. Its customers could profile or infect a chosen person using three identifiers: a mobile advertising ID, a browser cookie ID or an IP address. Apple has systematically restricted all three since implementing ATT in 2021, and its browser team said in 2019 it treats circumvention of anti-tracking measures "with the same seriousness as exploitation of security vulnerabilities."

Critics argue ATT at least asked users for consent, while the WebKit block list works without user input. Yet users already expressed a preference through the industry's own consent framework — Discover-Tech sat on IAB Europe's Global Vendor List for over six years, during which hundreds of millions of Europeans clicked "agree" to its data processing. That is what consent looks like when a media owner collects it once and passes it to hundreds of unknown vendors.

Apple's mission is its devices, which customers buy partly on trust and safety. Verdict: no blame.

Can we blame Apple for not trusting the industry's vendor lists?

Discover-Tech appeared on Google's Certified External Vendors list and on IAB Europe's Global Vendor List since July 2, 2020 — "registered and approved" by an association claiming "reasonable steps to vet and approve" applicants. Yet for most of that period, its company records showed links to the spyware industry on its board and among shareholders.

Citizen Lab concludes the vendor lists "appear to be largely based on self-attestation by vendors." Google and IAB Europe acted only after disclosure: Google blocked the company "for systematically violating our policies"; IAB Europe suspended it. Verdict: no blame. Know Your Customer checks should be the first layer of ad buying and selling.

Can media owners blame Apple?

IAB Tech Lab CEO Anthony Katsur recently wrote, "Ad tech can adapt." The bigger pressure, he argues, falls on publishers — and he is right on both counts.

Publishers whose first-party data strategy depends on a third-party identity resolver face serious strain. Apple has promised not to touch what media owners always had: their own data, with consent they collect, used on their own properties. Moving ID resolution to the publisher's server is no easy escape either; Apple's policy warns circumvention may bring "additional restrictions without prior notice."

For premium media owners, the future is first-party data, direct audience relationships and contextual targeting built on top of both. Verdict: no blame.

Apple is accelerating a trend already underway. The open marketplace will collapse sooner or later, and ad tech firms whose only business is that marketplace will go with it. Cybercrime delivered through advertising is wider than one spyware vendor and bigger than the argument with Apple. The answer, per De Zanche: don't blame Apple — evolve ad tech.