Admitted Without a Hearing

The official account of online advertising describes a service. The industry calls it relevance: the right message, the right person, the right moment, a courtesy extended to a reader who would otherwise be bored by shoes she does not want. From inside, the description reads differently. I am sitting at a kitchen table with a cooling cup of tea, scrolling a news page on my phone, and a small rectangle at the bottom of the screen loads a banner I never look at. I do not tap it. In the vocabulary of this business, I have not engaged. According to researchers at Citizen Lab at the University of Toronto, I may not need to.

Their claim, and it is a claim that is contested, concerns Discover-Tech, an advertising agency in Israel whose online adverts, they say, can deliver the installation of “zero-click” spyware. Zero-click is the term of art. It means the patient is committed without signing the papers. No link was opened, no attachment was trusted, no foolish thing was done that the victim can later be blamed for. The ward admits you because you were standing near the door.

I spent ten days once learning that an institution’s intake procedure tells you more than its brochure. So consider the intake here. Before any advert reaches my phone, an auction is held over me in the time it takes the page to load. Bidders are shown what the system knows: my rough location, my device, the kind of reader I appear to be. They decide whether I am worth reaching. That auction is not a scandal. It is the ordinary, legal, profitable plumbing of the free internet, and it is the part of this story nobody disputes.

Here is where the industry’s best defence deserves a fair hearing. Discover-Tech’s capabilities, as described by the researchers, have not been established in a courtroom. Advertising and hacking are different trades, and a firm that sells banners should not be convicted on the strength of a lab report. Spyware is the crime. Targeting is commerce. Draw the line there and the rest of the system remains clean.

The trouble is that the line does not hold from inside. The capability Citizen Lab describes has two halves, and the agency is alleged to supply only the first: finding a particular person and placing something on their screen. The ad industry has spent years perfecting exactly that half and calling it personalisation. The spyware does not corrupt the system. It finishes the sentence the system had already begun. If an operator can buy the right to show one person one rectangle, the remaining question is only what the rectangle contains, and that is a question the person in the kitchen has no means of asking.

This is why the stakes are not merely the covert hacking of a chosen journalist or dissident, grave as that is. They include the mass profiling of everyone else, because the profile is the precondition. To hit one target through an ad, you must first sort the crowd finely enough to know which phone is hers. The innocent reader is not collateral. She is the haystack, and the haystack must be catalogued before the needle can be found.

I have seen what an inmate’s file looks like when the inmate is never allowed to read it. It records her habits, her hours, her moods, in a language designed for the staff. The advertising profile is that file, kept on every reader, and the inmate’s only recourse is a settings menu written by the warden.

There is something almost comic in the arrangement, and the comedy is accurate. The industry has long complained that nobody clicks on its adverts. Engagement is down; banner blindness is a recognised affliction; whole conferences mourn the indifferent thumb. In Discover-Tech’s case, if the researchers are right, the problem was solved. The advert works perfectly on people who ignore it. It is the first banner in history whose conversion rate does not depend on the customer.

Somewhere a woman finishes her tea, locks her phone, and puts it face down on the table, the gesture we all make when we believe a thing has stopped watching.