Do you remember the moment in 2018 when the Cambridge Analytica scandal exploded into public consciousness? For many of us, it was the first time we truly understood how easily our personal information could be weaponized. The story had actually been unfolding since around 2014, when Cambridge Analytica, a British political consultancy working for Donald Trump’s 2016 election campaign, improperly accessed and sold data belonging to Facebook users in order to target them for political advertising. The figures were staggering: more than 87 million users had their personal data harvested, including over 1.1 million Filipinos. Worse still, the stolen information included phone numbers and contact lists, which meant that even people who had never engaged with the campaign could be caught in the net simply because they were connected to someone who had. How did they do it? Not through a sophisticated hack, but through those playful, endlessly shared personality quizzes that promised to reveal your spirit animal or your ideal holiday destination. They seemed like harmless fun, but in reality they were carefully crafted traps designed to extract intimate details about your psychology, your fears, your hopes, and your social networks. All of that information was then used to profile and micro-target audiences with surgical precision, nudging them toward messages designed to reinforce their existing beliefs and isolate them from opposing views. That is how echo chambers are born: not by accident, but by design. We were angry, we were scared, and we promised ourselves that we would be more careful online. But a lot has changed since then, and the threat has evolved in ways that should make us far more uneasy.
Now imagine this: malicious actors no longer need you to click, tap, or type anything. They don’t need you to take a quiz or share your contact list. Simply loading a webpage with an online advertisement can be enough to compromise your device. That is the frightening reality that emerged in recent reporting about an Israeli digital advertising agency called Discover-Tech. The company gave access to Candiru, a spyware firm that has been blacklisted by the United States government, to advertising platforms operated by Google, Comcast, and Russia’s Yandex. Through this arrangement, Candiru was able to spy on internet users using a vast network of online ads. The malicious code didn’t need to be clicked; it only needed to load on your screen. In other words, the very act of visiting a website could expose you to surveillance. Two separate research groups, Citizen Lab and Confiant, investigated the scheme and found that Discover-Tech used a technique called cookie matching to track people across the internet. Cookie matching is a common digital advertising practice, but in this case it became the foundation for something far more sinister: a way to plant spyware on unsuspecting users’ devices. The researchers were careful to note that the ads connected to Candiru represented only a tiny fraction of Discover-Tech’s overall advertising volume, but that small fraction is enough to cause enormous harm, especially if it is aimed at the right people. The point is not that every ad is a spy device. The point is that it is now technically possible, and perhaps even easy, to turn the ordinary infrastructure of online advertising into a surveillance network that requires no interaction from the victim.
The difference between this and the Cambridge Analytica scandal is profound, and it is a difference that should alarm everyone, not just people in other countries. In the old days, you had to be tricked into giving away your data. You had to be seduced by a quiz or persuaded to hand over permissions. Now, the data can be taken from you without your knowledge, without your consent, and without any action on your part. The Cambridge Analytica scandal taught us that targeted advertising can create isolation and division, narrowing what we see and reinforcing what we already believe. But at least we could look back and say, well, they shouldn’t have taken that quiz. In this new model, there is no such reassuring excuse. You could be doing everything right, using strong passwords, avoiding suspicious links, and still be exposed to eyes that should never have seen your data. This is particularly worrying for countries like the Philippines, which have been treated as a testing ground for these kinds of operations. Recall that Cambridge Analytica used the Philippines as a sort of digital petri dish, a place to experiment with its strategies before rolling them out to Western countries, largely because of the nation’s extremely high social media usage and its lack of strong data protection regulations. That should be a warning: if a technique works in the Philippines, there is a good chance it will soon be deployed elsewhere, and if it is already being deployed here, there may be little standing in its way.
So what can ordinary citizens do in the face of such a deeply unsettling reality? The first thing to do is to stop feeling powerless. There are people who have been fighting these battles for years, and their experience offers a roadmap. One of them is Maria Ressa, the Nobel Peace Prize laureate and CEO of Rappler, who has spent her career on the frontlines of the fight against disinformation and the overreach of Big Tech. Her latest book, The Fight Back: A Citizen’s Guide to Standing Up to Dictators, is exactly the kind of handbook we need in this age of artificial intelligence, surveillance capitalism, and information warfare. In the book, Ressa draws on her years of confronting authoritarian governments and corporate power, and she offers a clear-eyed, practical vision for how citizens and institutions can understand, defend, and rebuild democracy in the age of AI. She doesn’t just tell readers to be afraid; she gives them tools. The book is structured around ten strategic goals, spread across ten chapters, and each chapter is broken down into ten concrete actions. That may sound overwhelming, but it is actually deeply empowering, because it transforms a massive, intangible threat into manageable, achievable steps. Some of those steps involve mapping the battlefield, understanding who controls the platforms we use, and identifying the weak points in our own digital lives. Others are about defending our communities and building new forms of solidarity and resistance. And ultimately, the goal is to build a world where technology works for the people, not against them.
Ressa’s message feels especially urgent in October, which is not just the month of Halloween and spooky decorations, but also Cybersecurity Awareness Month. This is the perfect time to take stock of our own digital habits and to think about what we can do to protect ourselves and the people around us. At a personal level, we can start with the basics: enabling two-factor authentication on our accounts, regularly updating our software, using password managers, and being extremely cautious about what permissions we grant to apps and services. We can also push for stronger data protection laws, because individual vigilance is not enough to stop companies and governments that collect data on an industrial scale. We need legislation that treats privacy as a fundamental right, not a luxury. We need transparency from the platforms that profit from our attention. We need independent journalism and research groups that can investigate these schemes and expose them to the public, the way Citizen Lab and Confiant did with Discover-Tech. And we need a citizenry that is educated, engaged, and willing to demand better. Ressa’s book is a starting point, but the real work happens when we take those ideas into our communities, our schools, our workplaces, and our voting booths. It is easy to feel helpless when you learn about a spyware operation that requires no clicks, but helplessness is exactly what the architects of those systems want us to feel.
If this story has left you a little spooked, that is not necessarily a bad thing. Fear can be a powerful motivator, as long as it doesn’t tip over into paralysis. The truth is that we are not defenseless. We may never be able to fully control when and how our data is collected, but we can control how we respond. We can choose to pay attention. We can choose to learn about the systems that shape our digital lives and to push back against the ones that exploit us. We can support organizations and individuals who are working to make technology more humane, and we can hold our leaders accountable when they fail to protect our rights. The Cambridge Analytica scandal was a wake-up call, but it was a call that too many of us slept through. The rise of spyware inside online advertising is the second alarm, and it is even louder. The question is whether we will open our eyes this time. We are living through a moment when the internet, once celebrated as a tool for freedom and connection, has become a battleground for control and manipulation. But history has shown that citizens can push back, that democracies can be rebuilt, and that technology can be redirected toward more humane ends. The fight will not be easy, and it will require courage, creativity, and solidarity. But as Maria Ressa’s work demonstrates, it is possible. So this October, let’s make cybersecurity awareness month more than just a slogan. Let’s make it a commitment to protect ourselves, each other, and the democratic values we still hold dear. We don’t have to be perfect, and we don’t have to win every battle. But we do have to start, and we can start today.