Waterloo, Ont. tech company responds to surveillance, spyware allegations

Waterloo tech company responds to allegations Sandvine is speaking up after allegations were made that it supplied tech that was used for mass surveillance. Spencer Turcotte explains.

A Waterloo, Ont. tech company has responded to allegations it supplied technology that was used for mass surveillance and censorship.

In September, CTV News Kitchener reported on Sandvine's deals with autocratic governments, including Egypt, where its tech reportedly helped inject spyware into the devices of government critics.

After the first story, Sandvine posted a statement on its website saying it was acquired by a group of U.S. investment firms and listed several changes in consultation with the U.S. Department of Commerce and other key members of the U.S. government.

"It seems like it's a bit of a typical response. We are going to invest in digital rights, we are going to stop selling to the countries in question. We are going to try and rebuild trust," said cybersecurity and technology analyst Ritesh Kotak, referring to some of Sandvine's promises.

In the company statement, Sandvine lists several "transformative changes" which includes dedicating one per cent of all profits to protecting digital rights, new ownership and a new name.

The company's statement also says in part: "We acknowledge past misuse of Sandvine's products, as well as the fact that the company's response to past reports of misuse was insufficient."

Sandvine says they have already exited 32 countries and are in the process of exiting an additional 24 where the democratic process is in question.

They've identified an end-of-service date of March 31, 2025 for government of Egypt customers.

As for remaining Egyptian customers and all other identified countries, December 31, 2025 is the end-of-service date.

"It looks good on paper, but who is going to be doing the checking? How are we to know that they will be following these guidelines into the future?" said Ron Deibert, director at The Citizen Lab, an internet watchdog based at the University of Toronto.

After the lab published a report on Sandvine's tech in 2023, the Waterloo-based company was placed on the U.S. Department of Commerce entity list, which prevented Sandvine from doing business south of the border.

"It's kind of sad, as a Canadian I have to say, that it took the United States' action to precipitate these measures," said Deibert. "The Canadian government is asleep at the wheel, frankly, when it comes to export controls of this type of dual-use technology."

CTV News Kitchener asked Global Affairs Canada about repeated calls for tighter export controls on technology. They acknowledged our request but were not able to provide comment in time for publication.

"However, it's also important to understand that, yes, Canada is a big market. The U.S. is a much bigger market. If the U.S. puts you on any sort of list, that has massive repercussions for an organization, probably in comparison," said Kotak.

There is also concern from critics about whether Sandvine's promises are performative, especially considering their history.

"This is a company that, when asked questions by groups like ours, has been quite aggressive," said Deibert. "In fact, threatening The Citizen Lab and myself with litigation at one point."