Surveillance Tech Firm Scraps US Marketing Force, May Just Continue Selling To Human Rights Abusers

Make enough bad choices and, sooner or later, those decisions are going to come back to haunt you. Or, at least, haunt the 50 or so employees you've laid off because your past performance has made it all but impossible to pitch your tech to US government agencies.

That's the case here, as reported by Ryan Gallagher for Bloomberg.

Computer networking companySandvinehas scrapped an effort to sell US law enforcement agencies a controversial internet surveillance technology that tracks encrypted messages and laid off most of the employees involved in the initiative, according to four people with knowledge of the matter.

Sandvine had pitched the new product, called Digital Witness," to governments and law enforcement agencies in Europe, the Middle East, Asia and North America. It was marketed as a tool to covertly monitor people's internet use and encrypted messages sent using popular applications such asMeta Platform Inc.s' WhatsApp andSignal, according to the people, who asked not to be identified to discuss confidential matters.

This tech can't actually crack encryption. But it can collect tons of metadata on encrypted communications, which can help identify who's talking to who, where they're talking, and how long/how often they're communicating. That alone could be enough to allow government agencies to do things like, say, identify journalists' sources or make inferences about their chosen social groups.

Dangerous in pretty much anyone's hands. Worse in the hands of those who are always looking for yet another way to track dissidents, government critics, opposition leaders, and anyone else that's inconveniencing the powers that be.

Sandvine was hoping to make inroads in the United States after experiencing some success elsewhere.

Owned by San Francisco-based private equity firm Francisco Partners, Sandvine told employees it had negotiated a deal to sell licenses for Digital Witness to Australia's Attorney-General's Department and provided trials to the US Drug Enforcement Administration and several state and local U.S. law enforcement agencies, according to the people. The FBI had expressed interest in conducting trials with the product, and the company was also pursuing potential sales to authorities in India, the United Arab Emirates, and Europe, the people said.

But it was the elsewhere" that kept it from achieving this goal. In the wake of international fiascoes like the one currently involving spyware maker NSO Group (and seemingly every other Israel-based malware manufacturer), the US government has gotten a bit more particular about who it's willing to do business with.

Sandvine didn't do itself any favors by building up an extremely questionable customer base before trying to sell federal agencies on Digital Witness.

In October 2020, a Bloomberg Newsinvestigationfound Sandvine's equipment had been used in more than a dozen countries - including Azerbaijan, Belarus and Eritrea - to censor content on the internet. After public protests and inquiries from US senators, Sandvine announced that it would no longer work with Belarus, saying that it abhorred the use of technology to suppress the free flow of information resulting in human rights violations."

Really? If Sandvine truly abhorred" contributing to human rights violations, it maybe shouldn't have sold its tech to human rights violators. I mean, it seems like the most obvious way to prevent this sort of thing from happening. It's not all that convincing to act like you're shocked that a completely foreseeable occurrence, you know, occurred.

As was noted in the opening of Gallagher's report, the 50-odd team of Western World-focused Sandvine reps also covered the rest of this continent. And they found a similar lack of interest for exactly the same reasons when pitching to our northern neighbor.

The [Royal Canadian Mounted Police] initially expressed interest, but backed away from the sale after raising questions about Sandvine's prior sales to a Belarusian government agency, according to the people.

With this market closed off and no longer supported by Sandvine, it will likely restrict its North American sales to its more innocuous products, like those used to manage internet traffic without snooping on it. What it will do with its remaining staff and its already-misused, more-intrusive products isn't discussed by anyone spoken to by Bloomberg. And there is no statement made anywhere that suggests it just won't go back to selling to human rights abusers. The article does mention the company is pursuing potential sales" to questionable governments like the United Arab Emirates and the ascendant autocracy that is India under Narendra Mohdi, so it's not like it won't find purchasers willing to shock" Sandvine reps yet again with completely foreseeable abuse.

But, I guess we can at least be thankful this surveillance tech won't soon (or possibly ever) be deployed by US government agencies and/or local law enforcement entities. That doesn't mean others won't fill this void. But maybe those competitors will at least have the common sense to secure US contracts before they start pitching their products to the worst governments on earth.