Sandvine bid concerns internet watchdog

Companies, government urged to do more to ensure Canadian tech doesn’t end up in wrong hands

WATERLOO — An offer from a U.S. company to buy Sandvine Corp. underscores the need for closer scrutiny of deals in which Canadian technology could be used by oppressive governments that abuse human rights, says an internet watchdog.

Francisco Partners has offered to buy Waterloo-based Sandvine, a maker of hardware and software that helps manage network traffic, for $4.15 a share. The offer came a month after Vector Capital announced a deal to buy Sandvine for $3.80 per share. That offer valued Sandvine at $483 million.

Vector, also headquartered in San Francisco, has until the close of business on July 6 to match the offer from Francisco Partners.

Ron Deibert, director of The Citizen Lab at the University of Toronto’s Munk School of Global Affairs, said technology companies and the federal government must do more to ensure Canadian technology is not used against human rights advocates, journalists and dissidents.

Deibert said private companies can take the socially responsible approach and first learn who is buying the technology and how it will be used.

He said governments need to look closely at deals that involve what he calls “dual-use technologies” — technology that can be used for benign commercial practices or mass and targeted surveillance.

Sandvine’s “deep packet inspection” technology, which is used to examine and classify data that moves across internet networks, is classic dual-use technology, he said.

“That type of technology requires some sort of due diligence,” said Deibert.

Neither Sandvine nor Francisco Partners responded to requests for interviews.

Francisco Partners, with offices in San

Francisco and London, is a private equity firm that has raised more than $10 billion and has invested in more than 85 companies in software, security, the internet, health care IT, financial technology and communications.

Deibert and The Citizen Lab are closely watching how the sale of Sandvine is handled in the coming days because of the offer from Francisco Partners.

“Now when it comes to this sale you have this investment group, Francisco Partners, that is definitely involved in the national security arena,” said Deibert.

“In the past, I know Sandvine has claimed it is not a player in that marketplace, but if they are controlled by Francisco Partners, it is certainly possible they could be pushed in that direction,” said Deibert.

That’s what happened when Francisco Partners invested in and took control of Procera Networks in 2015. Some employees at Procera resigned in protest as the company provided technology to Turkey’s authoritarian government, enabling it to spy on its own citizens.

Francisco Partners also controls the NSO Group, an Israeli cyber warfare company that created malware called Pegasus. NSO has sold the malware to the United Arab Emirates and Mexico, where it was used to spy on journalists and anti-corruption advocates, human rights activists, human rights lawyers, politicians and health scientists.

“This is all, I would certainly say, cause for concern,” said Deibert.

There is a lot of enthusiasm around the tech sector for its job creation and exports, but little in the way of policy and incentives to ensure Canadian technology is not used against dissidents or to choke free expression, he said.

“I don’t think it has been given much systematic thought by either governments or companies,” said Deibert.

He is supported by PEN Canada, which has documented and published reports on how spyware provided by NSO was used against journalists in Mexico.

“We would certainly be extremely concerned at any government using surveillance in that way to intimidate human rights defenders, activists and journalists,” said Brendan de Caires, program co-ordinator for PEN Canada.

Last November, Deibert appeared before the Senate’s standing committee on human rights to talk about the issues around exports of Canadian technology and human rights. Jim Munson, the senator who chairs the committee, aims to publish a report on the subject this fall.

In his presentation to the committee in November 2016, Deibert said he documented numerous cases of human rights activists and civil society organizations being targeted with advanced commercial spyware sold by NSO, among others.

“Although our research at the Citizen Lab has not to date identified a Canadianbased vendor of commercial spyware selling to rights-abusing countries, we know that companies selling this type of technology do exist,” Deibert said in the presentation.

“Furthermore, the growth of the market, coupled with other circumstances, suggest it’s highly likely that a Canadian vendor would at some point in the not-too-distant future face the choice of whether or not to sell its technology and services to a rights-abusing country, if that hasn’t already happened,” he said.

Deibert called for government export controls and regulations for dual-use technology, self-regulation by the industry, and allowing people hurt by Canadian technology in other countries to sue for damages in Canadian courts.

Based on Deibert’s comments to the senate committee, the track record of Canadian technology firms in other countries is not always encouraging.

“The fact that Citizen Lab has documented at least seven countries whose national ISPs (internet service providers) use or have used a Canadian company’s services to censor Internet content protected under internationally recognized human rights agreements is an embarrassing black mark for all Canadians,” said Deibert.