Networking firm Sandvine cancels Belarus contract, citing ‘custom code’ that aided censorship

The episode highlights the role that software and cybersecurity firms can quietly play in the violation of human rights.

Sandvine, an internet routing and networking company, said Tuesday it would stop doing business with Belarus after realizing that government was using its products to suppress information during a bloody crackdown on protesters.

“Sadly, preliminary results of our investigation indicate that custom code was developed and inserted into Sandvine’s products to thwart the free flow of information during the Belarus election,” the company said in a statement, which was first reported by Bloomberg News. “This is a human rights violation and it has triggered the automatic termination of our end user license agreement.”

Belarus has been in a state of turmoil following an August election marred by allegations of fraud in which President Alexander Lukashenko, who has held power for a quarter-century, claimed victory. State security forces have arrested thousands of people and subjected hundreds to torture, according to Human Rights Watch.

Sandvine was founded in Canada and is backed by a San Francisco-based equity firm Francisco Partners. The firm, which says it sells data-collection and other telecom products in more than 100 countries, reportedly played a key part in Lukashenko’s attempt to stifle information. The government used equipment to block Belarusians’ access to Twitter and Facebook, along with international news sites, Bloomberg reported.

Twitter and virtual private network providers also reported service disruptions during the demonstrations. The episode highlights the role that software and cybersecurity firms can quietly play in the violation of human rights.  Surveillance software marketed by other firms have been used to spy on dissidents and journalists from Turkey to Morocco.

The revelations prompted Sen. Dick Durbin, D-Ill., to call for a U.S. Treasury investigation to determine if Sandvine had violated U.S. sanctions, according to Bloomberg. In its statement Tuesday, the company denied that was the case. “We abhor the use of technology to suppress the free flow of information resulting in human rights violations,” Sandvine said.

This isn’t the first time Sandvine has been accused of abetting censorship or the manipulation of web traffic. A 2018 investigation by the University of Toronto’s Citizen Lab found that technology that matched Sandvine devices’ digital fingerprint was being used to inject malicious code into web connections for people in Egypt, Turkey and Syria. At the time, Sandvine dismissed some of the allegations as “technically inaccurate and intentionally misleading” but did not provide further details.

Twitter, VPN services in Belarus disrupted during violent crackdown

The mostly peaceful protests represent the largest threat to the authoritarian government since 1994.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure