Sandvine Scraps Plan to Market Tool in US That Tracks Encrypted Messages

Computer networking company lays off 50 employees, including many of those working on ‘Digital Witness’

(Bloomberg) — Computer networking company Sandvine has scrapped an effort to sell US law enforcement agencies a controversial internet surveillance technology that tracks encrypted messages and laid off most of the employees involved in the initiative, according to four people with knowledge of the matter.Sandvine had pitched the new product, called “Digital Witness,” to governments and law enforcement agencies in Europe, the Middle East, Asia and North America. It was marketed as a tool to covertly monitor people’s internet use and encrypted messages sent using popular applications such as Meta Platform Inc.s’ WhatsApp and Signal, according to the people, who asked not to be identified to discuss confidential matters.Sandvine had already provided trial versions of the technology in the US, these people said. But a combination of broader economic woes and lingering concern over the company’s previous work with authoritarian governments hindered the product’s success, the people said.Sandvine declined to comment when asked about Digital Witness. The company’s marketing materials indicate the product is sold only to law enforcement and government agencies, and it is still listed on Sandvine’s website.Sandvine Chief Solutions Officer Samir Marwaha said in an emailed statement that about 50 employees were laid off. The job cuts were “directly attributable to the state of the global economy,” he said, adding that the reassignments had been made “to better align to serving our customer base.” Marwaha declined to comment on specific products or customers. 

It wasn’t immediately clear if Sandvine also stopped sales abroad. 

Digital Witness doesn’t hack the device or bypass the encryption, the way spyware can infiltrate a mobile phone. Rather, it analyzes troves of encrypted traffic as it flows across internet networks, gathering and analyzing metadata about the communications, according to the people and marketing materials. On its website, Sandvine touted Digital Witness as a “revolutionary solution designed to help investigatory agencies extract leads from network data,” which it said could help classify and correlate encrypted traffic, messages, voice calls, contacts, cryptocurrency transactions and details about a person’s lifestyle.In the last decade, encryption has become more widespread, improving privacy protections for individuals but making it harder for law enforcement and intelligence agencies to eavesdrop on suspects’ communications and internet use. Sandvine’s Digital Witness sought to address that challenge, offering a powerful tool for police agencies seeking to identify drug rings or criminal syndicates, as it could help them find networks of people through their communications, according to the company’s marketing materials.But in the wrong hands, the technology could be abused, said Natalia Krapiva, tech-legal counsel at the digital rights group Access Now. “Journalists and activists in repressive countries use encrypted messengers to protect themselves and others from government surveillance and retaliation,” Krapiva said. A tool like Digital Witness, she added, could be used to pierce those protections, putting people at risk of human rights violations.Owned by San Francisco-based private equity firm Francisco Partners, Sandvine told employees it had negotiated a deal to sell licenses for Digital Witness to Australia’s Attorney-General’s Department and provided trials to the US Drug Enforcement Administration and several state and local U.S. law enforcement agencies, according to the people. The FBI had expressed interest in conducting trials with the product, and the company was also pursuing potential sales to authorities in India, the United Arab Emirates, and Europe, the people said.

However, before those deals could close, in June of this year, Sandvine laid off most of the team of about a dozen people who were working on the product, according to the people. That ended efforts to sell it in North America and left other global sales in limbo, since so many employees were let go, they said.In all, Sandvine’s leadership cut employees from offices in the US, Canada, Sweden and India earlier this year and reassigned scores of others amid company reorganization, the people said.

The DEA and the FBI declined to comment. A spokesperson for Australia’s Attorney General’s Department said it hadn’t purchased a license for Sandvine’s Digital Witness or received a trial of the product. 

Sandvine, originally founded in Canada, was acquired by Francisco Partners and combined with Procera Networks in 2017, in a deal worth $444 million.  

The company makes equipment, known as “deep packet inspection” technology, which can be used to manage massive flows of internet traffic passing between networks. Telecommunications companies often utilize the technology for innocuous purposes, such as monitoring their customers’ data usage or blocking out spam or malware from networks. But it can also enable government-mandated censorship and surveillance, which has placed Sandvine — and other companies selling similar technology — at the center of several controversies.The company could use its technology to “show who’s talking to who, for how long,” said Chief Technical Officer Alexander Haväng, in an internal newsletter circulated in August 2020, before the company began marketing Digital Witness. The newsletter was reviewed by Bloomberg News. Haväng led the Digital Witness initiative, according to the people.“Because we can, I think we should,” Haväng wrote. “We can help make the world a better place with the appropriate application of our technology.”In October 2020, a Bloomberg News investigation found Sandvine’s equipment had been used in more than a dozen countries — including Azerbaijan, Belarus and Eritrea — to censor content on the internet. After public protests and inquiries from US senators, Sandvine announced that it would no longer work with Belarus, saying that it abhorred “the use of technology to suppress the free flow of information resulting in human rights violations.”

Early in 2022, Sandvine began expanding a new team focused on making more sales to government agencies, and added to its suite of network management tools its Digital Witness product, which was tailor-made for the purpose of government internet surveillance.Historically, Sandvine has made most of its sales by marketing its equipment to telecom companies — or to government telecom regulators to help them manage internet traffic flowing across their networks, according to sales documents reviewed by Bloomberg News. 

Digital Witness marked a significant strategic shift for the company into the lucrative surveillance technology market, where it planned to repurpose its deep packet inspection equipment into a powerful spy tool for governments and law enforcement agencies. But problems with that strategy surfaced last year, when Sandvine pitched the product to the Royal Canadian Mounted Police.The Canadian law enforcement agency initially expressed interest, but backed away from the sale after raising questions about Sandvine’s prior sales to a Belarusian government agency, according to the people.

The RCMP said in an emailed statement that it “conducts thorough and objective evaluations” of new technologies before they are used during active operations to ensure they provide a clear benefit to the public and meet privacy, legal, policy and ethical standards. It added that it had “not assessed or purchased” the use of Digital Witness. Sandvine declined to address questions about the prospective Canadian sale.



More stories like this are available on

©2023 Bloomberg L.P.