In an office in Dubai, half a world away from Sandvine’s headquarters in Waterloo, Ont., the company was scrambling to survive. It was April and Sandvine, which had just been blacklisted by the U.S. for allegedly selling its technology to authoritarian governments, was rejecting all new business. 

Staff in Dubai were directed to turn away pretty much anyone, including existing customers, a former sales director in Dubai told The Logic. The office was the regional headquarters for Sandvine’s operations in the Middle East and Africa—and the epicentre of its recent troubles around alleged censorship and surveillance. As business dropped off, staff stopped showing up. Some were laid off, with others staying home as morale sank.

“It’s unfortunate,” said the former sales director, who was laid off in September. But, he added, being let go wasn’t a surprise. The company, he expected, wouldn’t survive much longer, either. While not a shock to many, Sandvine’s collapse has been dramatic. Since being blacklisted by the U.S. on Feb. 28, the company haemorrhaged cash as it cancelled contracts left right and centre to try and save itself.

Court documents filed in November show the depth of Sandvine’s financial hole. Its 2024 revenue will be 50 per cent lower than in 2023. In June, as Sandvine nosedived, Francisco Partners, the private equity firm that bought it in 2017, walked away, leaving the company to debt holders, to whom Sandvine owes US$431.8 million. Now, the company is desperately seeking a buyer before its emergency funding runs out and its protection from creditors ends. 

“These proceedings are an important and positive development in this ongoing process, allowing us to optimize our capital structure to lay the foundation for long-term investment and success,” company spokesperson Sydney Cohen said in an emailed statement.

The blacklisting might have kneecapped Sandvine, but the industry in which it operates is inherently controversial. Sandvine has long had an internal policy to screen customers that might misuse its technology, the former Dubai sales director said. While customers in his region were denied from time to time, he said, rejections increased dramatically after the blacklisting. 

Human rights activists, meanwhile, have long taken aim at Sandvine for how its technology apparently allows authoritarian regimes, including Russia, Belarus and Egypt, to control and monitor internet use. But, insiders say, it wasn’t always this way. 

Two longtime senior employees who spoke to The Logic point to the arrival of Francisco Partners as a turning point for the company as it lost touch with its values and began operating with increasing secrecy. “I’m sad, embarrassed, concerned,” said one longtime senior Sandvine employee, who requested anonymity so he could speak freely about the business. “Sandvine is something I’m still very proud of, and this is terrible.”

---

Sandvine, which was founded in 2001, emerged from the ruins of the dot-com boom. Two of its founders, Brad Siim and Marc Morin, along with three other employees, Tom Donnelly, Dave Caputo and Don Bowman, took payouts from Cisco’s bungled takeover of PixStream to create the new venture. Before it even had a product, Sandvine raised $19.5 million in seed funding, largely the result of investor belief in the people behind it.

The team soon landed on building technology to help telecommunications providers see what kind of traffic was running on their networks, allowing them to adjust network capacity, and improve speed and security.

As internet access rates soared, so did Sandvine’s business. It grew from eight customers in 2003 to more than 60 service providers in 29 countries by September 2006. Annual revenue jumped from about $2 million in 2003 to nearly $16 million in 2005.

Driving the business was the goal to “make broadband better,” said one of Sandvine’s early, senior employees. “It sounds corny,” he said, “but it’s something we took very seriously.” The company’s global ambitions prompted it to go public in 2006, first in London and then Toronto.

Operating under the scrupulous watch of public investors, however, wasn’t always easy. The company had big sales contracts but the cycles between them could be long, and expenses were high, which meant cash reserves could look uncomfortably low, the former senior employee said. “When we were doing $120 million a year, $30 million a quarter, we had maybe $5 million or $6 million of recurring revenue in our pipeline,” he said. The company managed that cash-flow rhythm privately for years, but it spooked some public investors. “As a publicly traded company, that was very, very visible. That was an ongoing issue.” 

The company first started exploring going private after receiving an unsolicited bid from an interested buyer in 2013. Sandvine wanted to restructure as a software-as-a-service business, moving away from selling hardware. The model would eventually give the company more recurring revenue, but first it would require deferring even more revenue into the future, said the former employee, which would be unpopular with public shareholders, he said. 

Are you a current or former employee at Sandvine? We’d like to hear from you. Using a nonwork phone or computer, contact Catherine McIntyre at [email protected] or securely via Signal on catmc.13.

Sandvine considered offers from three other investors in 2015 and 2016, and decided in 2017 that a $562-million takeover bid from U.S. private equity giant Francisco Partners was the best deal for Sandvine’s shareholders. Beyond the deal value and transaction terms, Sandvine’s leadership didn’t know much about Francsico’s plans for the company, said the former employee—just that it would merge the firm with its U.S. rival Procera Networks, which Francisco had bought two years earlier. 

Sandvine’s leadership team assumed they would stay on to manage the new combined company. “We were the market leader compared with Procera,” said the former senior staffer. “We thought, if there is a merger, they’re going to pick the better team.” 

But the company chose Procera to lead the new firm, and Sandvine’s executives left in the months that followed, ushering in what one described as “Sandvine 2.0.” A small concession, one of them said, was that the company kept the Sandvine name. “At the time that felt important to us,” he said, “for no good reason other than maybe pride.” In hindsight, he said that desire was perhaps foolish. “What’s a name if we’re not there to protect it?”

---

Under the ownership of Francisco Partners, Sandvine’s operations became more covert. It was 2017 and internet use globally was surging. That year, when Francisco took charge, there were 3.5 billion people online, up from three billion in 2015. By 2019, 4.1 billion were online. The increased activity meant more demand for Sandvine’s technology, as well as more opportunities to misuse it. 

In 2018, an investigation by Citizen Lab, a research unit at the University of Toronto, found that Sandvine’s technology was seemingly now being used to infect devices in Syria and Turkey with spyware. In Egypt, Citizen Lab found that Sandvine’s technology was being used to send traffic to a cryptocurrency mining operation. These interventions, Citizen Lab said, presented significant human rights concerns, by infiltrating peoples’ devices and violating their privacy. 

When the group presented its research to Sandvine and Francisco Partners, Sandvine responded with legal threats. It called the findings “false, misleading, and wrong,” and demanded that a Sandvine device, known as a PacketLogic, that Citizen Lab had purchased on eBay to carry out its investigation, be returned. Ronald Deibert, the director of Citizen Lab, said that after a back and forth between lawyers on both sides, Sandvine dropped its threats and the report was published.

The findings seemingly did little to change Sandvine’s path. In August 2020, as people in Belarus took to the streets to protest a rigged election, Sandvine’s technology was reportedly used to effectively shut down the internet. Outcry following the incident prompted Sandvine to end its contract with the dictatorship in Minsk. 

In 2022, Bloomberg reported that Sandvine had also pursued business with telecommunications providers in Russia in 2018 as the government built out a nationwide digital censorship system. The company said it stopped sales in Russia after it invaded Ukraine.

Again, Sandvine seemingly carried on its business as usual. In September 2023, another Citizen Lab investigation found that the company’s technology appeared to have been used in Egypt to try and inject malware onto a device owned by Ahmed Tantawy, a former lawmaker who planned to run against incumbent president Abdel Fattah el-Sisi. Tantawy eventually dropped out of the race amid alleged harassment against his team and supporters.

In February 2024, five months after that report was published, the U.S. Commerce Department blacklisted Sandvine. The company’s tools facilitated “mass web-monitoring and censorship,” the department said, and helped target “political actors and human rights activists.” 

“There’s a big failure here,” said Deibert. “It took another government, the United States government, to essentially punish and regulate this company in the absence of Canada doing anything.” Deibert said he’s been pressing Ottawa for years to exert export controls over Sandvine’s technology to prevent it from being used to censor and surveil people. Those calls have been largely ignored, he said. 

When asked what export rules Sandvine is subject to, Global Affairs press secretary Isabella Orozco-Madison pointed The Logic to Canada’s export control list of items that require permits or licences to sell abroad. The list includes a range of goods like firearms, nuclear supplies, food products, lumber and technology that could be used for military uses—but no categories that would include technology like Sandvine’s. 

“Canada’s export controls are in general narrower than the export controls that apply in the United States,” said Jessica Horwitz, a partner at law firm Bennett Jones, specializing in international trade and investment. U.S. laws allow the government to cut off the flow of domestic goods and services to any company, like it did with Sandvine. In Canada, export controls target specific product categories, requiring Canadian firms to get a permit to sell those items outside the country. 

“If Canada wanted to control the export of a particular technology, it would need to amend the export control list,” said Horwitz, which, she said, is uncommon. While Canada’s sanctions lists can bar exports to certain countries and individuals, they still aren’t as broad or as flexible as the U.S. entity list on which Sandvine found itself. 

It’s hard to know for sure if human rights issues got worse under Francisco Partners’ ownership, said Deibert. As a private company, it didn’t disclose its customers or the specific markets in which it operated, or how it decided if a client will use its technology responsibly. That made it hard to hold the firm accountable, said Deibert. Even through its ongoing bankruptcy protection process, Sandvine hasn’t disclosed which creditors now control the company. 

Records filed in bankruptcy courts in the U.S. and Canada reveal the devastating impact of Sandvine being blacklisted by the U.S. It couldn’t access technology and services it needed from U.S. firms, including Zoom, Intel and Microsoft, hobbling its daily operations. Customers paused their purchase orders, and prospective clients lost interest in working with the embattled company. 

To try and save itself, Sandvine also tried to shut down its operations in countries it deemed non-democratic in an effort to get off the entity list as quickly as possible. The company wouldn’t say which specific countries it’s leaving—except Egypt, which it plans to exit by 2025—just that the exits are based on the Economist Intelligence Unit’s 2023 Democracy Index. 

The drop in business left the company cash-strapped and unable to service its debt. In June, it began a restructuring plan, supported by 97 per cent of its lenders, court records show. The strategy involved existing debt holders taking control of Sandvine from Francisco Partners, converting debt obligations into equity, and investors agreed to kick in an extra US$45 million in emergency financing while agreeing not to penalize Sandvine for defaulting on its loans. Sandvine is still looking for a buyer to take on its debt, rehabilitate its finances and attempt to mend its battered reputation. It has until Jan. 27 to accept binding offers, and a March 21 deadline to close a deal. 

“We already know we have a viable plan, subject to court approval,” Cohen, the Sandvine spokesperson, said of the company’s restructuring plan. 

Cutting off the limb of authoritarian regimes using its technology has allowed Sandvine to hobble on, for now. On Oct. 23, the company was removed from the U.S. blacklist. By then, the company had left 32 countries and planned to leave another 24—markets that made up 45 per cent of its revenue in 2023. Sandvine also said it would replace its chief executive Lyndon Cantor and install a CEO with “human-rights focused leadership.” The company says it has already appointed a new board. Its website still lists Cantor as its CEO, and as of Dec. 2, the company hadn’t updated its board members in business registry records in B.C., where it’s incorporated. Going forward, one per cent of its profits, it said, will go to internet freedom and human rights organizations. 

The company declined The Logic’s request for an interview and did not answer specific questions about its ownership, its export requirements or what its future in Canada might entail. Instead, Cohen pointed to existing public statements about Sandvine’s leadership changes and commitment to exclusively serve democratic markets. 

The damage, however, may be irreversible. Sandvine is a shell of what it was. As of Oct. 25, it had 475 employees worldwide, about 40 per cent fewer than early this year. Canada is still home to its largest workforce, with 87 staff, but the company would not say whether that will be the case if and when it’s sold, or if it will keep Waterloo as its global headquarters. 

As part of its restructuring, Sandvine has said it will soon change its name, erasing one of the last remaining relics of the original company. “It’s a sad story,” said the former sales director, who lamented the downfall of another globally successful Canadian tech firm, like Nortel and BlackBerry before it. “It will not be the same company again.”