Exposed: Sandvine

Sandvine provides deep packet inspection (DPI) technology that allows internet service providers and governments to monitor, analyze, and manipulate internet traffic at the network level. The company's equipment is deployed by authoritarian regimes to conduct mass internet surveillance, censor websites, throttle VPN connections, and inject spyware into unencrypted web traffic. Sandvine technology has been documented enabling internet censorship and surveillance in Egypt, Belarus, Eritrea, and other authoritarian states. In Egypt, Sandvine equipment was used to redirect users to cryptocurrency mining scripts and to inject Predator spyware (a Pegasus competitor) into web browsing sessions. Despite being a Canadian company subject to export controls, Sandvine sold to autocratic clients for years before being placed on the US Entity List in 2024. The company was acquired by Francisco Partners, a private equity firm that also invested in NSO Group, creating a portfolio of surveillance companies under common financial control. Sandvine represents the infrastructure layer of surveillance, the pipes and routers that enable governments to see and control everything their citizens do online.