Thread by @sienaanstis

US Company @Sandvine has announced that it will no longer sell its technology to Belarus and has terminated the agreement. Great news (and great job @rj_gallagher for reporting on this so tenaciously). A thread. 1/

While good news, the scant details released by @Sandvine in response to the serious situation in Belarus serve to underscore (yet again) the total lack of transparency in the surveillance industry. 2/

@Sandvine purports to have a "business ethics committee" that reviews certain transactions. While some basic details are public, @sandvine basically fails to provide any insight into what is going on with ethics/human rights protection at the company: sandvine.com/company/corpor…. 3/

For example, the policy states that the BEC has to approve sales where "products and services [are] related to Regulatory Compliance use cases to a country that has low World Bank indices". What does the BEC consider a "low" World Bank index? 4/

That's just the very tip of the iceberg. For example, who sits on the BEC and how are they positioned relative to the rest of the company? What real power does the BEC have to veto a sale? Where are these powers spelled out and how can they be changed? 5/

How are BEC decisions protected from the rest of the company (and presumably the business goal of turning a profit)? How are BEC meetings documented? What other factors are considered beyond World Bank indicators? How did a sale to Belarus get approved in the first place? Etc. 6/

Window-dressing to satisfy the public is tempting, but I suspect it's only going to become a bigger and bigger headache for companies. I doubt this situation is going to end with @Sandvine's public statement being taken at face value. 7/

In closing, this is perhaps a good time to remind everyone that BECs haven't been doing too well in the surveillance industry as a mechanism for ensuring companies respect human rights (e.g. recall NSO Group): citizenlab.ca/2018/12/litiga… 8/