The Canadian Government Has Funded a Notorious Censorship Company for a Decade
Netsweeper may be building a 'Great Firewall' in Bahrain.
A cameraman films Bahraini protesters in 2011. Image: Flickr/Al Jazeera English
While Justin Trudeau is busy promoting the image of a newly enlightened Canada on the world stage, a company headquartered in Waterloo, Ontario is allegedly silencing dissidents and religious minorities in Bahrain by censoring the internet on behalf of that country's repressive government.
This is according to a new report from research hub Citizen Lab at the University of Toronto, which finds that the company, Netsweeper, installed equipment on the networks of nine major internet service providers in Bahrain between May and July of this year to filter out websites that critics of the government, human rights organizations, and the Shia religious minority use to communicate with the populace.
Bahrain is known for jailing online dissidents and for its horrific human rights record, including deportation and ongoing allegations of torture. The country has been listed as an "enemy of the internet" by Reporters Without Borders since 2012 thanks to that government's censorship, surveillance, and its practice of hacking activists who are based outside the country.
"It's been widely reported that Bahrain censors internet content," said Ron Deibert, director of Citizen Lab, in an interview at the lab's offices in Toronto. "You can see it in the news of the riots and the persecution of Shiites." Citizen Lab's research indicates that Netsweeper is now playing an active role in that censorship.
Both the Canadian federal and provincial governments have funded Netsweeper for over a decade with grants and other supports, and continue to do so, despite numerous news stories and investigations into Netsweeper's censorship activities during this period.
Netsweeper's system in Bahrain, as outlined by Citizen Lab, is simple but effective. The Citizen Lab report notes that whenever someone in that country attempts to access a site that has been blocked, Netsweeper's equipment detects their request and sends a block page back to the user.
This technique described by Citizen Lab is known in hacker communities as "packet injection," and can also be used to serve malware using web pages loaded with malicious code.
Citizen Lab used several methods in its investigation into Netsweeper's activities in order to identify the company's unique software fingerprints in Bahrain—bits of code that Citizen Lab pinpointed in previous investigations as solely being used by this company.
The most damning evidence that Citizen Lab provides in the report are the results of a "beacon box" test conducted by its own team. For this test, the researchers set up a dummy website in Canada filled with innocuous content or no content at all. Then, the team got an anonymous tester in Bahrain to access the site from inside the country. Since the Toronto-based researchers controlled the website and the server, they could see every bit of code coming from Bahrain. What they found was Netsweeper's system attempting to fit the fresh site into a censorship category.
"When we see them coming to our website to categorize it, that again confirms that not only is Netsweeper active, but the company cannot legitimately claim that they provide this service and then wash their hands of it—there is ongoing, dynamic support," Deibert said.
Although Citizen Lab said that it confirmed Netsweeper equipment at nine service providers in Bahrain, due to concerns over the safety of its researchers in that country, the report only confirms filtering using Netsweeper technology at one Bahraini provider—Batelco, the most prominent telecom in the country—although Deibert said he's confident that future testing will confirm the same at the other eight providers.
Netsweeper, which has fewer than 50 employees, isn't violating any Canadian laws by providing its services to Bahrain, Deibert said. But, if Citizen Lab's findings are accurate, then the company's activities fly in the face of Canada's international human rights obligations and commitments regarding free speech online.
"The Canadian government is encouraging this business, and this business is selling services that violate international human rights that Canada is ostensibly promoting—how does that square?" said Deibert.
In advance of publication, Motherboard contacted Netsweeper by phone and email numerous times over a week. On Tuesday, the day before publication, it outlined the specific allegations contained in this report. The company did not respond to Motherboard's request for comment.
Bahrain is an important trading partner for Canada in the Gulf region, with imports rising from $4 million CAD to more than $40 million between 2011 and 2015.
The Canadian government has also funded Netsweeper's activities for a decade with hundreds of thousands of dollars worth of grants.
As far back as 2003, Canada was supporting Netsweeper's presence at foreign trade shows. Netsweeper received two grants from the National Research Council (NRC) amounting to $350,000 in 2007 and 2009, according to The Toronto Star. The Canadian government also contracted with Netsweeper twice, in 2009 and 2011, for roughly $3,600 in total. Also in 2011, the Ontario government singled out Netsweeper as a success story for the province's Export Market Access program to assist businesses in reaching international markets with a grant of up to $150,000.
At the time, in 2011, Netsweeper was openly advertising that it sold internet filtering tools to governments in the Middle East and could block sites "based on social, religious or political ideals."
In 2012, the NRC gave Netsweeper another grant totalling $46,430. And despite a Citizen Lab report detailing Netsweeper's censorship activities in Pakistan the following year, the company was again approved for participation in the Ontario export markets program in 2014. One year later, in 2015, Citizen Lab showed that Netsweeper was providing filtering technologies to rebels in Yemen during a bloody civil war.
Next month, the Ontario government will share a booth with Netsweeper at a major trade show in Dubai called GITEX, where select Ontario-based companies will hawk their digital wares under the province's banner. An Ontario government spokesperson confirmed that Netsweeper was invited to participate.
"Canada is committed to working with our partners to ensure the Internet is kept open, safe, and accessible," Alex Lawrence, a spokesperson for Minister of International Trade Chrystia Freeland, wrote me in an email. "We support the promotion of human rights and free speech online. We expect Canadian businesses to operate lawfully and according to Canadian values."
When asked about the grants given to Netsweeper over the years, Lawrence wrote, "We cannot comment on services provided to specific businesses due to commercial confidentiality."
Early in August 2016, coinciding with the timing of the alleged Netsweeper installations in Bahrain, the Bahraini government dictated that all service providers must use a unified internet censorship solution that can be centrally controlled by the government. It's not clear if Netsweeper is providing this censorship system, although Citizen Lab reports that the company's technology has a feature called "up2date" that, if enabled, can push system-wide updates across equipment installed on multiple networks, suggesting that this might be the case.
"What's unique is that all nine internet service providers got Netsweeper's technology at the same time," said Jakub Dalek, a Citizen Lab researcher who co-authored the report on Netsweeper. "The country of Bahrain, a very large plurality, has installed these devices all at the same time period. I haven't seen that in other countries."
Netsweeper's technology is both a cost-savings measure for large companies, and a cheap way for smaller providers to keep pace with government requirements to censor content, Dalek said.
"The reason that people would use Netsweeper over others is that the software can be installed on any sort of hardware," Dalek said. "If I have a Dell server, I can install the software as-is onto that. It's flexible and very cost-effective."
In June of this year, the Canadian government announced that it had co-founded the international Freedom Online Coalition, which seeks to "protect freedom of expression" online and "voice concern over measures that curtail human rights online."
Netsweeper's continued business with Bahrain and other repressive regimes would certainly appear to meet those requirements, as outlined in this new Citizen Lab report. So where is the smiling face of Canada's humanitarianism and support for freedom of speech now?