A company whose Internet-filtering servers were recently found to have been used by Syria’s regime for
censorship is facing a new research report that Myanmar, too, uses its technology—and that the Syrian
use is wider than acknowledged.

The findings released today by the Citizen Lab, an Internet research center at the University of Toronto,
are the latest evidence that commercial technology from the West—in this case from Blue Coat of Sunnyvale,
California—is often used by repressive regimes, says Ron Deibert, the lab’s director, who posted the findings today in a blog.

“Prior research by our group, and others like it, have highlighted the growing market for censorship,
surveillance, and even offensive computer network attack products and services,” Deibert says. “It is distressing
that many, but not all, of the companies that sell this technology are based in liberal democratic regimes.”

A spokesman for Blue Coat, Steve Schick, said he hadn’t seen the report and pointed to the company’s October
statement about the Syrian matter. The company said in that instance that its technology made its way to
Damascus by means of an “improper transfer.” It said it had sent 14 of its ProxySG 9000 filtering appliances
to Dubai in 2010, thinking they were headed for the Iraqi Ministry of Communications. “Blue Coat is mindful
of the violence in Syria and is saddened by the human suffering and loss of human life that may be the result
of actions by a repressive regime,” Blue Coat said in its statement at the time. We don’t want our products to
be used by the government of Syria or any other country embargoed by the United States. If our review of the
facts about this diversion presents solutions that enable us to better protect against future illegal and unwanted
diversion of our products, we intend to take steps to implement them.”

As for the new report on Myanmar (formerly known as Burma), “this is the first it’s really been raised,” Schick
said. He added that the company was starting an investigation into whether its products were used by the
government. Blue Coat says its primary customers are corporate networks that seek to filter the Internet to protect themselves.

Both Syria and Myanmar are known for serious human-rights violations and are subject to U.S. trade embargoes.
In Syria, the United Nations says that the government of President Bashar al-Assad has killed more than 3,500
people over the course of the citizen uprising that has gone on for eight months. Last month, the Wall Street Journal
reported that Blue Coat’s technology was used to help the government block or log Syrians’ attempts to connect to
facebook.com/syrian.revolution and other sites related to protests against the government.

The latest report from the Toronto group indicates that Blue Coat’s technology was more widely used in Syria than
previously thought. Deibert says that while the company acknowledges 13 of its servers ended up in Syria, forensic
analysis of networks shows that at least 15 of its devices are in use there. And after Citizen Lab conducted a forensic
examination of Internet traffic in Myanmar, “we found very strong evidence that Blue Coat devices are presently
employed in Burma at the highest level to censor the Internet and facilitate surveillance,” he said. The report
offers no insight into how the devices, if they are indeed in use in Myanmar, might have ended up there.

Deibert said prior Citizen Lab reports showed that products from the Canadian company Netsweeper are being
used in a variety of countries to block access to Web content related to human rights, political opposition, and
gay and lesbian issues. Technology from McAfee, now owned by Intel, and Websense has also been used in
repressive regimes. In a recent blog post, Websense called on the industry to regulate itself more tightly.

Deibert called on Blue Coat to take action to prevent further use of its technology by repressive regimes.
But it’s not clear that the transfer broke any U.S. embargo. “We are unclear whether it constitutes a
violation of the sanctions according to the strict reading of the sanctions themselves,” Deibert says. “But
certainly they constitute a violation of the spirit of the laws, and raise some serious questions about lack
of due diligence on the part of Blue Coat.”

Calls to the State Department press office about Blue Coat were not immediately returned.