Protei Hack: Deep Packet Inspection Data Exposed

A Russian telecom company that develops technology to allow phone and internet companies to conduct web surveillance and censorship was hacked, had its website defaced, and had data stolen from its servers, TechCrunch has learned.

Founded in Russia, Protei makes telecommunications systems for phone and internet providers across dozens of countries, including Bahrain, Italy, Kazakhstan, Mexico, Pakistan and much of central Africa. The company, now headquartered in Jordan, sells video conferencing technology and internet connectivity solutions, as well as surveillance equipment and web-filtering products, such as deep packet inspection systems.

Contents of Protei’s web server

It’s not clear exactly when or how Protei was hacked, but a copy of the company’s website saved on the Internet Archive’s Wayback Machine shows it was defaced on November 8. The website was restored soon after.

During the breach, the hacker obtained the contents of Protei’s web server — around 182 gigabytes of files — including emails dating back years.

Datasets in the public interest

A copy of Protei’s data was provided to DDoSecrets, a nonprofit transparency collective that indexes leaked datasets in the public interest, including data from law enforcement, government agencies, and companies involved in the surveillance industry.

Mohammad Jalal, the Managing Director of Protei’s branch in Jordan, did not respond to a request for comment about the breach. 

The identity of the hacker is not known, nor their motivations, but the defaced website read: 'another DPI/SORM provider bites the dust.' The message likely references the company’s sales of deep packet inspection systems and other internet filtering technology for the Russian-developed lawful intercept system known as SORM.

Install SORM equipment on networks

SORM is the main lawful intercept system used across Russia as well as several other countries that use Russian technology. Phone and internet providers install SORM equipment on their networks, which allows their country’s governments to obtain the contents of calls, text messages, and web browsing data of the networks’ customers. 

Deep-packet inspection devices allow telecom companies to identify and filter web traffic depending on its source, such as a social media website or a specific messaging app, and selectively block access. These systems are used for surveillance and censorship in regions where freedom of speech and expression are limited.

logging internet traffic and blocking access

The Citizen Lab reported in 2023 that Iranian telecoms giant - Ariantel had consulted with Protei about technology for logging internet traffic and blocking access to certain websites.

Documents seen and published by The Citizen Lab show that Protei touted its technology’s ability to restrict or block access to websites for specific people or entire swathes of the population.