Previous 20 / 76 Next

Contd. CyberNarrator: The All Seeing Eye and international roaming. This use case for Cyber Narrator (described more in the China deployment section below) makes it clear that Cyber Narrator can make it easier for client governments and security forces to flag individual subscribers for using circumvention tools or accessing other applications or webpages that the client government considers as potentially malicious. The analytical capabilities of Cyber Narrator also enable the obstruction of access to specific websites or Virtual Private Network (VPN) services. Through Cyber Narrator, the client government can also identify individuals who accessed the content or service prior to its restriction. In practice, this means that client states are able to “go back in time” and find people who previously visited a website that only later becomes illegal. This has worrying implications for civil liberties and freedom of expression, as an internet user could be identified, surveilled and even penalized for online activity that was lawful at the time they occurred. This capability is made possible by the mass data collection and aggregation functionality of another Geedge product, Tiangou Secure Gateway (TSG), and is described in greater detail in the Tiangou Secure Gateway section. TSG GALAXY: Aggregating Analytics for Mass Surveillance TSG Galaxy is Geedge Networks' ETL (Extract, Transform, Load) data warehouse solution designed for internet-scale mass surveillance, collecting and aggregating a significant amount of data about all internet users and data sent over the internet in a client country. It is built on the open source Apache Kafka stream-processing platform5, a common data processing software often used to provide customer analytics for online retailers and advertisers. The leaked data analyzed for this research included an SQL schema6 for TSG Galaxy that indicated that TSG Galaxy is utilized to store records of all TCP and UDP sessions, transport protocols that are largely used for broadband and mobile data, as well as all SIP sessions within the country. SIP is a protocol used for VoIP (Voice Over Internet Protocol), the basis for most modern telephone networks. This means that TSG Galaxy allows for not only the monitoring of network traffic and content over the internet, but also phone calls. TSG Galaxy employs Internet Protocol Flow Information Export (IPFIX) to analyze traffic flows and deep packet inspection (DPI) to extract the metadata. Using DPI, they can extract detailed fingerprints, including TLS and QUIC server name indications, DNS queries and email headers. TSG Galaxy also implements connection fingerprinting techniques, such as JA3 hashes, allowing for Cyber Narrator to identify patterns to help determine what operating system a user is on and what applications they are using to connect. This technique can be used to help identify if a user is using a circumvention tool such as a VPN to obscure traffic or bypass censorship. Within TSG Galaxy, all of this information is combined with information from the internet service provider to link it to ...

Select target paragraph3

● ● ●

The Internet Coup A Technical Analysis on How a Chinese Company is Exporting The Great Firewall to Autocratic Regimes

Report

Preview

Language

English

Topic

Digital Rights
Digital Surveillance
Internet Connectivity / Accessibility
Internet Restrictions

Author(s)

INTER SECLAB

Date Published: Sep 9, 2025

Abstract: Over the past two decades, the Chinese government has been steadily refining their model of internet control using surveillance and censorship technologies domestically while promoting this approach to other nations under the banner of “digital sovereignty”. Through the export of these technologies, China is not only extending its global influence but also laying the foundation for a federated system of internet governance. In this system, Chinese companies provide the infrastructure and expertise for client governments to more easily monitor and control their own networks, while learning from these deployments and improving collective capacity for digital authoritarianism worldwide.

This research by InterSecLab uncovers evidence of the export of a suite of technologies resembling China’s Great Firewall by Geedge Networks, a private company linked to the academic entity ‘Massive and Effective Stream Analysis’ (Mesalab), a research laboratory at the Chinese Academy of Sciences. Our team’s investigation identifies a pattern of commercialization of surveillance capabilities, with Geedge Networks offering a suite of products that enable comprehensive monitoring and control of internet users.

InterSecLab’s analysis reveals that Geedge Networks is contracted with governments in Kazakhstan, Ethiopia, Pakistan, Myanmar, and one other unknown country to establish sophisticated systems of internet censorship and surveillance. Furthermore, our findings indicate that Geedge Networks is also involved in developing similar systems deployed within China, including in Xinjiang and other regions.

Based on analysis of a leak of more than 100,000 Geedge Networks documents that was shared with InterSecLab, this research sheds light on the features and capabilities of Geedge Networks’ systems, which include deep packet inspection, real-time monitoring of mobile subscribers, granular control over internet traffic, as well as censorship rules that can be tailored to each region. The leak also reveals information about Geedge Networks’ relationship with the academic entity, Mesalab, as well as their interactions with client governments. The implications for data sovereignty are significant, and our findings raise concerns about the commoditization of surveillance and information control technologies.

This research examines the recent development of Geedge Networks’ systems in various countries, including what is known about their deployment timelines. By analyzing the company’s internal documentation, InterSecLab was able to chronicle the expansion of commercially available national firewalls and speculate about the implications for the future of the global internet considering the spread of such systems.

Link: source

Primary Documents

The-Internet-Coup_September2025.pdf
English
Download View

Myanmar Internet Project

Select target paragraph3

The Internet Coup A Technical Analysis on How a Chinese Company is Exporting The Great Firewall to Autocratic Regimes

Primary Documents

Notifications