Contd. TSG GALAXY: Aggregating Analytics for Mass Surveillance an individual internet user through various identifiers- including their IP address, their subscriber ID, IMEI, and IMSI7. Metadata extracted from TSG Galaxy is sent to a database able to be queried by a client through Cyber Narrator. Image Caption: 
 This diagram shows how traffic records are ingested and how data flows from TSG into Cyber Narrator. First, an internet user tries to access a website. The network request for “example.com” goes to the ISP’s infrastructure and is there captured by TSG-X. TSG-X queries Sanity Directory to identify who owns the user’s IP. This identity collected by Sanity Directory from the ISP signaling, comes back as Jane Doe. TSG-X then labels the IP with the IP owner’s name and the website visited, and logs this record to TSG Galaxy. Through Cyber Narrator, a government official can then query the websites that were visited by Jane Doe. Image Caption: 
 These are photos from the Mesalab documents showing a business trip to Xinjiang (Mar 14–Apr 28, 2021), likely taken in a server room during TSG deployment work by a member or graduate of the Chinese Academy of Sciences. The photos were included as part of a report that focused on the political, scientific, and commercial goals of the lab, quoting a call for scientists to serve China’s national interests. Due to limited office space, the Beijing team reportedly had to “squat” in the server room. I P : 1 0. 2 0.3 0. 4 0 who has..? SA N I TY TO RY TSG-X equests Example.com DIREC Jane Doe R LABEL IS... -Date -Example.com -10.20.30.40 -Jane Doe I S P S I G N AL I N G I P : 1 0. 2 0.3 0. 4 0 = Send reward to TSG GALAXY J ANE DOE Queries BE R A R R ATO R CY N “what websites has Jane Doe visited” A significant finding of this research is that all of this internet user data that is collected within TSG Galaxy at government client locations appears to be accessible to Geedge Networks employees. The data also suggests that snapshots of real customer data are sometimes shared with Mesalab, the academic laboratory at the Chinese Academy of Sciences that seems to be closely associated with Geedge Networks. The data suggests that engineering students at Mesalab have used real world customer information for research aimed at better understanding and obstructing internet censorship circumvention. The duration that customer data is retained by Geedge and Geedge affiliates remains unclear.