Previous 19 / 76 Next

Contd. CyberNarrator: The All-Seeing Eye Cyber Narrator is a powerful tool capable of tracking network traffic at the individual customer level and can identify the geographic location of mobile subscribers in real time by linking their activity to specific cell identifiers (cell IDs). The system also allows the government client to see aggregated network traffic. Cyber Narrator can thus be used to monitor groups of internet users in specific geographical areas, such as during protests or large crowded events. Image Caption: This is a screenshot from Cyber Narrator’s location map, showing how it can monitor groups of individuals in specific areas. Hexagon colors indicate population density. Displayed data includes CID, MSISDN, and group classifications. This example labels specific mobile subscribers as terrorist leaders in Shanghai. Cyber Narrator users can click hexagons to view subscriber counts, distinguishing locals, visitors, and people using a roaming service. Cyber Narrator draws on data collected by their data warehousing solution, called TSG Galaxy, as well as another Geedge Networks developed tool, WebSketch. WebSketch is an internet intelligence search hosted and run by Geedge. It is the only product from Geedge that is not hosted on the customer premises, but is instead hosted by Geedge. The data from WebSketch is sourced through Geedge’s own internet research as well as through the aggregation of information acquired from third-party data brokers. Websketch incorporates functionalities of popular cybersecurity intelligence services, Shodan and Greynoise. Like Shodan, Websketch discovers connected devices, such as webcams, routers, and servers, by scanning the internet for their unique identifiers. Websketch emulates Greynoise in that it provides the client with the ability to label otherwise meaningless identifiers such as IP addresses and domain names as being linked to a specific internet service, such as a messaging app like WeChat or a VPN service. So overt is the dependence on Greynoise for the design of WebSketch, that in design documents Geedge employees are asked to reference Greynoise when designing new features. The leaked data analyzed for this report included a detailed list of requirements for the deployment of Cyber Narrator in Xinjiang, China, specifying that the product has the capability to identify “suspicious” communication patterns, such as the use of VPNs...

Select target paragraph3

● ● ●

The Internet Coup A Technical Analysis on How a Chinese Company is Exporting The Great Firewall to Autocratic Regimes

Report

Preview

Language

English

Topic

Digital Rights
Digital Surveillance
Internet Connectivity / Accessibility
Internet Restrictions

Author(s)

INTER SECLAB

Date Published: Sep 9, 2025

Abstract: Over the past two decades, the Chinese government has been steadily refining their model of internet control using surveillance and censorship technologies domestically while promoting this approach to other nations under the banner of “digital sovereignty”. Through the export of these technologies, China is not only extending its global influence but also laying the foundation for a federated system of internet governance. In this system, Chinese companies provide the infrastructure and expertise for client governments to more easily monitor and control their own networks, while learning from these deployments and improving collective capacity for digital authoritarianism worldwide.

This research by InterSecLab uncovers evidence of the export of a suite of technologies resembling China’s Great Firewall by Geedge Networks, a private company linked to the academic entity ‘Massive and Effective Stream Analysis’ (Mesalab), a research laboratory at the Chinese Academy of Sciences. Our team’s investigation identifies a pattern of commercialization of surveillance capabilities, with Geedge Networks offering a suite of products that enable comprehensive monitoring and control of internet users.

InterSecLab’s analysis reveals that Geedge Networks is contracted with governments in Kazakhstan, Ethiopia, Pakistan, Myanmar, and one other unknown country to establish sophisticated systems of internet censorship and surveillance. Furthermore, our findings indicate that Geedge Networks is also involved in developing similar systems deployed within China, including in Xinjiang and other regions.

Based on analysis of a leak of more than 100,000 Geedge Networks documents that was shared with InterSecLab, this research sheds light on the features and capabilities of Geedge Networks’ systems, which include deep packet inspection, real-time monitoring of mobile subscribers, granular control over internet traffic, as well as censorship rules that can be tailored to each region. The leak also reveals information about Geedge Networks’ relationship with the academic entity, Mesalab, as well as their interactions with client governments. The implications for data sovereignty are significant, and our findings raise concerns about the commoditization of surveillance and information control technologies.

This research examines the recent development of Geedge Networks’ systems in various countries, including what is known about their deployment timelines. By analyzing the company’s internal documentation, InterSecLab was able to chronicle the expansion of commercially available national firewalls and speculate about the implications for the future of the global internet considering the spread of such systems.

Link: source

Primary Documents

The-Internet-Coup_September2025.pdf
English
Download View

Myanmar Internet Project

Select target paragraph3

The Internet Coup A Technical Analysis on How a Chinese Company is Exporting The Great Firewall to Autocratic Regimes

Primary Documents

Notifications