Previous 48 / 76 Next

Contd. P19: Pakistan Pakistan and Geedge Geedge’s codename for their Pakistan project is P19. According to the evidence in the new documents, Geedge’s operations in the country did not begin until 2023. This aligns with when Sandvine ended their contract with Pakistan in November 2023, responding to sanctions imposed by the United States Department of Commerce.50 The Geedge version of Pakistan’s national firewall, which Amnesty International Security Lab calls WMS 2.0, includes new functionalities courtesy of TSG-OS. The modern firewall can store details about who is using a censorship circumvention tool and which IPaddresses visited which websites. It can monitor the internet traffic as well as telephone communications within the country and can track and block access to circumvention tools such as VPNs and specific websites. The language used by a senior Pakistan ISP executive in an interview with Al Jazeera, mirrors Geedge marketing materials closely.51 The unnamed executive said the new WMS was being deployed not only at the country’s internet gateways but at local data centers of mobile service providers and ISPs.52 Because the previous system was only able to surveil content entering and exiting the country, Pakistan was not able to censor content hosted by local caching content delivery networks (CDNs) like those run by Netflix and Meta. Comparing WMS 1.0 and WMS 2.0, the executive said: “Unlike the Sandvine system, the new DPI-based system is now capable of monitoring local internet traffic,” using an “in-line network” which also had a higher likelihood of slowing down internet speeds for users. The executive also noted that the Chinese (Geedge) technology provides the capability to manage applications and websites at a “granular level”, providing better features than Sandvine. Unlike other countries using Geedge services, there are not national or regional centers in Pakistan. Instead, and likely a remnant of the old Sandvine system, Geedge is installed at three sites: PCAP (the generic term for data center and noted for “backup”), MSH (where most of the TSG hardware is), TWA (likely the Karachi Submarine Cable Landing Station owned by the company Transworld Associates).

Select target paragraph3

● ● ●

The Internet Coup A Technical Analysis on How a Chinese Company is Exporting The Great Firewall to Autocratic Regimes

Report

Preview

Language

English

Topic

Digital Rights
Digital Surveillance
Internet Connectivity / Accessibility
Internet Restrictions

Author(s)

INTER SECLAB

Date Published: Sep 9, 2025

Abstract: Over the past two decades, the Chinese government has been steadily refining their model of internet control using surveillance and censorship technologies domestically while promoting this approach to other nations under the banner of “digital sovereignty”. Through the export of these technologies, China is not only extending its global influence but also laying the foundation for a federated system of internet governance. In this system, Chinese companies provide the infrastructure and expertise for client governments to more easily monitor and control their own networks, while learning from these deployments and improving collective capacity for digital authoritarianism worldwide.

This research by InterSecLab uncovers evidence of the export of a suite of technologies resembling China’s Great Firewall by Geedge Networks, a private company linked to the academic entity ‘Massive and Effective Stream Analysis’ (Mesalab), a research laboratory at the Chinese Academy of Sciences. Our team’s investigation identifies a pattern of commercialization of surveillance capabilities, with Geedge Networks offering a suite of products that enable comprehensive monitoring and control of internet users.

InterSecLab’s analysis reveals that Geedge Networks is contracted with governments in Kazakhstan, Ethiopia, Pakistan, Myanmar, and one other unknown country to establish sophisticated systems of internet censorship and surveillance. Furthermore, our findings indicate that Geedge Networks is also involved in developing similar systems deployed within China, including in Xinjiang and other regions.

Based on analysis of a leak of more than 100,000 Geedge Networks documents that was shared with InterSecLab, this research sheds light on the features and capabilities of Geedge Networks’ systems, which include deep packet inspection, real-time monitoring of mobile subscribers, granular control over internet traffic, as well as censorship rules that can be tailored to each region. The leak also reveals information about Geedge Networks’ relationship with the academic entity, Mesalab, as well as their interactions with client governments. The implications for data sovereignty are significant, and our findings raise concerns about the commoditization of surveillance and information control technologies.

This research examines the recent development of Geedge Networks’ systems in various countries, including what is known about their deployment timelines. By analyzing the company’s internal documentation, InterSecLab was able to chronicle the expansion of commercially available national firewalls and speculate about the implications for the future of the global internet considering the spread of such systems.

Link: source

Primary Documents

The-Internet-Coup_September2025.pdf
English
Download View

Myanmar Internet Project

Select target paragraph3

The Internet Coup A Technical Analysis on How a Chinese Company is Exporting The Great Firewall to Autocratic Regimes

Primary Documents

Notifications