Previous 64 / 76 Next

Circumventing Psiphon Protective Measures Developed by Canada-based Psiphon Inc., Psiphon is a free and open-source internet circumvention tool designed to help users bypass online censorship and access restricted content. 75 Psiphon is primarily used in countries with significant internet censorship, including China, Iran, Egypt, and Turkey. 76 It has played a significant role in enabling access to censored information during times of political unrest, such as the 2021 Myanmar anti-junta protests and the 2021 Cuban protests. Psiphon3 employs a system known as Obfuscated Server Lists (OSL) to facilitate distributing server node information to clients. In contrast to other VPN applications, this server list is encrypted using a method referred to as server list encryption keys (SLOKs). The purpose of this encryption is to ensure that only trusted clients can access the complete list of server nodes, thereby preventing automated bots and opportunistic adversaries from scraping the information. According to the leaked data, Geedge Networks appears to have attempted to circumvent this protective measure by developing an internal tool referred to as Psiphon3-SLOK. This tool’s purpose is to continuously scrape the obfuscated server list and generates a compilation of IP addresses to be blocked, which is subsequently distributed to TSG nodes at client locations, through TSG Galaxy. In conversations with the Psiphon team, we learned that in late May of 2024 there was a sharp rise in users from Myanmar and a shift in how clients selected servers, consistent with server enumeration and targeted blocking. This period coincides with the deployment of the Geedge system in Myanmar. Internal data shared by Psiphon show that starting on May 30, 2024 Psiphon recorded about 500,000 new users. Myanmar traffic moved from a mix of discovery methods (REMOTE and EMBEDDED) toward mainly merit-based OBFUSCATED servers, indicating many servers were simultaneously blocked by certain ISPs. Although some servers were blocked, overall session quality, measured by tunnel duration and data transferred, remained normal. The duration and severity of blocking varied between ISPs. Psiphon employs a multi-layered server discovery process that allows clients to learn about available servers. Initially, EMBEDDED servers are included during installation, providing an immediate list of accessible nodes. Subsequently, DISCOVERY servers are fetched after an initial connection, expanding the client's access options. REMOTE servers can be accessed from a remote location, while OBFUSCATED servers are unlocked based on merit and are particularly resistant to enumeration and blocking due to their secure nature.

Select target paragraph3

● ● ●

The Internet Coup A Technical Analysis on How a Chinese Company is Exporting The Great Firewall to Autocratic Regimes

Report

Preview

Language

English

Topic

Digital Rights
Digital Surveillance
Internet Connectivity / Accessibility
Internet Restrictions

Author(s)

INTER SECLAB

Date Published: Sep 9, 2025

Abstract: Over the past two decades, the Chinese government has been steadily refining their model of internet control using surveillance and censorship technologies domestically while promoting this approach to other nations under the banner of “digital sovereignty”. Through the export of these technologies, China is not only extending its global influence but also laying the foundation for a federated system of internet governance. In this system, Chinese companies provide the infrastructure and expertise for client governments to more easily monitor and control their own networks, while learning from these deployments and improving collective capacity for digital authoritarianism worldwide.

This research by InterSecLab uncovers evidence of the export of a suite of technologies resembling China’s Great Firewall by Geedge Networks, a private company linked to the academic entity ‘Massive and Effective Stream Analysis’ (Mesalab), a research laboratory at the Chinese Academy of Sciences. Our team’s investigation identifies a pattern of commercialization of surveillance capabilities, with Geedge Networks offering a suite of products that enable comprehensive monitoring and control of internet users.

InterSecLab’s analysis reveals that Geedge Networks is contracted with governments in Kazakhstan, Ethiopia, Pakistan, Myanmar, and one other unknown country to establish sophisticated systems of internet censorship and surveillance. Furthermore, our findings indicate that Geedge Networks is also involved in developing similar systems deployed within China, including in Xinjiang and other regions.

Based on analysis of a leak of more than 100,000 Geedge Networks documents that was shared with InterSecLab, this research sheds light on the features and capabilities of Geedge Networks’ systems, which include deep packet inspection, real-time monitoring of mobile subscribers, granular control over internet traffic, as well as censorship rules that can be tailored to each region. The leak also reveals information about Geedge Networks’ relationship with the academic entity, Mesalab, as well as their interactions with client governments. The implications for data sovereignty are significant, and our findings raise concerns about the commoditization of surveillance and information control technologies.

This research examines the recent development of Geedge Networks’ systems in various countries, including what is known about their deployment timelines. By analyzing the company’s internal documentation, InterSecLab was able to chronicle the expansion of commercially available national firewalls and speculate about the implications for the future of the global internet considering the spread of such systems.

Link: source

Primary Documents

The-Internet-Coup_September2025.pdf
English
Download View

Myanmar Internet Project

Select target paragraph3

The Internet Coup A Technical Analysis on How a Chinese Company is Exporting The Great Firewall to Autocratic Regimes

Primary Documents

Notifications