Leak of Geedge Networks internal documents (100,000+ from Jira, Confluence, GitLab)

[wkrp]

We have discussed the Chinese company Geedge Networks (积至). Last year, there was the news that Geedge had provided equipment for VPN blocking in Myanmar. One of the founders of the company is 方滨兴 (Fang Binxing), the famous "father of the Great Firewall". Another Geedge principal, 郑超 (Zheng Chao), is a coauthor of censorship-related research papers we have discussed: #275, #282, #444.

Today, there are many news articles and reports about a leak of Geedge Networks internal documents, including from Jira (bug tracker), Confluence (wiki), and GitLab (source code). They say that several news organizations and technologists have worked together for a year to analyze the documents. This is the primary reporting from the people who worked directly with the documents, as best as I have been able to determine:

• The Globe and Mail: Leaked files show a Chinese company is exporting the Great Firewall's censorship technology (archive)
• Der Standard: Wie China seine Totalüberwachung des Internets ins Ausland exportiert (archive)
• Follow the Money: China exports censorship tech to authoritarian regimes – aided by EU firms (archive)
• InterSecLab: The Internet Coup (archive) PDF 76 pages (archive)
• Amnesty International: Shadows of Control: Censorship and mass surveillance in Pakistan (archive) PDF 102 pages (archive)
• Justice for Myanmar: Silk Road of Surveillance (archive) PDF 47 pages (archive)

As far as I can tell, the actual contents of the leak have not been made public. Even so, there is a lot of information across these public articles and reports. They include, at least, evidence of exports to other contries including Myanmar, Pakistan, Ethiopia, Kazakhstan, and at least one other unidentified country; operation in the Chinese provinces of Xinjiang, Jiangsu and Fujian; technical information about Geedge's products; and collaboration with MESA, a research lab at the Chinese Academy of Sciences.

[wkrp]

Here are notes and highlights from the three news articles.

The Globe and Mail: Leaked files show a Chinese company is exporting the Great Firewall's censorship technology

The leak of internal documents shows that Geedge works directly with governments and ISPs to install products for censorship and surveillance. They offer capabilities including tracking users' locations and network access history, and blocking services and circumvention systems.

…a leak of more than 100,000 internal documents linked to Geedge Networks, a little-known Chinese company that has quietly assumed a key role in developing the Great Firewall and providing similar censorship capabilities to governments around the world…

The files offer a key insight not only into how Geedge exports cutting-edge censorship technology to its authoritarian clients, giving them capabilities they might not otherwise have, but also into the evolution of the Great Firewall itself.

This includes solutions for filtering websites and apps, real-time online surveillance, throttling internet data to certain regions or enacting internet blackouts, identifying anonymous users by their online footprint, and blocking tools used to bypass censorship, including virtual private networks (VPNs).

Geedge is involved in at least five other countries: Kazakhstan, Ethiopia, Myanmar (#369), Pakistan, and an unidentified one known only by the codename A24. Kazakhstan was an early customer after being founded in 2018.

After its founding in 2018, one of Geedge's first clients was the government of Kazakhstan, to whom the company sold its flagship Tiangou Secure Gateway (TSG), which provides functions similar to China's own Great Firewall, monitoring and filtering all web traffic that passes through it, as well as attempts to bypass such censorship.

The same tool has been rolled out in Ethiopia and Myanmar, where it has been instrumental in enabling that country's military junta to enforce a ban on VPNs. In many cases, Geedge works with other private companies, including internet service providers (ISPs) such as Safaricom in Ethiopia, or Frontiir and Ooredoo in Myanmar, to enact government censorship, the documents show. No ISPs that have partnered with Geedge responded to a request for comment.

Myanmar is treated specially in the Justice for Myanmar Silk Road of Surveillance report. Pakistan is treated specially in the Amnesty International Shadows of Control report.

About Pakistan, this Globe and Mail article says that Geedge installed their new systems, including the Tiangou Secure Gateway (TSG), on existing equipment left behind by Sandvine. (Sandvine is now called AppLogic.)

Sandvine quit Pakistan in 2023 amid growing scrutiny of its work there, and was quickly replaced by Geedge, which the documents show apparently utilizing existing Sandvine installations as well as providing new technology to power Islamabad's Web Monitoring System, as the country's national firewall is called.

In a statement, AppLogic said it was not aware of Geedge and any hardware repurposed by the company was off-the-shelf equipment "that does not contain any special capability that is unique to Sandvine's solution."

The article cites the same hiring advertisement that was posted in #369 (comment) that mentions a further four countries: Malaysia, Bahrain, Algeria, and India:

A recent job ad posted by Geedge also mentioned the BRI [Belt and Road Initiative]. That ad sought candidates "able to speak English or another foreign language," and willing to go on three- to six-month business trips to "Pakistan, Malaysia, Bahrain, Algeria, and India."

Besides foreign contries, the documents show Geedge involvement in the Chinese provinces of Xinjiang, Jiangsu, and Fujian. This could be a sign of a more distributed, regional, firewall system, as has been discussed in relation to Henan in threads such as #416 and "A Wall Behind a Wall".

Geedge is closely aligned with MESA, a research lab at the University of the Chinese Academy of Sciences. We have previously mentioned MESA at #471 (comment), in a reading group post about MESA's "SAPP" network analysis platform. Geedge's chief technology officer 郑超 (Zheng Chao) was a co-founder of MESA in January 2012.

Mr. Fang is described proudly in the Geedge documents as "father of the firewall." Other top company personnel, such as chief executive Wang Yuandi and chief technology officer Zheng Chao, are listed as co-authors of papers on internet censorship and creator of patents applied for by Geedge. The company also has a close relationship with the Massive and Effective Stream Analysis Laboratory (MESA Lab) at the Chinese Academy of Sciences, with the documents showing regular collaboration between personnel at both entities.

It was a MESA Lab researcher who took notes at the July, 2024, meeting in Xinjiang, where attendees spoke of using technology to "strike at the use of tools" to bypass the Great Firewall and establish the "Xinjiang Branch Centre" as an "anti-terrorism vanguard" and "demonstration of provincial capabilities."

The company does individualized research on circumvention systems and VPNs in order to block them.

The leaks show employees at the company working to reverse-engineer many popular tools and find means of blocking them. One set of documents lists nine commercial VPNs as "resolved," and provides various means of identifying and filtering traffic to them. Similar capabilities have long been demonstrated by the Great Firewall, with most commercial VPNs inaccessible from within China and many dedicated anti-censorship tools also hard to access.

Der Standard: Wie China seine Totalüberwachung des Internets ins Ausland exportiert

Machine translation into English: How China is exporting its total surveillance of the internet abroad

A Chinese company is supplying the technology behind this to authoritarian countries. The consequences for opposition figures and journalists could be dramatic.

Sophia Baumann
9. September 2025, 05:00

His name stands for a monstrous system: Fang Binxing, professor, party member, architect of digital control. Anyone who wants to know what he does and what he stands for has to read between the lines – or search outside the Chinese firewall. Because Fang is one of the fathers of the system that selects, controls, and makes information disappear in China: the so-called "Great Firewall."

In 2011, during a lecture in Wuhan, an unknown person allegedly threw an egg and a shoe at Fang Binxing. It was a symbolic protest against a man who had turned the Chinese internet into a bulwark against freedom. Fang's office denied the incident at the time.

Total surveillance as an export hit

In 2018, Fang founded Geedge Networks, a company through which he intended to turn his invention, the Chinese firewall, into an export hit. Exclusive research now shows that Geedge Networks supplied censorship and surveillance technology to several, mostly autocratic states and may still be doing so. Its problematic customers included Myanmar, Pakistan, Kazakhstan, Ethiopia, and regional Chinese authorities.

DER STANDARD researched this for several months in collaboration with the Dutch platform Follow the Money and the Canadian newspaper The Globe and Mail, as well as with the help of the NGO Amnesty International, the activist group "Justice for Myanmar", which focuses primarily on the junta in Myanmar, the Tor Project, and Intersec Lab, which also provided technical support to the group.

The technologies offered by Geedge Networks are extremely powerful, as shown by an analysis by the IT security experts at Intersec Lab. They enable authorities to monitor the data traffic of individuals in certain regions, for example during protests. They can specifically detect and block individual virtual private networks (VPNs), which users have previously used to circumvent digital censorship by authorities. And they can even insert malicious code into websites or launch DDoS attacks, thereby crippling individual sites.

"Serious humanitarian consequences"

Ironically, the countries to which Geedge Networks supplied these tools have long been the subject of massive criticism. The American non-governmental organization Freedom House classifies China, Myanmar, Ethiopia, Pakistan, and Kazakhstan as "not free" in terms of internet freedom.

What this means in concrete terms can be seen in Ethiopia, for example. There, the government shut down the internet in the Tigray region for a good two years starting in 2020 – in the midst of an armed conflict involving serious human rights violations. This hampered the coordination of food deliveries and medical aid. Kian Vesteinsson of Freedom House says the blockade had "serious humanitarian consequences."

Myanmar also tightened its digital grip significantly after the military coup in 2021. Only websites pre-approved by the military are still accessible. In the meantime, cell phones were checked at roadblocks in search of installed VPN apps. Now, technology is doing what soldiers used to do.

Research suggests that Geedge Networks' censorship and surveillance technologies are now also being used in the countries mentioned.

Neither Ethiopia, Kazakhstan, Pakistan, nor China responded to requests for comment from STANDARD. The authorities in Myanmar could not be reached for comment. Geedge Networks and Fang Binxing also left all inquiries unanswered.

Surveillance technology from the West

At the same time, Geedge Networks is not the first company to supply such technologies to autocrats and censorship-happy authorities. Western companies have also been active in this market and have been criticized for years.

In 2015, for example, the NGO Privacy International revealed that Pakistan was using surveillance technologies from German companies. Even then, the country's massive surveillance frenzy was well known. According to media reports, one of the German companies, Utimaco, was also active in Myanmar. When asked, Utimaco stated that the company had always complied with all laws and regulations. Furthermore, it had never done business directly with any of the mobile network operators in Myanmar.

Later, the Canadian company Sandvine is said to have supplied Pakistan with a system that enables the authorities to block unwanted websites. In 2023, Sandvine, now renamed Applogic Networks, withdrew from the country. But it apparently left at least some of the Sandvine hardware in Pakistan.

Research suggests that this was then reused by Geedge Networks, at least initially. Applogic Networks told the STANDARD that it had no knowledge of this. Furthermore, the company emphasized that its technology cannot be used to decrypt user data or deploy spyware.

European traces

A French company also became an unwitting accomplice of Geedge Networks. The French Thales Group sells software that can be used to manage licenses. Geedge Networks apparently used this to maintain control over the products it sold. This allowed it to limit the functionality of the software for a limited period of time.

Upon request, the Thales Group confirmed to the STANDARD that the Chinese company is one of its customers. However, Geedge Networks' software does not rely on the French product to function. The company claims to have nothing to do with surveillance.

In addition, Geedge Networks apparently used a German server to distribute its software to customers via download links. The motives for this remain unclear. However, it is known that the Chinese firewall is making it increasingly difficult to access Chinese websites from abroad. The responsible ministry in Germany did not respond to inquiries from the STANDARD on the subject.

The model of digital authoritarianism

Unlike Western providers, a company like Geedge Networks is unlikely to be subject to ethical standards. On the contrary, the dissemination of its own technologies seems to be an overriding political goal here.

China wants to "export its model of digital authoritarianism," says Kian Vesteinsson of Freedom House. This is particularly true for autocratic neighbors such as Myanmar.

But while censorship has long been the norm for China's population, resistance is stirring in Myanmar. The organization "Justice for Myanmar," which was also involved in this investigation, warned last year against cooperating with Geedge Networks. In Pakistan, Usama Khilji of the organization Bolo Bhi sounded the alarm. "Pakistan is a democracy, we have fundamental rights – we cannot be treated the way the Chinese government treats its citizens," he said even before the research was made public.

A new position at Geedge Networks is currently advertised on a Chinese online job board. One of the criteria for applicants is a willingness to travel on business – to Pakistan, but also to Malaysia, India, Bahrain, and Algeria. So business seems to be booming for Geedge Networks, and Algeria, Malaysia, India, and Bahrain may also already be using its services or showing interest. The relevant authorities in the respective countries did not respond to questions from the STANDARD.

The spirit of the "Great Firewall" has long since taken hold. It creeps through networks, blocks data, and filters information. And sometimes it even affects its creators themselves: When Fang Binxing wanted to show a South Korean website during a lecture in 2016, he was blocked – by his own firewall. (Sophia Baumann, September 9, 2025)

This article lists additional capabilities of Geedge's technology, beyond tracking users and blocking access: injection of malware into HTTP sessions, and directly launching DDoS traffic volume attacks.

Die Technologien, die Geedge Networks anbietet, sind überaus mächtig, zeigt eine Analyse der IT-Sicherheitsexperten von Intersec Lab. Sie ermöglichen Behörden, den Datenverkehr von Einzelpersonen in bestimmten Regionen zu überwachen, beispielsweise während Protesten. Sie können gezielt einzelne Virtual Private Networks (VPNs) erkennen und blockieren, mit deren Hilfe Nutzer bislang die digitale Zensur von Behörden umgehen konnten. Und sie können sogar bösartigen Code in Websites einfügen oder DDoS-Angriffe starten und damit einzelne Seiten lahmlegen.

The technologies offered by Geedge Networks are extremely powerful, as shown by an analysis by the IT security experts at Intersec Lab. They enable authorities to monitor the data traffic of individuals in certain regions, for example during protests. They can specifically detect and block individual virtual private networks (VPNs), which users have previously used to circumvent digital censorship by authorities. And they can even insert malicious code into websites or launch DDoS attacks, thereby crippling individual sites.

It has the same information about Geedge software being deployed on repurposed Sandvine hardware in Pakistan. Evidently, Geedge places a priority on decoupling software from hardware.

Später soll die kanadische Firma Sandvine Pakistan ein System geliefert haben, das den Behörden das Blockieren von unerwünschten Internetseiten ermöglichen kann. 2023 zog sich Sandvine, inzwischen umbenannt in Applogic Networks, zwar aus dem Land zurück. Aber offenbar hinterließ es zumindest Teile der Sandvine-Hardware in Pakistan.

Die Recherchen legen nahe, dass diese nun von Geedge Networks zumindest zu Beginn wiederverwendet wurden. Applogic Networks teilte dem STANDARD mit, davon keine Kenntnis gehabt zu haben. Darüber hinaus betonte das Unternehmen, dass man mit seiner Technologie keine Benutzerdaten entschlüsseln oder Spyware einsetzen könne.

Later, the Canadian company Sandvine is said to have supplied Pakistan with a system that enables the authorities to block unwanted websites. In 2023, Sandvine, now renamed Applogic Networks, withdrew from the country. But it apparently left at least some of the Sandvine hardware in Pakistan.

Research suggests that this was then reused by Geedge Networks, at least initially. Applogic Networks told the STANDARD that it had no knowledge of this. Furthermore, the company emphasized that its technology cannot be used to decrypt user data or deploy spyware.

A French company, Thales Group, provides license enforcement to Geedge. Geedge used at least one server in Germany for the purpose of software downloads. (Perhaps to avoid interference by the GFW, if the download server had been hosted in China.)

Auch ein französisches Unternehmen wurde – wohl unfreiwillig – zum Helfer von Geedge Networks. Die französische Thales Group vertreibt eine Software, mit der man Lizenzen managen kann. Geedge Networks nutzte diese offenbar, um Kontrolle über die von ihr verkauften Produkte zu behalten. Sie könnte damit etwa die Funktionsfähigkeit der Software zeitlich beschränken.

Auf Anfrage bestätigte die Thales Group dem STANDARD, dass das chinesische Unternehmen zu ihren Kunden gehört. Die Software von Geedge Networks sei jedoch nicht auf das französische Produkt angewiesen, um zu funktionieren. Mit der Überwachung habe man nichts zu tun.

Darüber hinaus nutzte Geedge Networks offenbar einen deutschen Server, um seine Software über Downloadlinks an die Kunden zu verteilen. Die Motive dafür bleiben unklar. Bekannt ist aber, dass die chinesische Firewall den Zugriff auf chinesische Websites aus dem Ausland zunehmend erschwert. Das zuständige Ministerium in Deutschland ließ Anfragen des STANDARD zu dem Thema unbeantwortet.

A French company also became an unwitting accomplice of Geedge Networks. The French Thales Group sells software that can be used to manage licenses. Geedge Networks apparently used this to maintain control over the products it sold. This allowed it to limit the functionality of the software for a limited period of time.

Upon request, the Thales Group confirmed to the STANDARD that the Chinese company is one of its customers. However, Geedge Networks' software does not rely on the French product to function. The company claims to have nothing to do with surveillance.

In addition, Geedge Networks apparently used a German server to distribute its software to customers via download links. The motives for this remain unclear. However, it is known that the Chinese firewall is making it increasingly difficult to access Chinese websites from abroad. The responsible ministry in Germany did not respond to inquiries from the STANDARD on the subject.

Follow the Money: China exports censorship tech to authoritarian regimes – aided by EU firms

This article gives an outline of various Geedge products, which may be sold to customers in a bundle or selectively. Cyber Narrator is a kind of high-level dashboard that nontechnical users can interact with directly. Tiangou Secure Gateway (TSG) is the actual network surveillance and blocking device. TSG Galaxy is a data storage and analysis pipeline. Network Zodiac is a manager and monitor for the other systems.

Geedge Networks' portfolio includes several different technologies, InterSecLab's data analysis shows. "Cyber Narrator" is the main interface that clients interact with. It allows even non-technically-skilled individuals to monitor groups of internet users in specific areas, for example, during demonstrations.

Then, there is the "Tiangou Secure Gateway" – believed to be the flagship product. This tool can block VPNs, but also insert malicious code into websites or launch attacks on websites.

Another product is the "TSG Galaxy", where data collected on users is stored, while "Network Zodiac" monitors all other systems and reports any errors.

There may be may more installations of Geedge equipment such as TSG than even the countries mentioned in this leak, because Geedge's public marketing web site says "40+ global service providers":

In a 2024 speech covered by a Chinese media, Binxing announced that the company aims to expand into "international markets" and promote Chinese technologies globally. It seems he did just that as the documents show that Myanmar, as well as Pakistan, Ethiopia and Kazakhstan, held licenses for at least the flagship product, the Tiangou Secure Gateway. Furthermore, Geedge Networks' website boasts it serves "40+ global service providers", suggests a much further reach than the leaked documents suggest.

A Geedge support ticket from February 2023 has to do with blocking social media in Ethiopia. This correlates with known blocking (#210) in Ethiopia at the time.

Then, in February 2023, amidst a wave of national protests, a support ticket from Geedge Networks shows their experts were called in to fix a problem with regard to social media platforms like YouTube and Twitter. During the same time frame, the blocking of access to social media platforms was reported.

At least one Jira support ticket shows evidence of plaintext capture of email:

The internal documents show that Geedge Networks' tools, including the Tiangou Secure Gateway, were being used in [Pakistan]– and, in at least one case, e-mail traffic between a global shipping company and a Pakistani company has been intercepted.