The Internet Coup

A Technical Analysis on How a Chinese Company is Exporting The Great Firewall to Autocratic Regimes

Over the past two decades, the Chinese gov­ern­ment has been steadi­ly refin­ing their mod­el of inter­net con­trol using sur­veil­lance and cen­sor­ship tech­nolo­gies domes­ti­cal­ly while pro­mot­ing this approach to oth­er nations under the ban­ner of “dig­i­tal sov­er­eign­ty”. Through the export of these tech­nolo­gies, China is not only extend­ing its glob­al influ­ence but also lay­ing the foun­da­tion for a fed­er­at­ed sys­tem of inter­net gov­er­nance. In this sys­tem, Chinese com­pa­nies pro­vide the infra­struc­ture and exper­tise for client gov­ern­ments to more eas­i­ly mon­i­tor and con­trol their own net­works, while learn­ing from these deploy­ments and improv­ing col­lec­tive capac­i­ty for dig­i­tal author­i­tar­i­an­ism worldwide.

This research by InterSecLab uncov­ers evi­dence of the export of a suite of tech­nolo­gies resem­bling China’s Great Firewall by Geedge Networks, a pri­vate com­pa­ny linked to the aca­d­e­m­ic enti­ty ‘Massive and Effective Stream Analysis’ (Mesalab), a research lab­o­ra­to­ry at the Chinese Academy of Sciences. Our team’s inves­ti­ga­tion iden­ti­fies a pat­tern of com­mer­cial­iza­tion of sur­veil­lance capa­bil­i­ties, with Geedge Networks offer­ing a suite of prod­ucts that enable com­pre­hen­sive mon­i­tor­ing and con­trol of inter­net users.

InterSecLab’s analy­sis reveals that Geedge Networks is con­tract­ed with gov­ern­ments in Kazakhstan, Ethiopia, Pakistan, Myanmar, and one oth­er unknown coun­try to estab­lish sophis­ti­cat­ed sys­tems of inter­net cen­sor­ship and sur­veil­lance. Furthermore, our find­ings indi­cate that Geedge Networks is also involved in devel­op­ing sim­i­lar sys­tems deployed with­in China, includ­ing in Xinjiang and oth­er regions.

Following a joint inves­ti­ga­tion of 100,000 leaked inter­nal doc­u­ments linked to the Chinese com­pa­ny Geedge Networks, researchers found that the Chinese com­pa­ny has export­ed an inter­net cen­sor­ship toolset sim­i­lar to the Chinese Great Firewall to auto­crat­ic regimes.

The research team was com­posed of inves­tiga­tive reporters from sev­er­al media out­lets and researchers from human rights and inter­net free­dom groups, includ­ing InterSecLab, Amnesty International, Justice For Myanmar and the Tor Project. The research team spent almost one year review­ing the 100,000 doc­u­ments that leaked in 2024, and dis­cov­ered that China, through its affil­i­at­ed pri­vate com­pa­ny, has devel­oped a busi­ness mod­el by pro­vid­ing cen­sor­ship ser­vices to auto­crat­ic regimes and has test­ed new sur­veil­lance tech­nol­o­gy domes­ti­cal­ly in Xinjiang and oth­er Chinese cities.

Geedge Networks: China’s private entity on censorship and surveillance

The Beijing-based Chinese com­pa­ny Geedge Networks was found­ed in 2018 by Fang Binxing, a for­mer prin­ci­pal of Beijing University of Posts and Telecommunications who was crowned the father of the Great Firewall. On the company’s web­site, it describes itself as “a glob­al provider of net­work secu­ri­ty and intel­li­gence equip­ment and solutions.”

Like the Chinese Great Firewall, the “secu­ri­ty net­work” offered by the Chinese com­pa­ny can fil­ter web­sites and apps, con­duct real-time online sur­veil­lance, con­trol inter­net data flow by region, enact inter­net black­outs, detect and block cir­cum­ven­tion tools (includ­ing VPNs), launch DDoS attacks against tar­get­ed web­sites, mon­i­tor and con­trol inter­net users’ data flow, infect users with mal­ware, and geo­graph­i­cal­ly locate indi­vid­ual inter­net users.

The leaked doc­u­ments revealed that the com­pa­ny, in addi­tion to pro­vid­ing cen­sor­ship and sur­veil­lance sys­tems to gov­ern­ments from auto­crat­ic regimes, includ­ing Myanmar, Pakistan, Ethiopia, and Kazakhstan, also con­ducts test­ing projects in var­i­ous regions with­in China in Xinjiang, Fujian, and Jiangsu, to enhance its sur­veil­lance and cen­sor­ship sys­tems further.

The researcher from InterSecLab found that the sys­tem relies on remote man­age­ment by the com­pa­ny employ­ees in China, and the data of inter­net users from their clients are shared with stu­dents at MesaLab, a research lab­o­ra­to­ry on infor­ma­tion­al nation­al secu­ri­ty at the Chinese Academy of Sciences. This not only implies an infringe­ment of inter­net users’ pri­va­cy, but also has seri­ous impli­ca­tions for nation­al data sov­er­eign­ty, as InterSecLab’s researchers highlighted.

Geedge’s overseas Great Firewall business

Kazakhstan is Geedge’s first for­eign gov­ern­ment client. The leaked doc­u­ments show that the Chinese com­pa­ny worked with the pres­i­dent of Kazakhstan, Kassym-Jomart Tokayev, who stud­ied in China between 1984–1991, to pro­mote the image of a “state that lis­tens” to civ­il soci­ety when Tokayev began his pres­i­den­cy in 2019. Yet, the “con­struc­tive dia­logue” was mon­i­tored and manip­u­lat­ed through the Chinese polit­i­cal con­trol toolset.

Geedge start­ed oper­at­ing in Ethiopia around 2021 after the Tigray war broke out in 2020. The researchers said that the Chinese sys­tem was used to detect and respond to social unrest.

Geedge’s oper­a­tions in Pakistan began in 2023, after the Canadian soft­ware com­pa­ny Sandvine end­ed its con­tract with Pakistan under the polit­i­cal pres­sure of US sanc­tions. Upon fur­ther devel­op­ment of Sandvine’s hard­ware, Geedge enhanced the capac­i­ty of the pre-exist­ing mon­i­tor­ing sys­tem to track local inter­net traf­fic and detect and block the use of cir­cum­ven­tion tools. In 2024, Access Now’s “Keep It On” report reg­is­tered 21 shut­downs, and the Pakistan Telecom Authority acknowl­edged over 100,000 instances of con­tent block­ing over con­cerns includ­ing “moral­i­ty,” “nation­al secu­ri­ty,” and “incite­ment of hate.”

The imple­men­ta­tion of the Geedge sys­tem in Myanmar also began in 2023, two years after the mil­i­tary coup that over­threw the demo­c­ra­t­i­cal­ly elect­ed gov­ern­ment of Aung San Suu Kyi in February 2021. Geedge helped the jun­ta block 55 apps, includ­ing cir­cum­ven­tion tools such as VPNs and Tor, as well as mes­sag­ing apps like Signal and WhatsApp. In 2024, the jun­ta ordered 74 inter­net shut­downs to cov­er up the killing of civil­ians dur­ing armed con­flicts and to iso­late the coun­try from the rest of the world.

The complicity of Western companies

As indi­cat­ed in the leaked doc­u­ments, Geedge’s toolset must be installed by inter­net ser­vice providers (ISPs). In the case of Myanmar, Frontiir, an ISP that received invest­ment funds from Denmark, Norway, and the UK, had installed in its data cen­ters Geedge’s hard­ware that could track peo­ple online, and block web­sites and VPNs. Yet, the com­pa­ny denied its involve­ment in assist­ing cen­sor­ship and surveillance.

InterSecLab’s report also revealed that Geedge had used cer­tain tech­nolo­gies owned by Western com­pa­nies in its cen­sor­ship busi­ness. For exam­ple, accord­ing to the data leak, Sentinel HASP, a soft­ware license pro­tec­tion appli­ca­tion devel­oped by a sub­sidiary of the French aero­space and defense giant Thales Group, has been used by Geedge to set a time lim­it on client access to its soft­ware, there­fore mon­e­tiz­ing its soft­ware. However, in response to InterSecLab’s find­ing, the Thales Group said that “Geedge Networks soft­ware does not rely on Sentinel to func­tion. Thus, Sentinel does not con­tribute to the per­for­mance and func­tion­ing of Geedge Networks soft­ware and has noth­ing to do with the sur­veil­lance func­tion of Geedge Networks’ product.”

InterSecLab high­light­ed the need for trans­paren­cy and account­abil­i­ty among Western com­pa­nies regard­ing their involve­ment in busi­ness activ­i­ties that vio­late human rights.

Xinjiang: Testing ground for new surveillance technologies

The leaked doc­u­ment showed that Geedge had a spe­cial oper­a­tion in Xinjiang in col­lab­o­ra­tion with MesaLab and the Chinese Academy of Sciences begin­ning in 2022. The con­sor­tium of local gov­ern­ment, aca­d­e­mics, and Geedge indi­cates that the project is close­ly affil­i­at­ed with the Chinese government.

A major test­ing fea­ture of the Xinjiang project is Cyber Narrator, which aims to ana­lyze inter­net user behav­ior, lifestyle pat­terns and rela­tion­ships. It is capa­ble of gen­er­at­ing a rela­tion­ship graph based on a person’s con­tacts, online groups, and data from the users’ appli­ca­tions and web­sites they visit.

Another fea­ture is an alert sys­tem tar­get­ing spe­cif­ic indi­vid­u­als when they enter a des­ig­nat­ed area, change SIM cards, make an inter­na­tion­al call, or use cir­cum­ven­tion tools and for­eign social media applications.

The Geedge sys­tem also strength­ens its geo-detec­tion capac­i­ty, which not only locates an indi­vid­ual but also maps the dis­tri­b­u­tion of a mon­i­tored group and their geolo­ca­tion pat­tern to iden­ti­fy unusu­al gatherings.

Other domes­tic projects have tak­en place in Fujian and Jiangsu. The for­mer is a south­ern Chinese province, locat­ed off the coast of Taiwan, a run­away autonomous state that China claims as a part of its sov­er­eign­ty. There was lim­it­ed infor­ma­tion about the Fujian project in the leaked doc­u­ment. As for Jiangsu, the project was relat­ed to the devel­op­ment of a scam-detec­tion system.

The devel­op­ment, as indi­cat­ed by the leaked doc­u­ments, shows that the Chinese gov­ern­ment is active­ly trans­lat­ing its polit­i­cal con­trol mod­el into a cap­i­tal­ist busi­ness mod­el that caters for the needs of author­i­tar­i­an and auto­crat­ic gov­ern­ments. The domes­tic cen­sor­ship and sur­veil­lance sys­tem, hence, extends beyond the coun­try, affect­ing peo­ple who live under oppres­sive regimes around the world.

Source and cred­its: INTERSECLAB

September 09th, 2025

Read the full report 
The Internet Coup: A Technical Analysis on How a Chinese Company is Exporting The Great Firewall to Autocratic Regimes.

This research by InterSecLab is part of the Great Firewall Export inves­ti­ga­tion, a joint col­lab­o­ra­tion with the part­ners Amnesty International, Justice For Myanmar, Paper Trail Media, The Globe and Mail, the Tor Project, the Austrian news­pa­per DER STANDARD and Follow The Money.