2025-interseclab-internet-coup

The Internet Coupcore

Abstract

76-page consortium report based on a nine-month indexing, translation, and analysis effort over the ~600 GB Geedge/MESA leak. Documents how China's domestic censorship infrastructure has been productized and exported through Geedge Networks to states including Myanmar, Pakistan, Ethiopia, and Kazakhstan, with technical detail on the Tiangou Secure Gateway (TSG) product line and its detection capabilities.

Team notes

Of the analyses published alongside the leak, InterSecLab's is the most thorough technical read — they spent nine months on it. For Lantern protocol designers, this is the highest-leverage way to extract threat-model intelligence from the leak without working through the raw 600 GB. Pay particular attention to TSG product documentation: Geedge's productized GFW provides a clearer view of what detection capabilities are commercially deployable in customer states (vs. only deployed by the CN national operator). When designing for IR / RU / etc., assume Geedge or a Geedge-derived product is at least *available* to the censor, even where there's no public deployment evidence yet.

Tags

censors
cn
techniques
dpiactive-probingml-classifiersni-blockingtraffic-shapedns-poisoningfully-encrypted-detectip-blocking
defenses
mimicryrandomization
method
measurement-study