Leak of Geedge Networks internal documents (100,000+ from Jira, Confluence, GitLab)

Geedge co-founder Fang Binxing—named 'father of the Great Firewall' in company documents—explicitly linked Geedge's international expansion to China's Belt and Road Initiative in a 2024 speech, and a Geedge job advertisement sought candidates willing to travel to Pakistan, Malaysia, Bahrain, Algeria, and India. This confirms BRI as an institutional channel for GFW-derived censorship infrastructure export, not merely bilateral commercial deals.

body policy dpiip-blockingthrottling cnpkinkzetmm

Geedge's internal documents show that capabilities developed for one national deployment are explicitly documented to 'trickle down' to all the company's global clients—for example, Psiphon-blocking logic developed for Myanmar was tested for Ethiopia, though not yet fully deployed there as of the leak date. This vendor-mediated capability diffusion accelerates censorship sophistication across all client states simultaneously. The same model was framed at a July 2024 Urumqi meeting as a 'long-term struggle and technical confrontation', with anti-circumvention features developed for Xinjiang slated to roll out to Geedge clients globally.

body deployment dpiip-blockingtraffic-shape mmetpkkz

Internal Geedge documentation lists nine commercial VPNs as 'resolved,' providing staff with documented methods for identifying and filtering each protocol's traffic. The leak shows employees reverse-engineering popular circumvention tools to develop blocking signatures, consistent with GFW practices that have rendered most commercial VPNs inaccessible inside China.

body detection dpitls-fingerprinttraffic-shaperandom-payload-detect cnmmpketkz

Following Myanmar's 2021 coup, Geedge developed a tool specifically to detect the server endpoints that Psiphon's app connects to, enabling nationwide blocking. OONI measurement data shows Psiphon access was 'highly limited' in Myanmar from June 2024 to March 2025—a roughly nine-month window of near-total suppression.

body detection dpiip-blockingactive-probing mm

After Sandvine exited Pakistan in 2023 under U.S. sanctions, Geedge stepped in to power Pakistan's Web Monitoring System (national firewall), reportedly utilizing existing Sandvine hardware alongside new Geedge technology. This demonstrates that Western vendor exits under sanctions pressure do not disrupt national filtering infrastructure — they create vacuums filled by Chinese GFW-derivative equivalents.

Body deployment dpiip-blockingkeyword-filtering pk

A September 2025 leak of 100,000+ internal documents from Geedge Networks—co-founded by Great Firewall architect Fang Binxing—confirms export of GFW-derived Tiangou Secure Gateway (TSG) to Myanmar, Pakistan, Ethiopia, and Kazakhstan, providing those governments with DPI-based filtering, throttling, VPN blocking, and internet-blackout capabilities previously unavailable to them. Pakistan's deployment replaced Sandvine's Web Monitoring System infrastructure after Sandvine was sanctioned and exited in 2023, with Geedge apparently utilizing existing Sandvine hardware. Kazakhstan was the first client, from 2018, and Geedge claims more than 40 global service providers as clients under the Belt and Road Initiative framework.

body deployment dpiip-blockingthrottlingtraffic-shape cnmmpketkz

Despite Geedge's targeted Psiphon blocking in Myanmar (confirmed by OONI, June 2024–March 2025), Psiphon gained users during Myanmar's worst internet disruptions because all circumvention tools were simultaneously disrupted, with commercial VPNs collapsing first. Grant-funded tools with active anti-censorship investment (Psiphon, Tor) showed measurably greater resilience than commercial VPNs that do not invest in pluggable transport infrastructure.

Body evaluation ip-blockingdpiactive-probing mm