The Great Firewall has a vendor: Geedge Networks, five client states, 100,000 leaked files

InterSecLab published a technical analysis on 09 September 2025 arguing that a Chinese private company, Geedge Networks, is exporting a suite of technologies resembling China's Great Firewall to other governments ^[1][2]. The research rests on a leak of more than 100,000 Geedge documents shared with the group, and it names contracts with governments in Kazakhstan, Ethiopia, Pakistan, Myanmar and one further country the researchers do not identify ^[3][4] - five client jurisdictions in total ^[13].

The capability list is the part worth reading twice. According to InterSecLab, the systems include deep packet inspection, real-time monitoring of mobile subscribers, granular control over internet traffic, and censorship rules that can be tailored to each region ^[5]. That is a carrier-side toolkit with per-subscriber visibility, not a blunt national on/off switch, and the per-region tailoring means regional variation in what works is a configuration choice rather than an accident of routing ^[5].

Provenance matters here because it explains the iteration loop. InterSecLab links Geedge Networks to Mesalab, or "Massive and Effective Stream Analysis", a research laboratory at the Chinese Academy of Sciences ^[6], and says its findings indicate Geedge has also been involved in developing similar systems deployed inside China, including in Xinjiang and other regions ^[7]. The leak, per the researchers, also documents the Geedge-Mesalab relationship and the company's interactions with client governments, along with deployment timelines drawn from internal documentation ^[11][12].

The framing InterSecLab attacks is the sales language. The group's account is that Beijing has spent two decades refining domestic surveillance and censorship while promoting the model abroad under the banner of "digital sovereignty" ^[8], with Chinese firms supplying infrastructure and expertise to client states and learning from each deployment, which InterSecLab argues improves collective capacity for digital authoritarianism and lays the foundation for a federated system of internet governance ^[9]. Its own summary calls the implications for data sovereignty significant and raises concerns about the commoditization of surveillance and information control ^[16]. The work is one strand of the Great Firewall Export investigation, a collaboration with Amnesty International, Justice For Myanmar, Paper Trail Media, The Globe and Mail, the Tor Project, DER STANDARD and Follow The Money ^[10].

For operators, the shift is from country risk to vendor risk. If a national filtering plane is a commercial product with a support relationship, then anti-circumvention improvements arrive as releases, not as one-off political decisions, and capability in one client state is a reasonable prior for capability in the next ^[9][5]. Real-time monitoring of mobile subscribers is the line that should drive policy on corporate SIMs, roaming, and any assumption that staff traffic in these markets is only observable in aggregate ^[5]. Note also what the public summary does not provide: no figure for how much of any country's traffic traverses Geedge systems, and no company response ^[15].

Watch for whether the unnamed fifth client government is identified, either by InterSecLab or by consortium partners publishing nationally ^[4][10]. Watch for procurement and contracting records that corroborate the leak from the buyer side rather than the vendor side ^[3]. And watch the measurement community: InterSecLab's page lists academic work by researchers at the University of Massachusetts Amherst, GFW Report and the University of Minnesota ^[14], and network-level observation from outside these countries is what turns a document leak into something operators can test against their own traffic.