Researchers with InterSecLab and several human rights organizations on Sept. 9 published a report detailing how the Chinese communist regime has not only refined its internet surveillance and censorship abilities domestically, but is also exporting these methods for profit.
The findings are the conclusion of analyzing more than 100,000 leaked documents from Geedge Networks, a Chinese company that has contracted with governments in Kazakhstan, Ethiopia, Pakistan, Burma (Myanmar), and other unknown governments to “establish sophisticated systems of internet censorship and surveillance.”
Geedge Networks did not respond to an inquiry from The Epoch Times by publication time.
An Associated Press investigation published the same day exposed how Chinese systems used to persecute ethnic and religious minorities, including Falun Gong practitioners, were built on technologies supplied by American companies over the past several decades.
The InterSecLab findings confirm that Geedge frequently copied products from Western companies and designed its own products to be “sanction proof” by enabling usage across a wide range of network equipment options.
“We are publishing this report at a critical moment for internet freedom worldwide,” the researchers wrote.
They said that Geedge’s open marketing of censorship and surveillance services marks a fundamental shift in both technical capability and willingness to deploy such technologies around the world. The company was founded in 2018, selling “distinctly modern” cyberservices that are worlds apart from previous “patchwork” government attempts to enforce internet control, researchers said.
“In some cases, Geedge accomplished in a matter of months tasks that a client government struggled with for years,” the report reads.
Custom Digital Repression Solutions
The report highlights an example from 2022, when the United Nations held its Internet Governance Forum, highlighting a cease-fire deal that was announced after the population of 7 million in the Tigray region of Ethiopia had been cut off from the internet for two years.
While Ethiopia’s deputy prime minister was thanking U.N. members, the Ethiopian government was simultaneously working with Geedge to acquire new surveillance and censorship tools, according to the report. Log entries show that the Geedge chief technology officer signed off on work on two data centers less than a month after the forum, and more work was contracted throughout 2023 and 2024.
“These systems empower client governments to conduct both broad-scale population monitoring and internet shutdowns, while simultaneously enabling granular surveillance of internet users and targeted blocking and censorship,” the InterSecLab report reads.
The granular services include allowing government clients to identify specific individuals accessing certain websites or using VPNs or other tools, block access to specific tools or apps, and even infect users with malware, according to the report.
One such tool is Cyber Narrator, which allows clients to find the geographic location of specific people linked to their cell identifiers. It’s technology that can be used to identify protest gatherings in real time, and their participants, the report notes.
A screenshot of a Cyber Narrator map showed population clusters that identified individual users as locals, visitors, or potential threats a client can designate, such as “terrorist.”
Tiangou Secure Gateway (TSG) is a firewall that allows clients to monitor user traffic for an entire country, track specific users, and block access to specific tools and sites.
TSG Galaxy is a platform that stores and analyzes a significant amount of collected data.
The capability to identify and track specific users dovetails with another capability that allows for assigning scores to specific users and cutting off internet access for users whose scores fall below a certain level.
Among those discussed were the ability to construct relationship graphs of internet users, identify individuals who frequently change SIM cards or make international calls, and even cyberattack services.
Geedge usually sets up a national control center in the client country, and sometimes additional regional data centers.
Some of its services require work by Geedge employees based in China, so internet data from client countries could be made accessible to Chinese institutions like CAS.
Researchers say the documents show it’s likely Chinese engineering students have used some of this data in work aimed at refining these digital repression techniques.
“These students use samples of this data for product development and research aimed at better understanding and obstructing internet censorship circumvention,” the report reads.
International Implications
Researchers say that internet service providers (ISPs), including international companies with foreign investment, are complicit when Geedge hardware is installed in provider data centers.
“It is crucial to note that there is no way for Geedge to install its hardware without the knowledge and collaboration from ISPs,” the report reads.
Another key international link is Geedge’s use of Sentinel HASP, digital rights management software that it licenses to operate its business. Researchers say the documents show that the software is critical to client governments’ use of TSG.
“Specifically, this means that when the license period ends, the software will cease to function,” the report reads.
The software solution has been acquired by a large French defense company, Thales Group, which confirmed to researchers that it licenses its software to Geedge, but that Geedge did not rely on it to function, and that it has nothing to do with the surveillance function of Geedge’s products.
Thales Group did not respond to an inquiry from The Epoch Times by publication time.
In Ethiopia, the government increased internet control when it allowed for the entrance of ISP Safaricom into the market by requiring the ISP to incorporate Geedge technology. Yet the move had been applauded by the international community, which viewed it as the breaking up of a monopoly by the state-owned Ethio Telecom, researchers said.
The researchers urged internet and technology providers to consider these implications and internet protocol designers to create more censorship-resistant tools.
The report was published as part of the Great Firewall Export investigation, undertaken jointly with Amnesty International, Justice For Myanmar, Paper Trail Media, The Globe and Mail, the Tor Project, Austrian newspaper Der Standard, and Follow The Money.
