Geedge
TLDR: Geedge Networks was founded in 2018 by Fang Binxing. It commercializes and exports surveillance infrastructure to authoritarian governments. (Kazakhstan, Ethiopia, Pakistan, Myanmar, and Chinese provinces). The product also includes TSG hardware (firewall appliance), TSG Galaxy (data warehouse) and Cyber Narrator (behavioral analytics dashboard). The revenue comes from hardware sales, annual subscriptions from client governments, and data sharing with Mesalab researchers. The technology integrates Western and Chinese components and creates a surveillance loop: extract user data > analyze patterns > monetize control.
Introduction
Geedge Networks is a Chinese tech company that sells the Great Firewall (GFW). Founded in 2018, the company packages surveillance infrastructure which was once used only in China and now it exports to authoritarian governments around the world. It's a complete product containing: hardware, software, technical support, and ongoing updates. Governments pay upfront for the equipment and then pay annual subscription fees. The data client governments collect feeds back to Chinese researchers from Mesalab who use it to improve the blocking technology.
What makes Geedge interesting is the timing, internet censorship tech was previously scattered across different vendors and countries. China's approach had been state-run and internal. Geedge turned it into a commercial product: one standardized surveillance appliance that any tyrant could buy and install.
Who Is Geedge Networks
The company was founded by Fang Binxing, a computer scientist at BUPT (Beijing University of Posts and Telecommunications). He's known as the father of the Great Firewall. For decades, Fang and his team built the systems that allow China to filter content, block services, and track users.
Fang didn't start with repression as a goal, he started as an academic researcher. He published papers on network security. Over time, those papers became the foundation for surveillance tools. By the time Geedge was founded, he had spent more than twenty years perfecting how to block traffic and identify users trying to circumvent the system.
Origins and Background
The Great Firewall itself began in the 1990s as China opened its internet to the public. The government needed control, so Fang's lab at BUPT became central to that mission and the GFW grew more sophisticated.
By the 2010s, the GFW was mature. China had built something that worked, other governments started to noticed it, but these governments lacked the internal capacity to build it themselves. They didn't have twenty years to build their own systems. That's where Geedge came in.
Geedge's connection to Mesalab is critical. Mesalab is a research laboratory funded by the Chinese Academy of Sciences, they study how to defeat circumvention tools. As Geedge clients deploy the technology, real-world data flows back to Mesalab. Researchers use it to train machine learning models and stay ahead of open-source tools that dissidents and activists use.
It's a feedback loop.
Geedge makes money.
Mesalab gets research data.
Governments get surveillance.
Everyone benefits except the people being monitored.
What They Sell
What sets Geedge apart is its refusal to unbundle. Unlike vendors who sell network appliances that customers integrate themselves, Geedge treats the entire stack. TSG hardware, blocking logic, logging infrastructure, and analytics as an inseparable whole with some exceptions.
It's the surveillance equivalent of Apple's locked ecosystem: you can't buy the device without the OS, and you can't modify it either. This design choice is deliberate. It ensures that every connection flows through Geedge's infrastructure, making it impossible for a regime to accidentally misconfigure something or leave a backdoor open.
The Hardware: TSG
TSG stands for Tiangou Secure Gateway. The TSG appliance inspects packets in real time, capturing not just URLs but the protocols and data patterns that reveal what users are trying to do. A VPN connection is immediately recognizable by its traffic signature, once flagged, the data flows into Cyber Narrator, which profiles the person behind each attempt. Repeated access to banned content gets cross-referenced with metadata to create behavioral profiles authorities can act on.
The hardware does deep packet inspection. It can identify VPNs. It can spot proxy services. It can detect and block circumvention tools. It can even inject malware into user traffic. The capabilities are similar to China's Great Firewall, because that's exactly what it is.
The Software Suite
Three software components work together to create the surveillance stack.
TSG Galaxy (massive data warehouse)
TSG Galaxy is a data storage and analysis pipeline. Every packet captured by TSG hardware flows into TSG Galaxy: a massive data warehouse designed for internet-scale surveillance. You can query what happened a few months ago. You can track patterns over time. You can identify which users consistently try to access banned content.
Cyber Narrator
Cyber Narrator is accessed by client governments through a cloud dashboard. It uses machine learning to identify patterns in user behavior. It can see which IP addresses tried to access which blocked sites, when they tried, and what patterns emerge.
The system flags users who repeatedly try to access blocked news sites, use VPNs or proxies, search for political opposition content, or communicate with known dissidents. Once they're flagged, these users get tagged as "dissident", "terrorist", "terrorist leader", or "extremist". The system creates a political profile of every internet user. That profile can be used to find people to arrest, monitor and silence.
The Business Model
How Geedge Makes Money
Hardware sales start at $200,000 and scale to $2 million per installation. After that, subscriptions for software updates and content databases generate steady annual revenue. There's also the data arrangement: Mesalab, a Chinese Academy of Sciences lab, gets access to client data to train blocking models. Geedge gets paid for that access and each deployment produces data that makes the next one more effective.
Researchers get data about how users try to circumvent the system. When Pakistan deploys Geedge and activists use new tools, that data flows back. It's a global testing ground for surveillance technology.
Who Buys It
Geedge's client list includes Kazakhstan, Ethiopia, Pakistan, and Myanmar. It also operates in Chinese provinces including Xinjiang, Fujian, and Jiangsu. There's mention of a client called "A24" in company documents, though the actual identity remains unknown.
These aren't random countries. Many have poor human rights records and are trying to suppress political opposition or ethnic minorities. Geedge provides the technology to do it more effectively.
Pakistan deployed Geedge starting in 2023. Within months, the system was active. VPNs stopped working. Accessing foreign news sites became impossible.
Geedge was founded in 2018. Early deployments started in 2019 and 2020. By 2024, it was operational in at least four countries outside China.
Why It's Different
Traditional surveillance infrastructure comes in pieces, as seen in the mass surveillance in the United States, where the surveillance infrastructure is scattered among many divisions and companies. You buy infrastructure from one vendor, backdoors from another and "intelligence data" from another.
Geedge sells the entire stack integrated. One box, one dashboard, one vendor to call when something breaks. They maintain remote access to customer networks for technical support and software updates. This means surveillance data from foreign governments is accessible to China, TSG Galaxy data is accessible to Geedge employees in China and data snapshots are shared with Mesalab students for research purposes. When a client government deploys Geedge, the data they collect doesn't stay confidential. It unsurprisingly flows back to Beijing.
The system includes specific technology to identify and block circumvention tools. New tor circumvention techniques get blocked by Geedge. VPN usage gets logged and blocking rules update regularly.
Open-source circumvention projects move slower, when a new tool gets released it may take weeks or months for everyone to deploy it. By then, governments with Geedge may have already blocked it. The technology advantage swings heavily toward the system designers.
Appsketch was a blocking rule deployed by Mesalab researchers. It targeted a specific circumvention app. The rule was developed, tested, and pushed to all Geedge clients simultaneously. The app stopped working overnight in every country using Geedge.
Partners and Ecosystem
Thales is a French defense contractor that works with Geedge clients, local internet service providers integrate Geedge into their networks. Companies like Safaricom and Frontiir have deployed the technology to enact government censorship.
Western companies sell network infrastructure to tyrants that then use Geedge to monitor traffic. The Western vendors can claim they didn't know how their equipment would be used. This dynamic enables sanction evasion through corporate abstraction.
Surveillance Capitalism in Asia
Before Geedge, if you used a VPN in a country with heavy surveillance, you took a risk. Your ISP logs that you used a VPN, but without a centralized system, they couldn't do much with that information. After Geedge, VPN usage gets flagged automatically. Then it gets analyzed and users get profiled as "terrorists" or "terrorist leaders" as mentioned previously.
The surveillance capitalism model is extraction, prediction, and monetization. Geedge extracts data, the data then predicts behavior and political leanings and the predictions get monetized through government contracts and research licensing.
This is what surveillance states look like in the 22nd century. Not uniforms and interrogation rooms, though those still exist. It's algorithmic and invisible. It operates at the network level and every attempt to circumvent gets recorded.
The technology works at scale. A government with 1.4 billion internet users can monitor all of them simultaneously. The system doesn't require hiring more people. Adding more users just means more data flowing into the analytics engine. More data means better predictions. Better predictions mean more effective suppression.
This is surveillance capitalism deployed by governments with no concern for privacy or human rights. It's not designed to catch criminals. It's designed to identify political opponents, activists, suppress dissent and to maintain control.
Conclusion
Geedge Networks represents the globalization of Chinese surveillance technology. What was once unique to China is now available for export. The company has commercialized internet censorship, bundled it into a product, and sold it to authoritarian governments around the world.
The business model is effective. Governments pay for hardware and subscriptions. The data collected improves the technology. The improved technology sells to more governments and everyone in the ecosystem profits except the citizens being monitored.
This is happening now in Kazakhstan, Pakistan, Myanmar, Ethiopia, and multiple regions of China. And as long as governments are willing to pay for control, Geedge will keep selling.
Further reading: - The Internet Coup - Interseclab - Global Voices - The Globe and Mail - Der Standard - Follow the Money - Amnesty - Justice for Myanmar - gfw.report
Suggest changes
Lain
2026-06-18
Donate XMR to the author:4AGtz56WqJdXYt8qhkDbHRNaSTdu2nKuEGwDVzxeWPodQj1cVH2EQkk4fi9uAu8os1fazSUBDsqeFBqoEzAFuay3Fwd9BjJ