Mid- September 2025, one of the most significant information leaks in Internet history happened: more than half a terabyte of source code, deployment manuals, and operational logs leaked from inside China’s Great Firewall. 

The files, attributed to Geedge Networks and the Chinese Academy of Sciences’ Mesa Lab, detail not just how the system is built, but how it is packaged and exported. Contracts in the documents tie Geedge systems to Myanmar, Pakistan, Ethiopia, Kazakhstan, and at least one other unnamed country.

For decades, the Great Firewall has been seen as a uniquely Chinese system: a bespoke national infrastructure combining deep packet inspection, routing policies, and legal mandates. The leak shows it is no longer a custom project. The Firewall has been productized.

The leaked materials are comprehensive. They include build systems for Geedge’s “Tiangou Secure Gateway,” administrative dashboards, logs from live deployments, and correspondence between engineers and government clients.

Deployment maps show large-scale rollouts: in Myanmar, appliances were installed across 26 data centers, with monitoring capacity for more than 80 million simultaneous connections Source Logs from Ethiopia record the system switching between passive monitoring and active blocking in response to political events. Source

Technical details confirm capabilities that were long-suspected by the activist groups like GFwatch and GFW report :

• Encrypted traffic inspection and fingerprinting. GFW modules detect common VPN protocols, analyze TLS handshakes, and apply throttling or blocking (CyberNews, Sept. 2025; GFW Report, Sept. 2025).
  

• QUIC decryption. Since 2024, the Firewall has been able to decrypt QUIC handshakes to identify server names. Researchers observed performance degradation when the system was under load (USENIX Security 2025).

• Volatile resets. In August 2025, China’s network briefly experienced widespread HTTPS resets after forged TCP packets were injected at scale (Tom’s Hardware, Aug. 2025).
  

• Customizable censorship. Manuals show how operators can tune filters by domain, keyword, or language, and even inject malicious payloads (Wired, Sept. 2025; GFW Report, Sept. 2025).

In light of all this, "firewall" in a classic sense doesn't really feel like a good name for the product we are looking at.

GFW is more like border-control platform capable of quickly and flexibly adapting to current political and technical circumstances.

Something that directly counters the global cloud model the leading platforms have grown to rely on.

Modern enterprise infrastructure - from Adobe Experience Manager as a Cloud Service (AEMaaCS) to Salesforce, Shopify, or other global e-commerce stacks -  were built on three assumptions:

1. The network is uniform - the routes may be long, but packets behave the same in Frankfurt, Virginia, or Delhi,
   

2. Every request can call back to a global backend - and pages, APIs, or search engines requests can always reach back to global backends,
   

3. CDNs make pages faster - as static content and caching layers can smooth the edges for end user.

All that works - until a border router decides your packets are suspicious - and by definition, all data coming from abroad is. Then you get the usual complaints: 2-minute page loads, broken assets, analytics going AWOL.

It was once convenient to call that “the China problem”. Now, as The Geedge paperwork suggests, it’s also “the Pakistan problem, the Myanmar problem, the Ethiopia problem, and the Kazakhstan problem” - with other, much larger and influential states already making moves towards implementing digital control.

The place to get that information are, surprisingly or not, the global watchdog organizations, whose since early 2000s have been monitoring the growing tendencies towards restriction and surveillance over their internet users.

Content

How it works now: One global SaaS instance + CDN. China (or another country) is just “another region”, and we accept the fact that the pages get up to 200x slower there.

Why it breaks as firewalls spread: Every user request that hits a backend abroad must cross each border’s DPI box. Today that’s one (China). Tomorrow it could be two or three (Kazakhstan + Pakistan + Ethiopia). Latency, resets, and throttling don’t add linearly — they compound. You can’t debug or predict it, because every sovereign edge is a policy surface.

How it works now: Duplicate the platform inside China (Alibaba/Tencent). Run a local runtime.

Why it won't work anymore: Forking is tolerable if you do it once. But more and more other countries adopt the same regime, do you fork again and again? Each fork means a new compliance stack, new ops team, new data pipeline across borders.

You’re suddenly running five Internets instead of two. The operational cost scales exponentially, and content sync becomes fragile across multiple checkpoints.

Content