For years, China's national internet filtering system, widely known as the Great Firewall, was studied mostly from the outside: researchers measured what was blocked and guessed at how. In September 2025 that changed, when a very large collection of internal documents from companies and labs linked to the system appeared online.

More than a year later, as of October 2026, the leak is still one of the clearest public windows into how large-scale internet filtering is built, sold and deployed beyond China's borders. This article summarises what researchers and human rights groups reported, what remains unconfirmed, and why the technology involved matters to ordinary internet users, not just to activists.

What leaked, and when

According to GFW Report, a research group that tracks China's internet filtering, the leak occurred on 11 September 2025. It included more than 500 GB of source code, work logs and internal communication records; the full set was about 600 GB, most of it a single code archive.

The material came from two organisations:

  • Geedge Networks, a company that GFW Report says was founded in 2018 in Hainan. Its chief scientist is Fang Binxing, often described as the "father of the Great Firewall".
  • The MESA Lab at the Institute of Information Engineering of the Chinese Academy of Sciences. MESA stands for "Massive Effective Stream Analysis", and according to GFW Report much of Geedge's core research staff came from it.

GFW Report published its first analysis on 12 September 2025 and noted that the source code itself had not yet been analysed at that point. It also warned that the files could contain risky content and advised anyone examining them to do so only in an isolated virtual machine without internet access. That is good advice for everyone: leaked archives are a classic way to spread malware, so curious readers are better off relying on published research than downloading the files.

Who reportedly bought the systems

The most striking part of the leak is what it suggests about customers. GFW Report listed authorities in the Chinese provinces and regions of Xinjiang, Jiangsu and Fujian, and export customers in Myanmar, Pakistan, Ethiopia and Kazakhstan, plus one country it did not identify, describing these projects as taking place under the "Belt and Road" framework.

In other words, the leak points to something researchers had long suspected: national-scale filtering can be bought as a product, a packaged system that a government can install on its country's networks rather than build from scratch.

These are reported findings based on leaked documents. The companies involved have not confirmed them in the sources cited here, and details such as the scale of each deployment are not independently verified.

Pakistan: a detailed case study

Just before the leak became public, on 9 September 2025, Amnesty International published "Shadows of Control", a report on Pakistan's monitoring and filtering systems that also drew on what it called the "Geedge dataset". Amnesty reported that:

  • Pakistan's first Web Monitoring System (WMS 1.0) was installed in 2018 using technology from the Canadian company Sandvine (now AppLogic Networks).
  • In 2023 it was replaced by WMS 2.0, which Amnesty says is built on Geedge technology and which it believes is a commercial version of China's Great Firewall. Components also came from companies in the United States and France.
  • WMS 2.0 can block internet access and specific content "with virtually no transparency", and can also block VPNs and websites the authorities consider unlawful.
  • A separate system for monitoring phone communications, known as LIMS, lets authorities spy on "more than four million people at any given time", according to Amnesty, with core technology from German and Emirati firms.

Amnesty said it contacted 20 companies and that only two answered its questions. The report is a reminder that this industry is international: equipment from many countries ends up in the same national system.

Russia: similar technology, built at home

The same kind of technology is used elsewhere without Chinese exports. Mediazona, an independent Russian outlet, explained on 7 April 2026 that Russia's TSPU devices, installed on internet providers' networks under the 2019 "sovereign internet" law, inspect traffic in real time and are controlled centrally by the national telecoms regulator rather than by the providers themselves. Citing a March 2026 report by the newspaper Kommersant, Mediazona wrote that the government plans to increase the system's capacity about 2.5 times by 2030, to 954 terabits per second. For the wider rules on VPN use there, see our explainer on Russia's VPN rules in 2026.

Why deep packet inspection matters for your privacy

All of these systems rely on deep packet inspection (DPI). Ordinary network equipment looks only at the "envelope" of each packet: where it comes from and where it is going. DPI looks deeper, at patterns in the traffic itself, to work out what kind of connection it is, which service it belongs to, or which protocol is being used. That lets an operator slow down, block or log specific kinds of traffic, not just specific addresses.

For everyday users, this has a few practical consequences:

  • Metadata is visible even when content is encrypted. HTTPS protects what you read and type, but systems on the path can often still see which sites you connect to and when.
  • Unencrypted traffic is fully exposed. Old apps and websites that don't use encryption can be read, not just filtered.
  • Encrypted protocols can be recognised. DPI can often identify that a connection is a VPN, even if it cannot read what is inside.
  • Rules can change without notice. Because these systems are configured centrally, services can stop working overnight, as Amnesty's "no transparency" finding suggests.

What you can do

You don't need to be a target for this technology to affect you. A few habits help anywhere:

  • Use HTTPS and encrypted messaging so that the content of your communication stays private, even if metadata does not.
  • Keep apps and devices updated, and install apps only from official stores or the developer's own website. In places where services are restricted, fake "helper" apps are a common way to spread malware.
  • Don't download leaked archives out of curiosity; read researchers' analyses instead.
  • Protect your accounts with strong, unique passwords and two-step verification.
  • Check local law before using any privacy tool. Rules on VPNs differ widely by country and change over time. Our guide What is a VPN? explains what a VPN does and does not protect.

Key takeaways

  • The September 2025 leak exposed hundreds of gigabytes of internal material from Geedge Networks and the MESA Lab.
  • Researchers reported customers in several Chinese regions and in Myanmar, Pakistan, Ethiopia and Kazakhstan.
  • Amnesty documented how Pakistan's WMS 2.0, reportedly built on Geedge technology, can block content and VPNs.
  • Deep packet inspection lets networks see more than you might expect, so encryption, careful app choices and good account security matter.