If you are a circumvention developer, you will be interested in the linked paper, part of the proceedings of a security symposium held August 12-14, 2026. The authors note that until last year’s dramatic leak of source code that feeds into China’s Great Firewall, “black-box analysis” had been the only way to investigate DPI-based censorship systems.
DPI is deep packet inspection—deep inspection of bits of data sent over a computer network. DPI devices make it “easier than ever before for authoritarian nation-states to implement information controls and restrict Internet access.”
Black-box analysis relies on “Internet measurement experiments to infer the behavior of opaque and tightly controlled infrastructures, including those deployed by China.” Unfortunately, these measurements “are often noisy and incomplete, require substantial resources to deploy at scale, and can expose researchers and volunteers to ethical, legal, and personal safety risks.”
Finding out about the TSG
This paper is not the first attempt to dissect the code included in the Geedge Networks leak. But the 17 authors contend that theirs is the first systematic technical analysis.
This is the Abstract of the paper:
In September 2025, over 100K internal documents (including code, communications, etc.) from Geedge Networks, a Chinese DPI company with ties to the Great Firewall of China, were leaked to the public. In this paper, we analyze the source code from this leak, focusing on Geedge Networks’ flagship product, the Tiangou Secure Gateway (TSG) firewall [a major component of the Great Firewall]. Working across multiple repositories, we successfully build and run a local copy of TSG—revealing key aspects of its architecture, including the protocols it is capable of parsing and the format of blocking rules used to censor sites, proxies, and other resources. Finally, we extract several fingerprints from TSG, including custom random number generators and parsing idiosyncrasies that allow us to identify its use and similar deployments in the Great Firewall of China.
This is the first time that the source code of a commercial DPI has been leaked, and our work is the first code analysis of a core firewall component used in national censorship infrastructure. This unprecedented investigation offers insights that can assist circumvention developers and Internet security researchers in further understanding the capabilities and limitations of modern censorship technology.
Risk and mitigation
In a discussion of ethical considerations at the end of the paper, the authors say that they have considered the possibility that “by studying this firewall we could potentially make it easier to use this system.”
Specifically, our efforts to run a local operational copy of TSG [the Tiangou Secure Gateway firewall] could harm users experiencing censorship by enabling deploying countries to refine their systems or other censors to more easily deploy it themselves. To mitigate this risk, we choose not to publicly document or provide additional details on how to set up this firewall. We exclude this information from our published repository, instead focusing on information that is useful in fingerprinting these tools rather than direct operation or deployment.
We also considered whether it would be better to not deploy the firewall ourselves at all, as demonstrating feasibility could encourage others to do the same. We concluded that operating a local copy enables the anti-censorship community to fingerprint deployments, develop and test circumvention strategies against a working instance, and generalize those strategies across multiple national firewalls—benefits that would not be possible without a working deployment.
The authors say that they will make their build “available to trusted network security researchers upon request.”
The Abstract mentions the bottom line almost in passing, that the point of better understanding the censorship tech is to assist the “circumvention developers.” A circumvention developer would be someone who is helping to come up with new and more robust tools to defeat online censorship. All hail the circumvention developers.
