On September 11, over 500GB of internal documents—including source code, work logs, operational runbooks, and build systems—from Geedge Networks, a company linked to China’s Great Firewall, were leaked online. The breach exposed the internal architecture of ‘Tiangou’, a commercial deep packet inspection (DPI) platform used for mass censorship and surveillance, including VPN detection, SSL fingerprinting, and full-session logging. Deployment records revealed the system was operational in 26 data centers in Myanmar, monitoring 81 million TCP connections, and had been exported to Pakistan, Ethiopia, and Kazakhstan for state-level surveillance. The leak also contained dev notes and build logs, potentially exposing protocol vulnerabilities exploitable by circumvention tools. Researchers warn the archive may contain operational missteps or weaknesses in China’s censorship infrastructure, though full analysis remains incomplete. The data was mirrored by groups like Enlace Hacktivista, with experts advising extreme caution (e.g., air-gapped VMs) due to potential risks in handling the files.