About

On September 11, 2025, roughly 600GB of internal documents, source code, and communications leaked from Geedge Networks (chief scientist Fang Binxing) and the MESA Lab at the Institute of Information Engineering, Chinese Academy of Sciences — core R&D contractors behind China's Great Firewall who also export their flagship product, the Tiangou Secure Gateway (TSG), to Myanmar, Pakistan, Ethiopia, and Kazakhstan.

That leak is already extensively covered by gfw.report, geedge.report, a USENIX Security '26 paper, and investigative reporting from InterSecLab, Amnesty International, and Justice for Myanmar. This project doesn't re-host or duplicate that work — it's a defense-oriented extraction layer on top of the leak's primary source material, in the same structured, LLM-queryable spirit as corpus.lantern.io. Every finding here is one specific, cited claim, tagged against a shared taxonomy, answering one question: what does this mean for someone building a circumvention tool?

What's never here

Raw leak content is never rehosted. Findings cite artifacts — provenance pointers (archive, path, hash) — never full documents or source files. The canonical source for the raw leak remains Enlace Hacktivista.

Visibility and PII policy

Every finding defaults to visibility: internal. Promotion to public is a human decision — schema validation refuses to let a finding go public if it names an identifiable individual (mentions_individuals: true) until a person explicitly sets pii_reviewed: true. The review bar: does naming this person add anything beyond corroborating a technical or export-sales claim? If the finding's value survives without the name, the name comes out.

Confidence

Confidence is more load-bearing here than for a peer-reviewed paper: a single internal support ticket or a git commit subject line is not a verified fact. high requires an unambiguous, explicit source; medium is a reasonable inference; low is suggestive only and needs independent corroboration before it's treated as settled.

Pipeline

Text extraction (decompression, plain-text pulls via pandoc/pdftotext, git commit-log/tree inventory via git log/git ls-tree) is pure I/O with zero LLM involvement, run on an isolated processing machine — nothing is ever checked out to a working tree or executed. Finding extraction runs as Sonnet-tier agents reading batches of extracted text, treating the source material as untrusted data rather than instructions. Every record is schema- and taxonomy-validated before it lands in the corpus.