The 'E21' site code in Geedge's internal Jira maps to an Ethiopia deployment sold/serviced through CEIEC (中国电子进出口, a Chinese state-owned defense electronics company) as an intermediary — Geedge explicitly white-labels delivery documentation with an OEM template before it reaches CEIEC, and CEIEC's Ethiopia office director is named as directly relaying the customer's blocking requirements.
该版本文档中包含公司信息，如果提交CEIEC请告知，更换OEM模板重新导出 [this version's docs contain company info — if submitting to CEIEC, flag it so we swap the OEM template and re-export]
Defense implications
- Ethiopia's TSG deployment is procured/serviced through a state-owned intermediary (CEIEC), not direct Geedge-to-government sale — relevant context for any future export-control or accountability advocacy.
Related findings
Ethiopia (E21) customer specifically tested Melon VPN and Ultrasurf against TSG; Ultrasurf's frequently-rotating IPs required an updated signature (successfully blocked after update), while Melon VPN's connection succeeded but was non-functional for other reasons (not attributed to TSG blocking).
Confirms the full licensed TSG component roster deployed at Ethiopia (E21): Firewall, Digital Observer, Email Retention, Statistics Policy, Proxy, Session Record, GTP Security, AppSketch, AppSketch Engine, AppSketch DB, WebSketch, WebSketch DB. Several license terms were extended to expire 2091-12-31, indicating a multi-decade commercial commitment.
A field-operations runbook, "子卡槽位更换操作流程" (card-slot swap procedure), documents live maintenance work at the "Shashamane-IGW" site — one of the Ethiopian international-gateway sites named in the E21 site-codename mapping — upgrading an 8x10G link to 1x100G on device "9000-SMBIO-P01R01-1", including commands to force optical channels to bypass mode, physically relocate an optical port card, and switch the link back from bypass to inline mode, confirming the deployment operates in a passive/bypass-capable inline architecture.
Side-by-side internal performance comparison across Xinjiang (China Mobile carrier deployment, hostname cmcc-xj-server1-sapp-244), Fujian (domestic), and Ethiopia (E21) explicitly references the same 'app_sketch_maat' diagnostic log format at all three sites, confirming the identical AppSketch app-fingerprinting stack is used for domestic Xinjiang surveillance and for the exported Ethiopia deployment.
Direct dated evidence (July 2023) that the Ethiopia (E21) customer actively toggles application-level blocking as a live policy lever: lifting the block on YouTube plus four other apps caused a documented traffic surge and device alerts at the BOL-IGW site.
TSG's blocking of YouTube/Facebook/Twitter/Tencent at Ethiopia's IGW nodes fails for a large fraction of sessions because those sessions structurally never traverse the inspection point — quantified per-site traffic-completeness rates ranged from 0% to 40% (vs. ~100% completeness at the upstream PE node), with roughly half of sampled YouTube/Facebook sessions missing entirely from IGW-side logs. Root cause was traffic-splitting/mirroring architecture, not a detection failure of the DPI engine itself.