PART I: COURTS, SECURITY FORCES, EXECUTIONS, WOMEN, ETHNIC MINORITIES AND DOMESTIC REPRESSION

Political repression, state security and human-rights conditions in China

The Political and Judicial Architecture of Control

China's human-rights environment in 2025 and 2026 remained defined by centralized Chinese Communist Party control over the judiciary, police, national-security institutions, information systems and civil society. Human Rights Watch reported in its 2026 World Report that Chinese authorities continued to systematically restrict freedom of expression, association, assembly and religion, while persecuting government critics and intensifying ideological conformity. Repression remained particularly severe in Xinjiang, Tibet and Hong Kong.Human Rights Watch The structure is not limited to policing. It operates through multiple institutions simultaneously: the courts, Ministry of Public Security, Ministry of State Security, local public-security bureaus, cyberspace regulators, prison authorities, Party disciplinary bodies and regional security agencies. This creates an enforcement chain in which surveillance, detention, prosecution, censorship and imprisonment frequently reinforce one another.

The Death Penalty and the Problem of State Secrecy

China remains the world's leading executioner, but the actual number of executions is classified as a state secret. Amnesty International reported that China continued to execute thousands of people in 2025, but it could not publish a verified minimum because the government conceals execution data. For that reason, Amnesty excluded Chinese executions from its global numerical total of 2,707 executions recorded elsewhere in 2025.Amnesty International China also continued to impose the death penalty for drug-related offences and other crimes that do not meet the threshold of the "most serious crimes" under international human-rights law.Amnesty International

How Many People Were Under Sentence of Death in 2026?

There is no credible public nationwide figure. China's execution statistics, death sentences and many court records remain secret or only selectively published. Therefore, any exact 2026 death-row figure would be speculative. The strongest defensible conclusion is this: China continued to sentence and execute large numbers of people in 2025 and 2026, probably in the thousands, but the government prevents independent verification of the national total. That lack of transparency is itself a central feature of the death-penalty system.

Political Dissent and Public Protest

China did not experience a single nationwide uprising in 2025 comparable to large national protest waves elsewhere, but localized dissent, labor actions, rights protests, online criticism and symbolic acts of opposition continued. Human Rights Watch documented a particularly striking incident in August 2025, when an activist remotely projected a pro-democracy message onto a high-rise building in Chongqing before a major Beijing military event.Human Rights Watch The importance of such acts lies in the degree of risk involved. China's censorship and surveillance environment has made even relatively small demonstrations or symbolic acts highly consequential because digital identification, camera surveillance, device registration and online-content controls can allow authorities to reconstruct participants' identities and networks.

Xinjiang and the Uyghur Population

Uyghur repression and human-rights conditions in Xinjiang

The most severe allegations of crimes against humanity remain concentrated in Xinjiang. Human Rights Watch reported that several hundred thousand Uyghurs remained unjustly imprisoned in 2025, while earlier UN findings concluded that abuses in Xinjiang may constitute crimes against humanity.Human Rights Watch Documented abuses include mass detention, forced assimilation, restrictions on religion, cultural repression, family separation, surveillance and forced-labor programs. Human Rights Watch also reported in 2025 that state-sponsored labor-transfer programs continued to expose global industries to the risk of Uyghur forced labor, including electronics, vehicles, footwear, sportswear and critical minerals.Human Rights Watch The economic relevance is international. Supply chains involving Xinjiang can connect human-rights abuses in western China directly to manufacturers, importers and retailers operating in Europe and North America.

Tibet

Repression in Tibetan areas remained severe. Human Rights Watch documented continued restrictions on Tibetan-language education, religion, cultural expression and contact with Tibetans outside China. Authorities continued closing or pressuring schools that promote Tibetan language and culture and detained Tibetans for online communication or political expression.Human Rights Watch Xi Jinping's August 2025 visit to Tibet included renewed calls for Tibetan Buddhism to "adapt to socialist society," reflecting continued Party intervention in religious institutions.Human Rights Watch The state's policy toward Tibetan identity therefore combines education policy, religious regulation, policing, digital monitoring and ideological assimilation.

Hong Kong

Religious persecution and restrictions on belief in China

Hong Kong remained subject to an increasingly restrictive national-security system. According to official figures cited by Human Rights Watch, at least 365 people had been arrested and 174 convicted under national-security legislation since 2020, with nearly all people charged ultimately convicted.Human Rights Watch The 2020 National Security Law and the 2024 Safeguarding National Security Ordinance continued to criminalize peaceful political expression, while Hong Kong authorities expanded surveillance, arrest powers and secrecy surrounding national-security operations. In 2025, authorities also expanded transnational pressure by issuing arrest warrants and bounties against activists living abroad.Human Rights Watch

Women's Rights and Gender Control

Gender discrimination remained widespread in employment. Human Rights Watch reported that in 2025 Chinese authorities intensified ideological pressure around marriage, childbirth and traditional gender roles, while online regulators targeted content described as promoting "extreme feminism," "gender antagonism" or refusal of marriage and childbirth.Human Rights Watch This demonstrates a broader pattern. The Chinese state does not only suppress explicit anti-government political organizing. It also regulates social narratives that authorities consider inconsistent with demographic or ideological goals. Women's-rights advocacy therefore exists in a constrained environment where criticism of domestic violence, reproductive policy or gender discrimination may be tolerated only until it becomes politically organized or critical of Party institutions.

PART II: THE GREAT FIREWALL, DPI, QUIC, VPN SUPPRESSION AND THE PHYSICAL ARCHITECTURE OF DIGITAL CONTROL

China Great Firewall, internet censorship and digital-control infrastructure

The Great Firewall Is More Than Website Blocking

Great Firewall censorship and network-control systems in China

China operates one of the most sophisticated national censorship systems in the world. The Great Firewall combines multiple methods: DNS poisoning, IP blocking, TLS and SNI inspection, keyword filtering, active probing, forged TCP reset packets, packet dropping, protocol classification and large-scale traffic analysis.GFW Report This architecture allows China to interfere with communications without necessarily decrypting every application-layer message. The state can often identify or block a communication by examining metadata, protocol behavior or connection establishment.

DNS Poisoning and IP Blocking

For DNS requests to prohibited domains, the Great Firewall has long been documented injecting false responses. This can cause a user to receive an incorrect IP address or failed resolution before any application connection is established. China also blocks selected destination IP ranges directly. These are among the simpler layers of the system, but they operate alongside much more sophisticated inspection.

TLS, SNI and Forged TCP Resets

For HTTP and HTTPS traffic, researchers have documented stateful inspection of TCP connections. When prohibited domains appear in HTTP Host headers or TLS Server Name Indication fields, censorship infrastructure may inject forged TCP reset packets or drop traffic.GFW Report This matters because TLS encrypts the content of the connection but historically did not always conceal the destination hostname. Thus, a censor may not need to decrypt the full session. Identifying the domain can be sufficient.

China's New QUIC Censorship System

One of the most technically significant developments documented in 2025 concerned QUIC. A 2025 USENIX Security study by researchers from the University of Massachusetts Amherst, Stanford, the University of Colorado Boulder and GFW Report found that the Great Firewall was decrypting QUIC Initial packets at national scale and inspecting the SNI field.GFW Report This is technically important because QUIC carries much of modern HTTP/3 traffic over UDP. The researchers found that China: inspects QUIC Initial packets, recovers the TLS Client Hello, reads the SNI, compares it to a dedicated blocklist and then blocks subsequent traffic.GFW Report The research found that a single forbidden SNI could trigger approximately 180 seconds of residual blocking for the affected flow.GFW Report Researchers identified 58,207 unique fully qualified domain names blocked over QUIC during their measurement period, and the QUIC blocklist was distinct from China's DNS, HTTP and HTTPS censorship lists.GFW Report This is not primitive filtering. It is protocol-aware, large-scale network inspection.

Active Probing and VPN Detection

The Great Firewall has also historically used active probing. When network systems detect traffic that appears to belong to a proxy or circumvention service, censorship infrastructure can initiate its own connection to the suspected server to determine whether the destination is a proxy. This capability allows censorship to move from passive observation into active verification. VPN systems therefore face several forms of pressure: endpoint blocking, protocol fingerprinting, active probing, SNI filtering, IP reputation blocking and traffic-pattern analysis.

Encrypted Client Hello and Circumvention

Encrypted Client Hello, or ECH, was designed in part to hide SNI information. The 2025 QUIC research found that, as of January 2025, China's firewall did not automatically block every QUIC connection containing ECH; instead, blocking still depended on visible outer SNI behavior.GFW Report Researchers also found that fragmenting the QUIC Client Hello could sometimes bypass censorship because the firewall did not fully reassemble certain fragmented initial messages. These findings led to technical circumvention updates in Firefox, quic-go, sing-box, V2Ray, Xray and Hysteria during 2025.GFW Report

Where Is the Great Firewall Physically Located?

Digital authoritarianism and surveillance infrastructure in China

Open-source technical research can identify major network locations associated with censorship. The 2025 QUIC study used measurement points in Beijing, Guangzhou and Shanghai, major Chinese internet exchange regions, and found that QUIC censorship devices appeared co-located with existing Great Firewall infrastructure.GFW Report However, public evidence does not provide a complete rack-by-rack inventory of DPI appliances, serial numbers or military-operated interception rooms. The distinction matters. Researchers can identify censorship behavior and network position without necessarily identifying the manufacturer or physical serial number of each appliance.

China Can Produce Its Own DPI Systems

One assumption frequently made about authoritarian censorship is that such governments must import all advanced filtering equipment. For China, that assumption is incorrect. China has both domestic technological capacity and domestic companies capable of building advanced national-scale censorship and surveillance systems. The strongest recent example is Geedge Networks. InterSecLab's 2025 investigation, based on more than 100,000 leaked company documents, found that Geedge Networks had developed and exported systems resembling China's Great Firewall to governments including Pakistan, Myanmar, Ethiopia and Kazakhstan.InterSecLab Its systems reportedly include: Deep Packet Inspection, real-time mobile-subscriber monitoring, granular traffic control, internet shutdown capability and region-specific censorship policies.InterSecLab This is direct evidence that China is not merely a consumer of surveillance technology. It is also a producer and exporter.

PART III: WESTERN AND ASIAN SUPPLY CHAINS, HARDWARE FORENSICS, E-COMMERCE EXPOSURE, ILLICIT FINANCE AND THE CHINA-RUSSIA-IRAN SECURITY RELATIONSHIP

China sanctions-evasion exposure, supply chains and international financial networks

Foreign Components Inside Chinese-Built Censorship Systems

Even systems developed by Chinese companies may depend on global components. An important 2026 InterSecLab investigation found that Taiwanese company ADLINK Technology supplied 1,708 CSA-7400 network appliances to Geedge Networks between 2019 and 2020. ADLINK said it sold standard hardware after compliance screening and was not informed of the eventual censorship-related end use.InterSecLab InterSecLab found that these appliances later formed part of Geedge's first-generation censorship platform in Kazakhstan. The same investigation found that later Geedge systems used components associated with: Nettrix, Inspur, Intel, Mellanox/NVIDIA and other commodity server and networking technologies.InterSecLab This demonstrates why supply-chain attribution must distinguish: component manufacturer, distributor, integrator, software provider, government buyer and final operational user. A foreign-made chip inside a censorship system does not automatically mean the original chip manufacturer knowingly participated in censorship.

Hardware Serial Numbers and Customs Forensics

The strongest evidence chain for surveillance technology includes: Manufacturer, model, serial number, MAC address, OUI, firmware version, importer, consignee, exporter, customs declaration, invoice, bill of lading, freight forwarder, transshipment location and final end user. InterSecLab's 2026 investigation illustrates how MAC identifiers and leaked hardware records can expose the relationship between commercial network appliances and censorship infrastructure.InterSecLab Such evidence is stronger than simply identifying a company logo in a photograph. Serial-level attribution can help answer: Who purchased the device?<br>Who shipped it?<br>Who integrated it?<br>Where was it installed?<br>Who knew the end use?

The Export of Chinese Censorship Technology

Chinese censorship technology, cyber repression and exported surveillance systems

Amnesty International and InterSecLab documented how Geedge Networks exported a commercialized version of Great Firewall technology into foreign national censorship systems. Amnesty's 2025 investigation found that Geedge technology was integrated into Pakistan's Web Monitoring System 2.0, while hardware and software from companies in several countries also appeared in that system.Amnesty International The investigation identified technology relationships involving Chinese, European, North American and other suppliers. This exposes an important structural problem. Digital repression can be built through multinational commercial supply chains even when the final censorship policy is imposed by one government.

China, Russia and Iran: A Strategic Security Relationship

China, Russia and Iran have significant diplomatic, economic and security relationships, but describing them as one unified command structure would go beyond the available evidence. The documented record supports a narrower conclusion. China and Russia continued joint military exercises, including naval drills in 2026.Reuters China has also maintained economic and diplomatic relations with Iran, while U.S. authorities have repeatedly scrutinized Chinese and Hong Kong entities for alleged procurement or sanctions-evasion support involving Iranian military programs. On September 29, 2026, the United States sanctioned individuals and entities in China, Hong Kong and Pakistan for allegedly assisting Iranian defense procurement.Reuters The United States has also publicly raised concerns about Chinese assistance to Iran during the 2026 conflict. China has disputed or avoided confirmation of various allegations, and different claims remain contested.Reuters The strongest conclusion is therefore that China, Russia and Iran maintain overlapping strategic, military, economic and technology relationships that create significant security concerns for Western governments, not that every action is centrally coordinated.

Economic Exposure and E-Commerce

China's censorship system imposes costs, but there is no reliable public dataset isolating exact quarterly e-commerce losses caused specifically by internet censorship in 2025 or 2026. That limitation should be stated directly. China did not undergo a prolonged nationwide internet blackout comparable to some other authoritarian states during this period. Therefore, there is no defensible national figure such as "Q2 censorship losses = X billion yuan." What can be measured is the enormous scale of economic activity exposed to digital-policy decisions. According to China's National Bureau of Statistics: 2025 online retail sales: RMB 15.9722 trillion, up 8.6 percent year on year.National Bureau of Statistics of China Q1 2025 online retail sales: RMB 3.6242 trillion.National Bureau of Statistics of China H1 2025 online retail sales: RMB 7.4295 trillion.National Bureau of Statistics of China First nine months of 2025: RMB 11.2830 trillion.National Bureau of Statistics of China For 2026: Q1 2026 online retail sales: RMB 4.9774 trillion, up 8.0 percent year on year.National Bureau of Statistics of China H1 2026 online retail sales: RMB 10.0715 trillion, up 5.2 percent.National Bureau of Statistics of China January to August 2026: RMB 13.4766 trillion, up 4.6 percent.National Bureau of Statistics of China These figures demonstrate the scale of economic activity dependent on digital infrastructure. They do not quantify censorship losses.

The Economic Cost of Fragmentation

The economic cost of digital control appears through several mechanisms: compliance costs, blocked foreign services, reduced cross-border communication, restrictions on cloud platforms, foreign-investor uncertainty, duplicated infrastructure, data-localization requirements and reduced access to information. These effects are difficult to isolate from other economic conditions. Therefore, any exact censorship-loss estimate should disclose a transparent methodology rather than present a speculative figure as fact.

Chinese Money-Laundering Networks and Narcotics Proceeds

Claims that narcotics directly finance the Chinese government require caution. There is no evidence that drug trafficking constitutes a major revenue source for the Chinese state. There is, however, extensive U.S. law-enforcement documentation concerning Chinese money-laundering networks involved in laundering proceeds for Mexican drug cartels. FinCEN warned in August 2025 that Chinese money-laundering networks pose a major threat to the U.S. financial system and have facilitated money laundering for Mexico-based drug cartels.U.S. Department of the Treasury In May 2026, U.S. prosecutors charged two Chinese nationals with participating in a network allegedly laundering cartel proceeds using mirror transfers, foreign bank accounts, encrypted applications, serial-number verification and trade-based money laundering.Department of Justice Another 2026 federal case involved alleged laundering of tens of millions of dollars in proceeds from fentanyl, cocaine and methamphetamine.Department of Justice These are criminal networks involving Chinese nationals, not evidence that the PRC government itself is funded through narcotics.

Fentanyl Precursors and Cryptocurrency

U.S. prosecutors have also successfully prosecuted Chinese chemical-company executives for shipping fentanyl precursors and accepting cryptocurrency payments. In February 2025, two Chinese chemical-company executives were convicted in the United States in connection with fentanyl-precursor importation and money laundering, including cryptocurrency payments.Department of Justice In a separate 2026 case, a Chinese national pleaded guilty to narcotics trafficking, money laundering and material support charges after prosecutors said his network laundered more than $22 million using methods including cryptocurrency and trade-based money laundering.Department of Justice

Crypto-Forensics

There is no reliable public list of cryptocurrency wallets belonging broadly to Chinese intelligence agencies. Accordingly, such addresses should not be invented. A credible investigation should begin with: court filings, OFAC designations, seized wallets, exchange records, sanctions notices, transaction hashes and law-enforcement attribution. Then investigators can map: first-hop counterparties, exchange deposits, bridge transactions, stablecoin flows, OTC desks, repeated clusters and cross-chain movement. Blockchain proximity alone does not prove intelligence control.

PART IV: TRANSNATIONAL REPRESSION, CYBER OPERATIONS, CRITICAL INFRASTRUCTURE AND RISKS TO EUROPE AND THE UNITED STATES

China transnational repression, foreign intelligence and international security risks

China's Security Reach Extends Beyond Its Borders

The most consequential external risk from the Chinese state is not ordinary migration, tourism or student travel. It is the documented use of intelligence officers, agents, cyber operators, transnational repression mechanisms and covert influence activities. The distinction is essential. Millions of Chinese students, tourists, immigrants, refugees and businesspeople have no connection to the Chinese government. Security assessments must focus on state direction, operational tasking, financing, undeclared relationships and documented conduct, not nationality.

Transnational Repression

The FBI maintains a dedicated transnational repression program and specifically warns that foreign governments, including China, may harass, intimidate or monitor people living in the United States.FBI Human Rights Watch documented Chinese transnational repression affecting Uyghurs, Tibetans, Hong Kong activists and dissidents abroad during 2025.Human Rights Watch In Hong Kong-related cases, authorities issued arrest warrants and bounties against overseas activists and increasingly targeted relatives who remained in Hong Kong.Human Rights Watch

A Documented PRC Agent Case in the United States

The danger of foreign intelligence activity should be assessed through evidence. A strong example occurred in June 2026, when U.S. citizen Thomas Weir Pauken II pleaded guilty in federal court in Virginia to acting as an agent of the People's Republic of China. According to court documents, Pauken received taskings from people he understood to be connected to the Chinese Ministry of State Security, met potential intelligence assets and received at least $100,000 for his work.Department of Justice This is materially different from general speculation about students or immigrants. It is a documented intelligence case with court evidence.

Salt Typhoon and U.S. Telecommunications

Chinese state-security and critical-infrastructure risks

The most serious recent cyber threat linked to China involves U.S. telecommunications networks. In April 2025, the FBI stated that PRC-affiliated actors publicly tracked as Salt Typhoon had compromised multiple U.S. telecommunications companies. The campaign resulted in theft of call-data records, some private communications and certain information related to court-ordered U.S. law-enforcement requests.FBI This creates an obvious counterintelligence risk. Telecommunications metadata can reveal: who communicates with whom, when they communicate, how frequently they communicate and which individuals are connected to sensitive investigations. For intelligence services, that information may be highly valuable even without access to the full content of every call.

Volt Typhoon and Critical Infrastructure

U.S. agencies have separately attributed Volt Typhoon activity to PRC state-sponsored actors. CISA, NSA and FBI assessed with high confidence that Volt Typhoon actors had compromised critical infrastructure networks in sectors including: communications, energy, transportation, water and wastewater.FBI The agencies assessed that the activity was consistent with pre-positioning for potential disruption of operational technology in a future crisis, not merely conventional intelligence collection.FBI That distinction is strategically important. Espionage seeks information. Pre-positioning creates the possibility of future disruption.

Continued PRC Cyber Operations in 2026

The Justice Department announced additional action in 2026 against infrastructure used by PRC-sponsored hackers, including malware platforms associated with targeting U.S. critical infrastructure. DOJ noted that earlier U.S. operations had removed PRC-linked PlugX malware from more than 4,000 U.S. computers and disrupted botnets used by Chinese state-sponsored actors.Department of Justice These cases provide direct evidence that Western security concerns about Chinese cyber activity are not merely theoretical.

The Threat to Europe

The same threat model applies to European states. Telecommunications operators, energy systems, transport infrastructure, universities, research laboratories and technology companies can all become intelligence targets. European governments also face transnational repression directed against Chinese diaspora activists, Uyghur organizations, Tibetans and Hong Kong democracy advocates. The most effective response is evidence-based counterintelligence, not generalized suspicion toward Chinese communities.

Humanizing Digital Control

China's internet-control system also has consequences beyond political speech. Censorship and network interference can affect access to: foreign medical information, international research, cloud applications, professional collaboration, academic databases and communications between Chinese specialists and foreign institutions. However, there is insufficient public evidence to conclude that Great Firewall censorship directly caused a specific number of hospital deaths in 2025 or 2026. Such a claim would require case-level medical documentation. The defensible conclusion is that heavy censorship can interfere with time-sensitive information exchange and professional collaboration, creating potential healthcare and public-safety risks.

Patient and Service-Provider Data

The broader concern about third-party service providers handling sensitive information is legitimate, particularly where data involves politicians, law-enforcement personnel, intelligence personnel, refugees, dissidents, military officials or government contractors. But an investigative report must distinguish risk architecture from proven compromise. The questions that matter are: Who owns the service provider, where are the servers located, which subcontractors can access data, what data are retained, what jurisdictions apply, what government-access laws exist, whether sessions are recorded and whether employees have privileged access. Those questions apply to healthcare, translation, cloud computing, call centers, customer service and remote technical-support systems.

Information Influence and Institutional Capture

Foreign influence operations may attempt to shape public debate, institutional priorities, expert selection, hiring, research relationships or media narratives. But claims that a specific U.S. or European media organization has been penetrated by Chinese intelligence require direct evidence. No credible open-source evidence reviewed for this report establishes that China's government controls or directs the editorial policy of VOA Persian. Therefore, such an allegation should not be presented as fact. The wider institutional question is still valid: Can publicly funded institutions, universities, media organizations and government contractors identify undeclared foreign influence before it alters decision-making?

Final Assessment

China's domestic repression and its international security footprint should be understood as related but distinct systems. Inside China, Party authority relies on courts, policing, surveillance, censorship, ideological controls and restrictions on minorities and dissidents. Technically, the Great Firewall has evolved into a sophisticated system capable of inspecting modern protocols including QUIC, manipulating DNS, identifying TLS destinations, probing suspected proxies and enforcing nationwide censorship policies. Commercially, China is no longer merely a consumer of censorship technology. Chinese companies such as Geedge Networks have developed and exported systems modeled on the Great Firewall, while global hardware supply chains continue to feed components into those platforms. Internationally, the strongest documented risks are different from the domestic censorship system but no less significant: transnational repression, intelligence recruitment, telecommunications espionage, critical-infrastructure access, illicit financial networks and export of surveillance technology. The strongest investigative approach therefore remains evidence-driven: Follow the court records, follow the telecom infrastructure, follow the hardware, follow the serial numbers, follow the customs data, follow the sanctioned entities, follow the cyber indicators and follow the financial flows.

Sources and Reference Material

Research, investigation, compilation and preparation by the Editorial Team.