Who builds the censorship: fingerprinting the DPI gear behind the blocks

Internet censorship runs on boxes — deep-packet-inspection (DPI) appliances on the wire — and those boxes have makers with fingerprints. Voidly maintains a 14-signature DPI library (a decade of Citizen Lab + academic research) and matches it against its corpus: 16.8% of evidence rows (~30,000) carry a recognizable DPI signature. The picture has two halves. HALF IS HOME-GROWN: the most-matched signatures are STATE-BUILT DPI — Russia TSPU (9,206 matches), China's Great Firewall (8,026), Iran ARIA (4,099), Myanmar junta (2,450), Turkey BTK (2,302), Pakistan PTA (2,068), Belarus Beltelecom (1,241). These regimes build and tune their own (Iran/China rotate keyword+SNI lists daily); fingerprints trace to peer-reviewed work (Xue IMC 2022 on TSPU, Ensafi/Wang on the GFW, Aryan FOCI 2013 on Iran). THE OTHER HALF SHIPS FROM THE WEST: the library catalogs 7 COMMERCIAL DPI appliances documented by Citizen Lab in authoritarian markets — Fortinet (FortiGate), Cisco (Ironport), Palo Alto Networks, McAfee (Smartfilter), Blue Coat/Symantec ProxySG, Netsweeper, Sangfor — placed across the Gulf, South/SE Asia, and beyond (Blue Coat in Syria, Netsweeper across the Gulf, FortiGate in a dozen countries). In Voidly's OWN measurements two surface at scale: FortiGate (519 matches, the most-detected commercial appliance) and Blue Coat (30); the rest are catalogued from public research but rarely match current evidence — honest state of the art: the commercial chain is well-documented historically, day-to-day blocking data is dominated by state systems. HONEST CAVEATS: heuristic matching not ML (false positives possible); public fingerprints lag vendor updates (FortiGate redesigned its blockpage in 2023); state configs rotate; and crucially a match does NOT prove that vendor performed the block — leads for investigation, not courtroom attribution. Censorship has a supply chain, a chunk of it publicly-traded companies under export controls — naming the gear (carefully) is how accountability starts. Live: /v1/atlas/dpi-fingerprints.