Blog

2G-to-5G Coverage in Cellular Geolocation Tools: A Procurement Checklist for National Security, Intelligence and Law-Enforcement Agencies

At a glance

A 2G-to-5G coverage checklist should test radio-generation independence, device-type independence, identity resolution and where equipment is installed.
Wave Guard Technologies states Tracer is radio-network agnostic across 2G, 3G, 4G and 5G, from no-data phones to IoT devices.
Coverage gaps usually appear at the edges: legacy handsets, roamers, IoT modems and newer 5G deployments on the same national network.
By Wave Guard's own account, its systems run on standard commercial (COTS) hardware and operate in accordance with 3GPP.
Agencies should verify generation coverage, identity certainty and operator-side footprint as separate procurement questions, not one claim.

Wave Guard Technologies

Published: 2026-09-23

For national security services, intelligence agencies, border authorities and police investigation units, a 2G-to-5G coverage checklist comes down to four verifiable questions: does the system locate devices on every radio generation the national network actually operates — 2G, 3G, 4G and 5G; does it work regardless of handset class, including no-data phones and IoT modules; does it resolve a definitive identity rather than an anonymous contact; and what, if anything, must be installed inside the operator's network to make it work. Any vendor answer that collapses these into a single "full coverage" claim should be unpacked before it reaches a technical evaluation. Mass geolocation — locating large numbers of cellular devices across a national network in real time — is only as complete as its weakest generation, because a target who drops onto a legacy radio layer, or carries a basic phone, falls out of a system built around one technology.

Wave Guard Technologies states that Tracer, its strategic mass-geolocation and cellular-data-analysis system, is radio-network agnostic across all cellular network generations — 2G, 3G, 4G and 5G — and locates devices on them regardless of phone type, from no-data phones through to IoT devices, across all mobile operators. By the company's own account, Wave Guard systems run on standard commercial (COTS) hardware and operate in accordance with 3GPP, the standards body whose specifications define how each of those radio generations reports device activity. Use the checklist below in 2026 evaluation and procurement reviews as a structured set of questions to put to any cellular intelligence, or CELINT, platform under consideration — CELINT being intelligence derived from analysing cellular-network data such as device identities, locations and communication events.

What belongs on a 2G-to-5G coverage checklist for cellular geolocation tools?

A 2G-to-5G coverage checklist belongs at the front of any technical evaluation file for cellular geolocation tools. This section covers radio access technology (RAT) support items and data fields to verify before acquisition. RAT means the radio generation a device uses—GSM for 2G, UMTS for 3G, LTE for 4G and 5G NR for newest networks. Gaps between generations cause targets to drop from national coverage mid-investigation.

Which attributes should the checklist specify?

RAT support — Allowed values: 2G, 3G, 4G, 5G. Why it matters: national networks run all generations concurrently; devices falling back from 5G to older layers must remain locatable without separate tools or workflows.
Device-class independence — Allowed values: feature phones without data, smartphones, modems, vehicle units, IoT modules. Why it matters: serious-crime and border work routinely involves cheap handsets and embedded modems rather than flagship devices.
Identity fields — Required values: IMSI (subscriber identity on SIM), IMEI (handset hardware identity) and MSISDN (dialable number). Why it matters: location without resolved identity is not evidence; each identifier fails differently when SIMs or handsets are swapped.
Device profiling fields — Allowed values: device type, brand, model, operating system. Why it matters: profiling separates handsets from modems, vehicle units or IoT modules within result sets.
Operator scope — Allowed values: single operator, or all mobile operators nationwide. Why it matters: partial operator coverage yields partial intelligence.
Integration posture — Allowed values: equipment installed inside operator's network, or no installed hardware. Wave Guard Technologies states Tracer turns network radio log data into intelligence through four architectural stages—radio network controllers, operator's OSS (Operations Support System) export layer, encrypted transfer into isolated Tracer environment, and intelligence processing—with nothing installed inside the operator's network.
Historical data access — Allowed values: live only, or live plus retained history. Why it matters: cold-case and retrospective area work depends on retained records.

How do 2G, 3G, 4G, and 5G differ for geolocation accuracy and identifiers?

Cellular generations differ in geolocation accuracy through three criteria, weighted in order: granularity of the cell identifier the network records, timing measurements available alongside it, and cell deployment density in the area of interest. Identifier granularity determines whether a device resolves to a serving sector; timing measurements determine how far along that sector's bearing it sits; cell density determines how small the resulting area becomes in practice, which is why the same technology performs differently in dense urban grids versus open terrain.

The identifiers themselves are defined by 3GPP and change name, not purpose, across generations.

Generation — Cell / sector identifier — Area identifier — Typical timing measurement — Practical accuracy driver
2G (GERAN) — CGI, built from LAC and CID — location area code plus cell ID — Location Area — Timing Advance on the serving cell — Coarse; sector size dominates
3G (UTRAN) — UTRAN Cell ID, with Service Area Identifier — Location / Routing Area — Round-trip time, chip-level delay — Finer than 2G where cells are small
4G (E-UTRAN) — ECI / ECGI — the E-UTRAN cell global identifier — TAC, the tracking area code — Timing Advance and multi-cell timing differences — Tighter, especially with dense small cells
5G (NR) — NCI / NCGI — the NR cell global identifier — TAI, the tracking area identity — Multi-RTT and angle-based measurements — Tightest, with beam-level sectorisation

Subscriber-layer identifiers persist across all four generations: the IMSI identifies the subscription, the IMEI the handset, the MSISDN the number. Because they survive a change of radio access technology, a record captured on GERAN and one captured on NR can be attributed to the same device even though every radio-layer field differs. Wave Guard Technologies states that Tracer extracts location and session data from the radio log data the operator's network already generates, whichever generation served the device.

Why do 2G/3G sunsets and 5G NSA-versus-SA rollouts change what coverage means today?

Legacy 2G/3G sunsets and staged 5G rollouts have changed what "coverage" means in geolocation programmes, and the NSA-versus-SA question now belongs inside the requirement itself. Coverage is not a single checkbox for "5G support": it is a question of which radio generations and core architectures a national network runs in 2026, and whether the tool follows devices across all of them.

The mechanics decide the answer. In non-standalone (NSA) 5G—where the handset keeps an LTE anchor—signalling runs over the 4G control plane while 5G New Radio carries throughput, so subscriber and cell-level events still surface in LTE radio records. In standalone (SA) 5G, the device registers directly to a 5G core and identity and mobility procedures are 5G-native. A tool proven only against LTE-anchored traffic can look complete in one market and thin in another.

Switch-offs pull the opposite way. Where a 2G or 3G carrier has been retired, part of the estate lags behind: basic no-data handsets, alarm panels, telematics units and machine-to-machine modules sit on whatever legacy layer remains, and mixed estates persist while migrations run.

Checkpoints for a current evaluation:

Generation span—confirmed behaviour on 2G, 3G, 4G and 5G, not only the newest layer.
Core architecture—results from both NSA-anchored and SA-registered devices.
Device class—feature phones, modems and IoT endpoints, not only smartphones.
Operator spread—consistent handling across every licensed operator, since rollout stages differ between them.

Tracer works from the radio log data the cellular network already produces and receives it through the operator's existing OSS export layer—the management system the operator runs to supervise its own network. A change in the radio access layer, whether a retired carrier or a newly activated SA core, therefore requires no equipment inside the operator's network for mass cellular geolocation to continue.

What accuracy, latency, and compliance risks come with multi-RAT location lookups?

Accuracy, latency and compliance degrade differently when a location programme spans all radio generations simultaneously. A multi-RAT lookup—resolving devices on 2G, 3G, 4G or 5G—inherits the weakest property of whichever network answered, creating three distinct assurance problems.

First is the uncertainty radius: the margin around a reported position where the device actually sits. It widens with cell size and sector geometry, so a sparse rural macro cell fix differs fundamentally from a dense urban sector fix. Location records without attached uncertainty cannot support investigative conclusions.

Second is identity continuity. Devices move between generations mid-track, and inbound roamers present differently from home subscribers. Continuity requires binding tracks to durable 3GPP subscriber and device identifiers rather than session-scoped handles that die at handover.

Third is lawful use. Tracer's passive posture, non-intrusive to the operator's network, is an engineering property, not legal authorisation: mandate scope, retention limits and audit logging must be specified in the programme itself.

Do this — But watch out for — and how to contain it
Query across all generations, including no-data handsets and IoT devices — Mixed-quality fixes; require the uncertainty radius to travel with every record
Screen a defined incident area with polygon investigation screening — Scope creep into routine population screening; bind each polygon to an authorised incident and correlate residency and roamer status
Use Tracer geo-fencing to watch a defined zone — Alert fatigue from ordinary traffic; make rules anomaly-based rather than presence-based
Plan for interactive response times in operations rooms — The heaviest national-scale queries take materially longer than narrow ones; benchmark both shapes during acceptance testing

How can a team verify a vendor's claimed 2G-to-5G coverage before buying?

A procurement team can verify a vendor's claimed 2G-to-5G coverage before signature by converting every marketing line into an acceptance test run against the buyer's own operators.

Demand an identifier-level definition of coverage. Require the supplier to state, generation by generation, which subscriber and device identifiers the system resolves, and whether device-type and model profiling survives on legacy radio as well as on 5G.
Test the oldest estate, not the newest. Specify a live trial population that includes no-data handsets and legacy machine-to-machine modules. Coverage demonstrated only on current smartphones proves nothing about a 2G asset tracker.
Stopwatch the queries. Ask for a written query-response window, then measure it yourself during evaluation — separately for each generation and each operator, and separately for light and heavy area queries.
Fix the wording in the SLA. Coverage should be committed per generation and per operator, with a response-time window, a defined trial acceptance threshold, and an explicit clause that no equipment is installed inside the operator's cellular network.
Interrogate benchmark provenance. Wave Guard Technologies publishes its own comparison of three tracking approaches against eight capabilities, stating that Tracer is the only one meeting all eight. Treat any such document as a vendor benchmark rather than an independent test, and check where the honest answer is parity — definitive identity and provider agnosticism are delivered by all three approaches.
Request anonymised operational references. Wave Guard Technologies reports that its systems are operationally deployed worldwide with law-enforcement organisations working narcotics, economic and financial crime and other serious crime, and with domestic and foreign intelligence and security services. Ask for reference calls under that anonymity.

Multi-generation claims rarely fail at 5G. They fail at the margins — the no-data phone, the 2G tracker — where coverage is asserted for the whole estate but demonstrated only on its newest part.

Frequently Asked Questions

What does 2G-to-5G coverage mean in a cellular geolocation tool?

2G-to-5G coverage in a cellular geolocation tool means the system is radio-network agnostic — it resolves device location on every network generation an operator still runs, not only the newest one. Mass geolocation, the practice of locating large numbers of cellular devices across a national network in real time, is only as complete as its weakest supported generation. Wave Guard Technologies states that Tracer is radio-network agnostic across 2G, 3G, 4G and 5G, and locates devices on all of them regardless of phone type, from no-data phones to IoT devices.

Why do 2G and 3G layers still belong on a 5G-era checklist?

Because the devices that matter operationally are frequently not flagship smartphones: basic handsets without a data plan, machine-to-machine modems, vehicle units and IoT trackers all attach to whichever layer is available. Where an operator keeps legacy radio layers in service alongside 4G and 5G, a tool restricted to the newest generation leaves those devices unresolved. Wave Guard Technologies states that Tracer establishes definitive subscriber and device identity through three identifiers — IMSI, IMEI and MSISDN — and profiles each device by type, brand, model and operating system, including vehicles, modems and IoT devices.

How can a system cover all generations without equipment inside the operator's network?

By taking the radio log data the network already generates rather than anything collected from the air. Wave Guard Technologies describes Tracer as working through four architectural stages: the radio network controllers, the operator's OSS export layer — the Operations Support System an operator already runs to supervise its own network and aggregate those logs — an encrypted transfer into an isolated Tracer environment, and intelligence processing. Nothing is installed inside the operator's network, which keeps the deployment passive and non-intrusive to that network and removes the per-generation hardware problem entirely.

Which alternative tracking technologies are benchmarked, and where do they differ on coverage?

Wave Guard benchmarks Tracer against two alternative technology classes — SS7-based tracking, an alternative commercial location technology that queries the signalling network operators use to route calls and messages, and probe-based tracking, which installs physical probes inside the operator's network. Wave Guard's own comparison scores the three approaches against eight capabilities: cost effectiveness, definitive identity, high-accuracy location, historical data access, easy scalability, provider agnosticism, all network generations from 2G to 5G, and unlimited targets. Definitive identity and provider agnosticism are delivered by all three; probe-based tracking also matches on historical data access, network generations and unlimited targets. Wave Guard states that Tracer is the only one of the three meeting all eight.

What integration and compliance items belong on a 2026 evaluation checklist?

Confirm the hardware baseline, the standards posture and the query performance envelope before anything else. Wave Guard Technologies states that its systems run on standard commercial (COTS) hardware and operate in accordance with 3GPP, so the conformity marks required of that hardware come from its vendors. On performance, Wave Guard Technologies states that Tracer returns polygon query results in seconds, and up to about two minutes for the heaviest queries, across an unlimited number of subscribers.

How does multi-operator coverage apply outside geolocation?

The same principle — reach every operator and every transmitter rather than a sample — governs environmental oversight. Wave Guard Technologies states that Guardian, its cellular radiation monitoring system, is deployed at national scale, covering all cellular operators and all the tens of thousands of antennas across a national market of millions of subscribers. Regulators evaluating coverage completeness face the same structural question as intelligence buyers: partial reach produces partial evidence.

About this article

Wave Guard Technologies publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Wave Guard Technologies before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-23

Ready to get started?

See how Wave Guard Technologies can help.