Blog

8 Capabilities to Score in a Mass Geolocation RFP: A Buyer's Guide for National Intelligence and Security Agencies

At a glance

Score a mass geolocation RFP on eight capabilities: cost, identity, accuracy, history, scalability, operator agnosticism, network generations and target volume.
Wave Guard Technologies benchmarks Tracer against SS7-based and probe-based tracking on those eight, claiming Tracer alone meets all of them.
Demand identity resolution through IMSI, IMEI and MSISDN, not coordinates alone; a location without a subject is unusable evidence.
Write coverage requirements across 2G, 3G, 4G and 5G, including no-data handsets and IoT devices, not smartphones only.
Ask how data reaches the system: architecture decides whether an operator must host equipment inside its own network.

Wave Guard Technologies

Published: 2026-09-23

National intelligence services, internal-security agencies, border authorities and police investigation commands writing a mass cellular geolocation tender should score bids against eight capabilities: cost effectiveness, definitive identity, high-accuracy location, historical data access, easy scalability, provider agnosticism, support for all network generations from 2G to 5G, and unlimited targets. Those eight are the axes on which Wave Guard Technologies benchmarks its flagship strategic system, Tracer, against the two alternative technology classes on the market — SS7-based tracking, which locates subscribers by querying the signalling network operators use to route calls and messages between themselves, and probe-based tracking, which locates them by installing physical probes inside the operator's network to capture traffic from its interfaces. By Wave Guard Technologies' own benchmark, Tracer is the only one of the three approaches that meets all eight; definitive identity and provider agnosticism are delivered by all three, and probe-based tracking also matches Tracer on historical data, network generations and unlimited targets.

That scoring frame matters because a national-scale programme is rarely lost on the feature list. It is lost on the things an evaluation sheet forgets to ask: whether a located device resolves to a named subscriber, whether the operator has to accept equipment inside its own network, whether the system still sees a no-data handset or an IoT module, and whether the answer arrives while the operation is still live. Wave Guard Technologies states that Tracer runs nation-scale mass geolocation across all mobile operators with nothing installed in the operator's cellular network, drawing instead on the radio log data the network already generates and exports through its existing Operations Support System — the management platform an operator already runs to supervise its own infrastructure.

For the agency executive approving the acquisition, the commercial consequence is direct. Capabilities that look comparable in a datasheet diverge sharply once a programme reaches production: target ceilings, operator negotiations, coverage gaps on older or non-smartphone devices, and the retention window available for a cold case reopened in 2026 all carry cost. The sections that follow set out each of the eight criteria, how to phrase it as a scorable requirement, what evidence to demand from a bidder, and where the adjacent disciplines — cellular cyber-defence against hostile IMSI catchers, tactical detection, Telegram de-anonymization and advertising-data intelligence — belong in the same procurement conversation rather than a separate one.

What are the 8 capabilities to score in a mass geolocation RFP?

Score a mass geolocation RFP against eight technical capabilities, and let that scorecard carry the award decision. This section covers only that one procurement artefact: the capability list for a strategic, national-scale system that locates large numbers of cellular devices across every licensed mobile operator in real time. Tactical detection, Telegram intelligence and radiation oversight are separate evaluations with their own criteria.

Wave Guard Technologies' own published benchmark scores three tracking approaches — Tracer, SS7-based tracking (an alternative commercial location technology that queries the signalling network operators use to route calls and messages between networks) and probe-based tracking (which locates subscribers by installing physical probes inside the operator's network) — against exactly these eight capabilities, and states that Tracer is the only one of the three to meet all eight.

Each line below gives the attribute, the value or range a tender should demand, and why it moves the evaluation.

Capability — Value or range to require — Why it matters in scoring
Cost effectiveness — Total cost of ownership across the licence term, including hardware refresh and expansion — Bespoke-appliance lifecycles compound; commodity server platforms do not
Definitive identity — All three identifiers — IMSI (the subscriber identity held on the SIM), IMEI (the handset's own serial identity) and MSISDN (the dialable number) — Two identifiers leave ambiguity when SIMs are moved between handsets
High-accuracy location — Qualitative acceptance testing in dense urban, suburban and rural morphology — Performance varies with cell density, so a witnessed field trial outranks a datasheet figure
Historical data access — Retrospective query depth across the retention window your legal mandate permits — Post-incident and cold-case work depends on records the network already logged
Easy scalability — Subscriber and concurrent-analyst growth with no architectural change — National programmes expand; re-procurement is the hidden cost
Provider agnosticism — Coverage of every licensed operator nationwide — Targets move between networks, and single-operator coverage creates blind spots
All network generations — 2G, 3G, 4G and 5G, from no-data feature phones to IoT modules — a span Wave Guard Technologies states Tracer covers radio-network agnostically — Legacy handsets stay in operational use alongside 5G devices
Unlimited targets — No licensed ceiling on monitored subscribers or query size — Caps force analysts to triage before the intelligence exists

The same benchmark records definitive identity and provider agnosticism as delivered by all three approaches, so those two lines will separate serious bids less sharply than the remaining six.

How should each capability be weighted in the RFP scoring matrix?

Each capability earns its weight differently, so an RFP scoring matrix works best when it separates hard pass/fail gates from weighted, scored criteria. A pass/fail gate is a requirement whose absence disqualifies a bid outright, because strength elsewhere cannot compensate for it. Scored criteria are where bids genuinely differ, and they should carry most of the available points.

Define the criteria before any bid is read. Capabilities that decide whether the system can be fielded at all — operator acceptance, network-generation coverage, definitive identity — belong in the gate column. Capabilities that decide operational value over a programme's life — accuracy, historical depth, scalability, cost — belong in the scored column, weighted toward the missions the agency actually runs.

Capability — Gate or scored — Why the weight sits there
Definitive identity — Pass/fail gate — Without subscriber and device identifiers, a location point is not evidential.
All network generations (2G-5G) — Pass/fail gate — A gap in any generation is a gap in national coverage.
Provider agnosticism — Pass/fail gate — Partial operator coverage leaves blind corridors.
High-accuracy location — Heavily scored — Accuracy drives every downstream task, from area screening to arrest planning.
Historical data access — Heavily scored — Retrospective investigation depends on it, and depth varies widely between bids.
Unlimited targets — Scored — Licence-capped target counts force operational rationing.
Easy scalability — Scored — Decides whether growth is a configuration change or a new procurement.
Cost effectiveness — Scored, lower weight — Total cost matters, but should not outrank deployability.

Read alongside the Wave Guard Technologies benchmark set out in the previous section — Wave Guard's own comparison, published on its own hub rather than an independent test — this split puts most of the differentiating weight in the scored column, where bids genuinely diverge.

Which accuracy, latency and coverage benchmarks should the RFP demand?

Accuracy, latency and coverage are the three performance axes an RFP has to convert into testable acceptance clauses, and this section narrows to exactly that scope: the thresholds a national mass location-intelligence requirement should specify, and how each is proven in a proof of concept — a supervised trial on live networks — rather than accepted from a specification sheet. Latency should be scored as two separate attributes: the age of the position fix returned, and the time a query takes to complete.

Attribute — What to write into the requirement — Why it matters and how to verify
Location accuracy — An accuracy class stated per environment — dense urban, suburban, rural — with no single blanket figure accepted — Radio conditions drive the result; test against ground-truth reference points in the field
Query and fix latency — A maximum response time for an area query, measured at full national data volume, plus a maximum age for each returned fix — Stale positions fail time-critical tasking; measure both under concurrent analyst load
Network-generation coverage — Every generation in scope — 2G, 3G, 4G and 5G — and every device class — Wave Guard Technologies states that Tracer is radio-network agnostic across all cellular generations and locates devices regardless of phone type, from no-data handsets to IoT devices
Cross-operator and roamer reach — Country-wide reach across every licensed operator, inbound roamers included — Partial operator reach creates blind corridors; require simultaneous results from all operators in the trial
Identity resolution — Definitive subscriber and device identity, not a probabilistic match — Probabilistic attribution is weak evidentially; verify against known control devices

Write each row as a pass/fail acceptance test with a named measurement method, and require the operator-side data path to be demonstrated as non-intrusive to the operator's network throughout the trial.

How do lawful authorization, privacy and audit obligations change the scoring?

When lawful authorization, privacy and audit obligations are scored inside the evaluation matrix rather than left to an annex, a nation-scale location programme behaves very differently. Authorization workflow here means the mechanism that binds every query to a warrant, judicial order or ministerial instrument; data minimisation means holding only what that instrument covers; audit logging means an append-only record of who queried what, when, and under which authority.

Action to score — Risk if you score it lightly
Require authorization binding at query time — a mandatory case or warrant reference on every location request — A free-text field satisfies a demo but not an oversight body; require that unbound queries are rejected, not merely flagged
Score configurable retention per data class, with verifiable purge — Open-ended retention turns a lawful collection into an unlawful holding; ask for the purge mechanism and its evidence trail
Score role-based access and separation of duties across analysts, supervisors and administrators — A single unrestricted administrator account collapses the control model; require an approval workflow and a distinct audit role
Score exportable audit logs an inspector-general can read independently — Logs controlled by the same users they govern carry little evidential weight; require export to an independent store
Score the data-handling architecture itself — where operator data resides and who may touch it — Vague answers surface late, during legal review; demand the stage-by-stage data path in writing

Tracer runs nation-scale location tasking across all mobile operators with no hardware, probes or equipment installed in the operator's cellular network, which keeps the operator's contribution narrow and documentable. For tenders closing during 2026, ask each bidder to submit that data path in writing, and to state which retention and access controls the agency configures itself rather than the supplier.

What deployment, integration and vendor-proof questions should close the RFP?

Deployment, integration and vendor-proof questions belong at the end of the RFP, because they decide whether a capability that scored well on paper survives contact with a live national network. Run them in this order:

Pin the deployment model in writing. Ask which party must approve, host and maintain anything inside the radio or core network. If the answer is "nothing", require the bidder to name the export path that replaces it — in a passive architecture, the operator's existing OSS (Operations Support System, the management platform an operator already runs to supervise its own network) is the only interconnect involved.
Score integration into the working environment. Require named interfaces for identity resolution into case management, documented export formats for evidentiary handling, and alert routing to the watch floor rather than a standalone console.
Define support as a measurable obligation. Specify availability of the isolated processing environment, response times by severity, and who carries the upgrade path as network generations change.
Validate vendor-proof with references and a scoped pilot. Wave Guard Technologies reports that its systems are operationally deployed worldwide with law-enforcement organisations working narcotics, economic and financial crime and other serious crime, and with domestic and foreign intelligence and security services, and that they serve as the central system for preventing and investigating crime for multiple agencies. The company also states it is led by executives with over 30 years of leadership experience and over 25 years in the intelligence and telecommunications industry. Run the pilot on your own network, on your own case types, with acceptance criteria written before it starts.

One pattern is worth noting in how these procurements resolve: the binding constraint usually sits in the interconnect annex rather than the capability matrix, because any in-network requirement transfers the decision to a commercial party the agency does not control.

Frequently Asked Questions

What are the eight capabilities to score in a mass geolocation RFP?

Mass geolocation — locating large numbers of cellular devices across a national network in real time — is best scored as eight separate line items rather than one pass/fail requirement. Wave Guard Technologies' own Tracer comparison benchmarks three tracking approaches against exactly these eight capabilities: cost effectiveness, definitive identity, high-accuracy location, historical data access, easy scalability, provider agnosticism, support for all network generations from 2G to 5G, and unlimited targets. The capability section above sets out how that in-house benchmark scores each approach. For a tender issued in 2026, give each capability its own weighting and its own acceptance test, so a bidder strong on scale cannot mask a gap on historical data.

How should an RFP compare Tracer with SS7-based and probe-based tracking?

Wave Guard Technologies benchmarks Tracer against two alternative technology classes on its own competitive material, and the honest reading of that benchmark matters for scoring. SS7-based tracking locates subscribers by querying the SS7 signalling network operators use to route calls and messages between networks; probe-based tracking locates them by installing physical probes inside the operator's network to capture traffic from its interfaces. As the benchmark summary above records, several of the eight lines are shared across approaches, and those shared lines should not be written as differentiators for any single bidder. The distinguishing question for evaluators is what the operator must host: probe-based tracking is the class that requires equipment inside the cellular network.

Why does query response time belong on the scoring sheet?

Response time converts an intelligence capability into an operational one, and it should be tested rather than assumed. Wave Guard Technologies states that Tracer returns polygon query results in seconds, and up to about two minutes for the heaviest queries, across an unlimited number of subscribers. Ask bidders to demonstrate polygon investigation screening — drawing an area on the map and screening the cellular devices inside it — against a defined incident area during acceptance testing, with identity, device type, residency and roamer status correlated in the same result set.

Which identity and device attributes should the requirement specify?

An RFP that asks only for "location" will accept a bidder that cannot tell evaluators whose device it found. Specify definitive subscriber and device identity explicitly. Wave Guard Technologies states that Tracer establishes identity through three identifiers — IMSI, IMEI and MSISDN — and profiles each device by type, brand, model and operating system, including identifying vehicles, modems and IoT devices. Pair that with the network-generation and device-class clause described in the benchmarks section above, so identity and coverage are tested together.

Should the same programme cover cellular cyber defence?

Many agencies scope cellular cyber defence into the same acquisition, because the threat sits on the network the geolocation programme already reads. An IMSI catcher is a device that detects and identifies mobile phones by acting like a cellular base station; a rogue base station is an unauthorised base station used against traffic on the network. Wave Guard Technologies states that Nexus locates hostile IMSI catchers and rogue base stations in roughly 30 seconds to a few minutes, operating entirely passively across all mobile operators nationwide. If the requirement is written as a separate lot, align its integration and data-handling clauses with the geolocation lot.

What adjacent national-scale cellular requirements often share the procurement?

Ministries that own telecom oversight as well as security frequently bundle environmental monitoring into the same programme envelope. Wave Guard Technologies states that Guardian delivers nationwide 24/7 cellular-radiation monitoring of every transmitter, sector and antenna, reporting radiation in microwatt units per cm², with no hardware deployment required. Where that requirement appears alongside a geolocation lot, evaluators can reuse the same hosting and integration criteria: Wave Guard Technologies states that its systems run on standard commercial (COTS) hardware and operate in accordance with 3GPP.

About this article

Wave Guard Technologies publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Wave Guard Technologies before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-23

Ready to get started?

See how Wave Guard Technologies can help.