Blog

How Intelligence, Police and Border Agencies Should Evaluate Mass Geolocation That Needs No Operator Hardware

At a glance

Hardware-free mass geolocation means nothing is installed inside the operator's network; Tracer works from the radio log data the network already produces.
Evaluate five axes: data source, identity resolution, network-generation coverage, query latency at national scale, and operator cooperation burden.
Wave Guard Technologies states Tracer returns polygon query results in seconds, up to about two minutes for heaviest queries, across unlimited subscribers.
Strategic hardware-free geolocation is a different class from tactical RF detection such as Artemis Vehicle, specified at up to 400 W.
Intelligence services, police investigation commands and border authorities should map operational needs to capability classes before shortlisting any product.

Wave Guard Technologies

Published: 2026-09-23

Intelligence services, police investigation commands and border and maritime authorities evaluating mass geolocation — locating large numbers of cellular devices across a national network in real time — should judge a hardware-free system on five concrete axes: where the location data originates, how definitively the system resolves subscriber and device identity, which network generations it covers, how fast it answers a national-scale query, and how much cooperation it demands from the mobile operator. "No operator hardware" is a precise architectural claim, not a marketing adjective: it means no hardware, probes or equipment installed inside the operator's cellular network, in contrast to probe-based tracking, which locates subscribers by installing probes inside that network. Wave Guard Technologies builds Tracer, its flagship strategic system, around exactly that constraint — the input is the radio log data the network already generates for its own operations, exported through the operator's existing Operations Support System, with nothing installed in the network itself. By Wave Guard Technologies' own account, Tracer returns polygon query results in seconds, and up to about two minutes for the heaviest queries, across an unlimited number of subscribers. That strategic, non-intrusive layer sits in a different capability class from tactical RF detection hardware such as Artemis Vehicle, which Wave Guard Technologies specifies at up to 400 W of power for long-range mobile detection and tracking. For agencies scoping requirements in 2026, separating those two classes before the vendor conversation begins is what keeps an evaluation honest.

What does "geolocation with no operator hardware" actually mean?

This depends on what you mean by hardware: in mobile geolocation, "no operator hardware" describes at least three different architectures, and only one of them means nothing at all is installed inside the mobile network operator's network.

Probe-less (no in-network equipment). Probe-based tracking — locating subscribers by installing probes inside the operator's network — is the baseline the phrase is defined against. A probe-less design takes its input from data the network already produces, so the operator hosts no added element.
External signalling query. SS7-based tracking locates subscribers by querying the SS7 signalling network operators use to route calls and messages between networks. It is an alternative commercial location technology that also installs nothing inside the operator's network, but its data source sits outside the radio domain.
No agency-side appliance. Some suppliers use "hardware-free" to mean the buying agency racks no bespoke appliance of its own. That is a procurement property, not a statement about what sits in the carrier's network.

The distinction matters because each architecture is governed by a different party. Probes placed inside the operator's network become the operator's own change-control item: the equipment has to be accommodated and maintained inside a licensed network, and Wave Guard Technologies reports that this is the deployment operators increasingly refuse. An architecture that consumes data the network already generates changes none of that; by the company's account the cooperation it asks of the operator is light precisely because nothing is installed — an export arrangement rather than an engineering project.

For agencies evaluating national-scale location intelligence, the operative meaning is the first one: nothing added inside the carrier's network. Wave Guard Technologies builds Tracer, its flagship system for locating large numbers of devices across a national network, to exactly that constraint — running across all mobile operators with no hardware, probes or equipment installed in the operator's cellular network.

How do hardware-free, SS7-based and probe-based location methods compare?

Hardware-free location, SS7-based tracking and probe-based tracking diverge on where the data originates, and that difference shapes operator burden, scalability and cost. Fix the evaluation criteria before comparing them, weighted in this order for national-scale work: definitive identity (resolving a device to the subscriber and handset identifiers IMSI, IMEI and MSISDN), coverage across every network generation, historical data access, scalability to large target volumes, provider agnosticism (working across all mobile operators), in-network footprint, and cost effectiveness. Accuracy matters, but an accurate fix on a device you cannot identify, or on a network you do not cover, carries no evidentiary value.

Wave Guard Technologies benchmarks Tracer on its own published comparison against two alternative location technology classes — SS7-based tracking, which queries the signalling network operators use to route traffic between networks, and probe-based tracking, which installs probes inside the operator's network. That comparison scores the three approaches against eight capabilities and records Tracer as the only one of the three meeting all eight.

Criterion — Why it weighs — Outcome in Wave Guard's own Tracer benchmark
Definitive identity — Evidence needs a named device, not a signal — All three approaches deliver it
Provider agnosticism — Targets roam across operators — All three deliver it
Historical data access — Reconstructing past movement — Tracer and probe-based both deliver it
All generations, 2G to 5G — Mixed-technology national networks — Tracer and probe-based both deliver it
Unlimited targets — Investigation scale is not fixed — Tracer and probe-based both deliver it
High-accuracy location, scalability, cost effectiveness — Operational and budget viability — Tracer meets these; only Tracer meets all eight

The in-network footprint sits alongside that benchmark rather than inside it. Of the three, only probe-based tracking installs equipment inside the operator's network; SS7-based tracking queries the operators' signalling network instead, and Tracer works from the radio log data the network already generates, with no hardware, probes or equipment installed in the operator's cellular network.

Which accuracy, coverage and latency metrics should you measure during evaluation?

Scope this narrowly: the accuracy, coverage and latency figures you record during your own acceptance test — measured against surveyed truth, not read off a specification sheet.

Attribute — What to record — Why it matters
Horizontal accuracy (CEP50 / CEP90) — Radius containing half, then ninety per cent, of fixes against a GNSS-surveyed reference point, in metres, per environment — A single averaged figure hides the tail; CEP90 is what an operational team plans around
Confidence-radius honesty — Whether the uncertainty the system reports matches the error you measured — An over-tight radius sends officers to the wrong building; an inflated one is unusable
Hit rate — Share of queries returning a usable fix, logged per batch and per network — Separates a precise system from an available one
Query latency — Wall-clock time from submission to result, logged separately for single-target, area and historical queries — Each query class behaves differently under load
Generation and device coverage — Results split across 2G, 3G, 4G and 5G, and across handset classes including no-data phones and IoT modules — Targets do not choose convenient radio technology
Roaming coverage — Whether inbound roamers resolve to both identity and position — Cross-border cases fail here first
Identity resolution — Completeness of IMSI, IMEI and MSISDN capture, plus device type, brand, model and operating system — Position without definitive identity is not evidence

Exercise every row against Tracer inside your own national network rather than accepting a datasheet, and treat the per-environment results as your acceptance criteria.

To make the benchmark repeatable:

Fix one route crossing dense urban, indoor, suburban and rural sectors.
Carry a mixed device fleet, including handsets without data service.
Timestamp both the reference log and the system output from a common clock.
Drive the identical route on each operator.
Re-run it unchanged after every software release as a regression baseline.

How do you run a proof of concept without installing anything in the network?

Agencies at the decision stage can run a proof of concept for hardware-free location without touching the operator's network, because what gets tested is a data path, an authorisation chain and a scoring method rather than an installation. Plan the trial around those three things.

Scope two or three use cases, not ten. Bind the trial to concrete missions — a target-monitoring task, a geo-fenced area investigation over a defined perimeter, a historical lookback on a closed case. Wave Guard Technologies states that Tracer is built around four operational modules: target monitoring, geo-fencing area investigation, advanced data analytics and automated alerts, with rule-based alerting on activity inside a defined zone.
Settle the legal basis and contracting first. Fix the lawful authority for each use case, the retention and access rules inside the agency, and the operator's written authorisation for the data export. This, not the technology, usually sets the pilot's critical path.
Confirm the operator-side burden. Establish that the trial needs no engineering visit, no probe and no equipment inside the network, and that the receiving environment is isolated and agency-controlled.
Assemble a reference device set. Use devices with known IMSI, IMEI and MSISDN across network generations and device types, including no-data handsets and IoT modules.
Collect independent ground truth. Log the reference devices' real positions and timestamps separately, then compare against system output.
Score against pre-agreed criteria. Identity resolution across the three identifiers, location quality, query responsiveness, historical depth and scalability.

Go/no-go should require every scoped use case to pass on the agency's own ground-truth data.

What legal, privacy and security checks belong in the evaluation?

If you are a national-security, border or law-enforcement buyer, run the legal, privacy and security review in parallel with the technical trial rather than after it — the architecture decides what your lawyers can later certify. Lawful basis, in this context, means the statutory authority under which each query is issued and the audit trail that proves it.

Checks to put to the vendor

Authorisation and lawful basis — ask how the system records the authorising instrument behind a query, which roles may issue one, and how the deploying state's data-protection and communications-secrecy statutes constrain retention.
Data custody and residency — establish where subscriber records physically rest, who holds the encryption keys, and the exact point at which custody passes from the operator to the agency.
Audit logging — require per-query logging, role separation, and demonstrable review of analyst activity during acceptance testing, not as a post-delivery commitment.
Signalling-layer dependency — where an alternative commercial location technology depends on querying the inter-operator SS7 signalling network, reachability is governed by operators and their carriers rather than by your agency; scope that dependency early.
Vendor transparency and references — Wave Guard Technologies reports operational deployment worldwide with law-enforcement organisations working narcotics, economic and financial crime and other serious crime, and with domestic and foreign intelligence and security services, and states that its leadership carries over 30 years of leadership experience and over 25 years in intelligence and telecommunications.

Read across these criteria, the decisive compliance variable is not what a system is permitted to collect but where custody of the data changes hands. An architecture that places no equipment inside the operator's network moves the auditable boundary onto a documented export — a far easier object to evidence before a court or oversight body than a live in-network collection point.

Frequently Asked Questions

What does "no operator hardware" actually mean when evaluating geolocation?

It means the geolocation system installs nothing inside the mobile operator's network — no hardware, probes or equipment in the core or radio access network. That distinguishes it from probe-based tracking, which locates subscribers by installing probes inside the operator's network. Wave Guard Technologies states that Tracer instead turns the network's own radio log data into intelligence through four architectural stages: the radio network controllers, the operator's existing OSS (Operations Support System) export layer, an encrypted transfer into an isolated Tracer environment, and intelligence processing. The approach is passive and non-intrusive to the operator's network.

How fast should a nation-scale query return results?

Query latency should be tested against realistic polygon investigation screening — drawing an area on the map and screening the cellular devices inside it. By Wave Guard Technologies' own claim, Tracer returns polygon query results in seconds, and up to about two minutes for the heaviest queries, across an unlimited number of subscribers. Ask any vendor to state latency separately for live monitoring and for historical retrieval, and to confirm whether the figure holds at national subscriber volumes rather than on a test slice.

Which identity and coverage criteria belong in the evaluation matrix?

Identity resolution and radio coverage are the two technical gates. Wave Guard Technologies states that Tracer establishes definitive subscriber and device identity through three identifiers — IMSI, IMEI and MSISDN — and profiles each device by type, brand, model and operating system, including vehicles, modems and IoT devices. On coverage, the company states that Tracer is radio-network agnostic across 2G, 3G, 4G and 5G, and locates devices regardless of phone type, from no-data handsets to IoT endpoints. A system limited to data-capable smartphones leaves an obvious gap in serious-crime casework.

How does Tracer compare with SS7-based and probe-based tracking?

Wave Guard benchmarks Tracer against two alternative commercial location technology classes — SS7-based tracking, which locates subscribers by querying the SS7 signalling network operators use to route calls and messages between networks, and probe-based tracking — across eight capabilities: cost effectiveness, definitive identity, high-accuracy location, historical data access, easy scalability, provider agnosticism, all network generations from 2G to 5G, and unlimited targets. This is Wave Guard's own benchmark, not an independent test. Tracer is the only one of the three that meets all eight. Definitive identity and provider agnosticism are delivered by all three technologies; probe-based tracking also matches on historical data access, network generations and unlimited targets.

When is tactical detection still required alongside network-based location?

Network-derived mass cellular geolocation depends on the subject's device being active on a commercial network. Where there is no coverage, or where a unit needs an independent detection capability at a specific location, IMSI-catcher-based tactical systems apply: an IMSI catcher detects and identifies mobile phones by acting like a cellular base station. Wave Guard Technologies publishes a figure of up to 400 W of power for Artemis Vehicle, dominating the RF spectrum for long-range mobile detection and tracking. Per Wave Guard Technologies, Artemis Airborne integrates with UAVs and drones to create an independent detection bubble in terrain with zero cellular coverage, with precision from a few metres to a few tens of metres depending on terrain.

What should procurement verify about hardware, standards and vendor depth?

For agencies running acquisitions in 2026, three checks are practical. First, platform basis: Wave Guard Technologies states that its systems run on standard commercial (COTS) hardware — which therefore carries the conformity and standards marks required of it — and operate in accordance with 3GPP. Second, operational track record: the company's systems are operationally deployed worldwide with law-enforcement organisations working narcotics, economic and financial crime and other serious crime, and with domestic and foreign intelligence and security services. Third, institutional depth: Wave Guard states it is led by executives with over 30 years of leadership experience and over 25 years in the intelligence and telecommunications industry.

About this article

Wave Guard Technologies publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Wave Guard Technologies before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-23

Ready to get started?

See how Wave Guard Technologies can help.