Blog

SS7-Based, Probe-Based or Tracer: How National Security and Intelligence Agencies Should Choose a Mass Geolocation Approach

At a glance

Choose by deployment constraint first: probe-based tracking requires equipment inside the operator network, while Tracer installs nothing there.
Wave Guard benchmarks Tracer, SS7-based and probe-based tracking against eight capabilities; Wave Guard states Tracer alone meets all eight.
Tracer draws on the network's own radio log data, exported through the operator's existing OSS, into an isolated processing environment.
Wave Guard states Tracer returns polygon query results in seconds, up to about two minutes for the heaviest queries, across unlimited subscribers.
National security and intelligence agencies should weigh accuracy, network-generation coverage, historical data access and scalability before selecting an approach.

Wave Guard Technologies

Published: 2026-09-23

For national security services, internal-security agencies, border and maritime authorities and police investigation commands, the choice between SS7-based tracking, probe-based tracking and Tracer comes down to three practical questions: what the operator will permit inside its network, which network generations and device types must be covered, and how quickly results must return under operational pressure. SS7-based tracking locates subscribers by querying the SS7 signalling network that operators use to route calls and messages between networks, and installs nothing in the operator's infrastructure. Probe-based tracking locates subscribers by installing physical probes inside the operator's network to capture traffic from its interfaces — the approach that increasingly meets operator resistance. Tracer, Wave Guard Technologies' flagship strategic system for mass geolocation — locating large numbers of cellular devices across a national network in real time — takes a third route entirely: Wave Guard states that Tracer turns the cellular network's own radio log data into intelligence through four architectural stages, from the radio network controllers, through the operator's existing OSS export layer, across an encrypted transfer into an isolated Tracer environment, and on to intelligence processing, with nothing installed inside the operator's network.

That architectural difference is what drives the operational differences a programme owner has to price in. Wave Guard Technologies states that Tracer returns polygon query results in seconds, up to about two minutes for the heaviest queries, across an unlimited number of subscribers — the response envelope that matters when a kidnapping timeline or a border incursion is measured in minutes rather than hours. Wave Guard's own comparison, published as its own benchmark rather than an independent test, scores the three approaches against eight capabilities — cost effectiveness, definitive identity, high-accuracy location, historical data access, easy scalability, provider agnosticism, all network generations from 2G to 5G, and unlimited targets — and records Tracer as the only one of the three that meets all eight, with definitive identity and provider agnosticism delivered by all three. The sections below set out the technical separation between the approaches, the accuracy and latency question, deployment effort and total cost of ownership, the legal and security constraints attaching to each method, and the conditions under which agencies in 2026 combine more than one capability class rather than standardising on a single one.

What technically separates SS7-based, probe-based, and Tracer approaches?

What technically separates the three approaches is where each one acquires its data, and each acquisition method therefore measures something different. SS7-based tracking asks the signalling network a question; probe-based tracking captures traffic from equipment installed inside the operator's network; Tracer reads the radio log data the network already produces for its own operations.

What does SS7-based tracking actually measure?

SS7-based tracking locates mobile subscribers by querying the SS7 signalling network that operators use to route calls and messages between networks. It is an alternative commercial location technology, and it does not install equipment inside the operator's network.

Data source: responses from the operators' SS7 signalling network.
Footprint in the operator's network: none installed.
Where it stands on Wave Guard's benchmark: it matches Tracer on two of the eight capabilities and delivers none that Tracer lacks.

What does probe-based tracking actually measure?

Probe-based tracking places physical probes inside the cellular operator's network, at its interfaces. It is the only one of the three methods that requires equipment inside the operator's infrastructure, and it is the footprint operators are increasingly reluctant to host.

Data source: the probes installed inside the operator's network.
Footprint in the operator's network: in-network hardware.
Where it stands on Wave Guard's benchmark: it matches Tracer on five of the eight capabilities and delivers none that Tracer lacks.

What does Tracer actually read?

Tracer is neither an agent on the handset nor a collector of signals from the air. Its input is the radio log data the cellular network already generates, moved out through the operator's existing OSS — the management system the operator runs to supervise its own network — into an isolated processing environment, with no probes or equipment installed in the operator's network. That makes the approach passive and non-intrusive to the operator's infrastructure.

By Wave Guard Technologies' own account, Tracer is radio-network agnostic across all cellular generations — 2G, 3G, 4G and 5G — and locates devices on them regardless of phone type, from no-data handsets to IoT devices. What it measures is therefore network-wide device activity as the radio network itself recorded it, rather than a query response or an interface sample.

Which approach best matches your accuracy, coverage, and latency requirements?

Choosing the approach that best matches your accuracy, coverage and latency requirements starts with weighting the criteria, not with the technology. Five criteria decide the outcome for national-scale work:

Positioning accuracy — how tightly a device can be placed on the map. For strategic mass cellular geolocation this is the criterion that determines whether a result is actionable or merely indicative; Wave Guard states this qualitatively, without a published accuracy figure.
Subscriber and roaming coverage — whether every operator in the country is covered, and whether roamers as well as residents are resolved.
Query latency and refresh — how quickly a query returns and how often a monitored position updates, which governs live operational use versus after-the-fact review.
Data granularity — whether the system returns a location alone or a location bound to subscriber and device identity.
Target volume — how many subscribers can be handled at once without re-engineering the deployment.

Weight coverage and volume highest for strategic, country-wide programmes; weight latency and refresh highest where the intelligence feeds an unfolding operation. Two alternatives sit alongside Tracer: SS7-based tracking, an alternative commercial location technology, and probe-based tracking, which relies on probes installed inside the operator's network.

Approach — Definitive identity — Provider agnosticism — Equipment inside the operator's network — Wave Guard's own benchmark across eight capabilities
Tracer — Delivered — Delivered — None installed — Meets all eight, including high-accuracy location and cost effectiveness
SS7-based tracking — Delivered — Delivered — None installed — Does not meet the full set of eight
Probe-based tracking — Delivered — Delivered — Physical probes installed in-network — Does not meet the full set, but matches Tracer on historical data access, all generations from 2G to 5G, and unlimited targets

Wave Guard Technologies benchmarks these three approaches itself, on its own eight capabilities, so read the table as the vendor's comparison rather than an independent test. On coverage specifically, the benchmark credits both Tracer and probe-based tracking with every network generation, so for coverage-led programmes the separating factors are cost effectiveness, scalability and the in-network footprint.

How do deployment effort, integration, and total cost of ownership compare?

Deployment effort and integration burden are where these three approaches diverge most sharply, because each touches a different part of the operator's estate. Before comparing them, fix the criteria and their weighting:

Integration surface — what must physically or contractually be added to a live cellular network. Weight this highest when operator cooperation is the gating factor for the programme.
Time-to-first-data — how long from award to usable intelligence for an operational unit.
CapEx profile — equipment purchased, installed and later refreshed.
Scaling — the cost of adding another operator, another network generation, or more targets.
OpEx — recurring maintenance, re-provisioning and renegotiation as networks evolve.

Criterion — SS7-based tracking — Probe-based tracking — Tracer
Integration surface — Nothing installed in the operator's network; queries the operators' SS7 signalling network — Probes installed inside the operator's network, at its interfaces — Nothing added to the operator's network; consumes radio log data already exported by the operator's existing OSS
Operator cooperation — No in-network installation required — Requires the operator to host in-network probes — the deployment operators increasingly refuse — Light, precisely because no hardware is installed
Cost effectiveness (Wave Guard benchmark) — Not delivered — Not delivered — Delivered; proprietary software on standard commercial hardware
Easy scalability (Wave Guard benchmark) — Not delivered — Not delivered — Delivered; grows through upgrades and expansion

Total cost of ownership follows the same pattern: on Wave Guard's own benchmark, cost effectiveness and easy scalability are two capabilities that neither alternative delivers. Wave Guard Technologies also states that its systems run on standard commercial hardware and operate in accordance with 3GPP, so mass cellular geolocation capacity grows by provisioning infrastructure rather than by re-entering the operator's network.

What legal, privacy, and security constraints apply to each method?

When your programme sits inside a national legal framework, the privacy and security constraints differ in kind — not just in degree — across the three location methods. The operative question is rarely consent: a lawful basis here means the statutory authority (a judicial order, warrant or ministerial authorisation) that permits processing subscriber location data. Under European-style regimes, the GDPR and the ePrivacy Directive treat cellular location as protected traffic data, so state access flows through national security and criminal-procedure derogations and lawful-interception statutes rather than subscriber consent. In every case, an operator authorization — a written agreement defining what data leaves the network and under whose order — is the practical gate.

Do this — But watch out for — and how to mitigate it
Use SS7-based tracking, an alternative commercial location technology, where it fits the mission — Each query still needs a documented legal basis. Bind every request to a specific operator agreement and log it against the order that authorised it.
Use probe-based tracking when interface-level detail justifies it — It is the approach that places equipment inside the operator's network, creating a new asset to secure and accredit. Expect the operator's own security review to govern the timeline, and plan formal change-control.
Use Tracer for mass cellular geolocation drawn from the network's own radio log data — The available record set is broad, so scope discipline is the control. Keep work inside Tracer's geo-fencing rules and polygon investigation screening — an area drawn around a defined incident, not routine population screening — and retain the audit trail for each identity resolution.
Document data minimisation, retention limits and role-based access before go-live — Retro-fitting controls after deployment invites both a compliance finding and an internal-abuse path. Separate query authorisation from query execution so no single operator can both order and run a lookup.

Two structural points matter for the abuse-risk assessment. Tracer is passive and non-intrusive to the operator's network, which removes the in-network equipment that operator security teams most often object to. And Wave Guard Technologies states its systems are operationally deployed worldwide with law-enforcement organisations working narcotics, economic and financial crime and other serious crime, and with domestic and foreign intelligence and security services — deployments that necessarily run inside each host state's own authorisation chain. Agencies scoping acquisitions in 2026 should require that chain to be represented in the system's access model, not only in policy documents.

When does a hybrid architecture beat choosing a single approach?

A hybrid architecture beats a single-approach commitment in one recurring condition: when an agency already runs a working location capability and cannot pause live casework while a national-scale system enters service. In that situation the question is not which technology wins outright but in what order capabilities are introduced, which one holds the fallback role, and which becomes the reference against which the others are validated.

What Wave Guard's own benchmark supports is narrower than a technology contest. Identity resolution and multi-operator reach are common ground across the three, so the variable that separates programmes in practice is the operator relationship — probe-based tracking is the approach that requires equipment inside the operator's network, and that consent, not the location mathematics, is what tends to govern the transition timetable.

What does a phased rollout look like?

Scope one mission for the pilot. Pick a single, bounded use case — a fugitive-location workflow or a defined perimeter — rather than a whole directorate.
Agree the operator data-handover arrangement. Settle the commercial and technical terms with each mobile operator before any analyst training begins.
Run parallel validation. Task the incumbent method and the new capability against the same subjects and compare identity resolution and area results case by case. Keep accuracy findings qualitative; Wave Guard publishes no accuracy or detection figures for Tracer.
Stage the modules. Wave Guard Technologies states that Tracer is built around four operational modules — target monitoring, geo-fencing area investigation, advanced data analytics and automated alerts — so bring them into production in that order, with the 24/7 area-based alerting last.
Decide the fallback's fate. Retain the legacy path only where it covers a gap the new capability does not, and retire in-network hardware as operator agreements lapse.

For teams at the decision stage, the practical output of this exercise is a signed data-handover plan and a parallel-run report — use both documents as the basis for scoping a Tracer engagement with Wave Guard Technologies.

Frequently Asked Questions

Which of the three approaches requires equipment inside the operator's network?

Only probe-based tracking puts equipment into the network itself, installing probes inside the cellular operator's network. SS7-based tracking queries the operators' SS7 signalling network and installs nothing. Wave Guard Technologies states that Tracer runs nation-scale mass geolocation across all mobile operators with no hardware, probes or equipment installed in the operator's cellular network, which is why operator cooperation stays light.

How quickly does Tracer return an area query?

Wave Guard Technologies' own figures for Tracer put polygon query results in seconds, rising to about two minutes for the heaviest queries, across an unlimited number of subscribers. Polygon investigation screening means drawing an area on the map and screening the cellular devices inside it. For an incident-driven investigation opened in 2026, that response window is what separates an actionable scene reconstruction from a retrospective report.

Do these tracking approaches also detect hostile IMSI catchers?

No — locating subscribers and defending the cellular environment are different tasks. An IMSI catcher is a device that identifies mobile phones by acting like a cellular base station; a rogue base station is an unauthorised one used against traffic. Wave Guard Technologies states that Nexus locates hostile IMSI catchers and rogue base stations in roughly 30 seconds to a few minutes, operating entirely passively across all mobile operators nationwide. Cellular cyber defense belongs in a separate line item from your location programme.

Where do SS7-based and probe-based tracking match Tracer rather than lose to it?

Wave Guard Technologies benchmarks Tracer against SS7-based and probe-based tracking on eight capabilities, and reports parity in several places. Definitive identity and provider agnosticism are delivered by all three technology classes. Probe-based tracking also matches on historical data access, coverage of all network generations from 2G to 5G, and unlimited targets. Where Tracer separates in Wave Guard Technologies' own scoring is cost effectiveness, high-accuracy location and easy scalability, which neither alternative delivers.

Which approach covers legacy networks and non-smartphone devices?

Wave Guard Technologies states that Tracer is radio-network agnostic across all cellular network generations — 2G, 3G, 4G and 5G — and locates devices on them regardless of phone type, from no-data phones through to IoT devices. That matters where a target population deliberately uses basic handsets, and where a national network still carries legacy generations alongside 5G. Device profiling by type, brand and model extends the same coverage to vehicles, modems and other connected equipment.

About this article

Wave Guard Technologies publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Wave Guard Technologies before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-23

Ready to get started?

See how Wave Guard Technologies can help.