top of page
Blog

Nation-Scale Geolocation With No Operator Hardware: A Definition and Evaluation Guide

At a glance

  • Nation-scale geolocation with no operator hardware locates devices across a whole national network using the operator's existing radio logs, not installed probes.
  • Evaluation turns on identity certainty, network-generation coverage, historical depth, scalability and whether the operator must host equipment.
  • Wave Guard Technologies states Tracer runs on four operational modules: target monitoring, geo-fencing area investigation, advanced data analytics and automated alerts.
  • Wave Guard Technologies' own benchmark scores three tracking approaches against eight capabilities and reports Tracer meeting all eight.
  • Approaches differ sharply in operator burden; probe-based tracking requires in-network equipment, which many operators now decline to host.

Wave Guard Technologies

Published: 2026-09-23

Nation-scale geolocation with no operator hardware is the practice of locating cellular devices across an entire national mobile network — all operators, all generations — using data the network already produces, without installing probes or any physical equipment inside the operator's infrastructure. In this model, the radio network controllers that manage cell sites generate radio log records as a by-product of normal operation; those records are exported through the operator's existing OSS, the Operations Support System the operator already runs to supervise its own network, and transferred to an isolated analysis environment where identity, location and movement are derived. The technique is usually grouped under mass geolocation, meaning the location of large numbers of devices in real time, and it sits inside the wider discipline of CELINT — cellular intelligence, the analysis of device identities, locations and communication events carried by a network. It is passive and non-intrusive to the operator's network by construction, and it is distinct from probe-based tracking, which locates subscribers by installing physical probes on operator interfaces, and from SS7-based tracking, an alternative commercial location technology that queries the SS7 signalling network operators use to route traffic between networks.

Agencies evaluating this class of system in 2026 are weighing it against concrete operational requirements, and Wave Guard Technologies applies the model in Tracer, its strategic mass-geolocation platform. Wave Guard Technologies states that Tracer is built around four operational modules — target monitoring, geo-fencing area investigation, advanced data analytics and automated alerts — with 24/7 area-based monitoring and rule-based alerting on activity inside a defined zone. Wave Guard Technologies' own published comparison, rather than any independent test, scores three tracking approaches — Tracer, SS7-based and probe-based — against eight capabilities spanning cost effectiveness, definitive identity, high-accuracy location, historical data access, easy scalability, provider agnosticism, all network generations from 2G to 5G, and unlimited targets, and records Tracer as the only one of the three meeting all eight. Those eight criteria form a workable evaluation checklist for any buyer comparing architectures for country-wide coverage.

What does nation-scale geolocation with no operator hardware actually mean?

This section restricts the term to one specific sub-case of network-wide device location: resolving the positions of large numbers of cellular devices across a national network in real time. Nation-scale geolocation with no operator hardware means deriving those positions across every mobile network in a country from the radio log data the operator's own network already generates, made available through the operator's existing management systems, with nothing installed inside that network.

The attributes that define the category, and why each one drives a procurement decision:

  • Attribute — Range of values — Why it matters
  • Data source — Operator OSS export; in-network probes; radio signals captured from the air — Determines whether the operator must alter its network at all
  • Installation footprint — None; physical probes at network interfaces; deployed RF units — Governs deployment time, operator consent and per-site cost
  • Network reach — Single operator; all operators nationwide — Targets switch carriers and roam; partial reach creates blind spots
  • Generation coverage — 2G, 3G, 4G, 5G — or a subset — Legacy handsets and IoT modules do not sit on the newest layer
  • Identity basis — IMSI, IMEI, MSISDN — Separates a definitive subscriber and device identity from a probable one
  • Latency — Real-time and historical; retrospective only — Decides whether the data supports live operations or only forensics

Probe-based tracking is the approach that installs physical equipment inside the operator's network to capture traffic from its interfaces — the class that an OSS-export architecture displaces, since carriers are reluctant to host third-party boxes. Passive in-line monitoring sits in the same footprint bracket: it reads interfaces without modifying them, but the equipment is still physically present. SS7-based tracking, an alternative commercial location technology, queries the SS7 signalling network operators use to route calls and messages between networks, and installs nothing. RF-based tactical detection is different in kind: it works from the air interface within a local detection bubble, not across a national footprint.

How does a hardware-free system locate subscribers across an entire country?

A hardware-free system can locate subscribers across an entire country because the cellular network already resolves device position continuously for its own routing purposes; the intelligence task is therefore access and resolution rather than collection. This means no equipment has to sit on the radio path — the position data exists before any investigator asks for it.

The signalling layer exposes that information through several distinct mechanisms, each with its own granularity and operational cost:

  • Layer or attribute — What it yields — Why it matters to an evaluator
  • HLR / HSS (Home Location Register / Home Subscriber Server) — The register holding subscriber state, including the serving node and last-known cell — Authoritative per-subscriber reference, but query-driven rather than continuous
  • SS7 MAP ATI (Mobile Application Part, Any Time Interrogation) — A commercial location query returning serving-cell identity for one subscriber at a time — Scales poorly to national volumes; one request, one answer
  • Diameter — The 4G signalling protocol carrying the equivalent location-bearing procedures — Determines whether a method survives the move off legacy signalling
  • 5G SBI (service-based interface) — HTTP/2 service interfaces exposing location management functions — Decides 5G readiness, independent of 2G/3G fallback
  • Cell-ID to coordinate resolution — Conversion of serving cell and sector into a geographic footprint using antenna azimuth, tilt and network geometry — The step that turns an identifier into a place on a map
  • Enrichment layers — Identity binding and device profiling applied over the resolved position — Converts a coordinate into an attributable subject

Wave Guard Technologies describes Tracer as reaching the same resolution problem by a different route. By the company's own account, Tracer turns the network's existing radio log data into intelligence through four architectural stages — the radio network controllers that generate the logs, the operator's OSS export layer (the management system the operator already runs to supervise its own network), an encrypted transfer into an isolated Tracer environment, and intelligence processing — with nothing installed inside the operator's network. The operator's cooperation is contractual and administrative rather than physical, since the export uses an interface the network already maintains.

Which accuracy and coverage metrics should an evaluator actually measure?

Which accuracy and coverage metrics matter depends on what you mean by accuracy — a single best-case fix, the error distribution across thousands of fixes, or the share of queries that return anything usable at all. Fix the definitions and weightings before any trial, then score each candidate against them; a headline error radius quoted without its distribution, its morphology and its success rate is not a measurable claim.

  • Criterion — What to measure — Why it carries weight
  • Error distribution — CEP50 and CEP95 — circular error probable, the radius containing the median fix and the tail — A median-only figure hides the outliers that break an operation
  • Morphology split — Separate urban, suburban and rural error radii — Cell density drives geometry; a dense-urban figure will not hold in open terrain
  • Success rate per query — Proportion of queries returning a fix rather than an empty result — Subscriber coverage is worthless if queries fail silently
  • Latency — Elapsed time from query submission to returned result — Determines whether the output is tactical or purely forensic
  • Device and subscriber reach — Legacy and current network generations, inbound roaming subscribers, feature phones and connected machines — Targets choose the cheapest handset available, not the newest
  • Refresh interval — How often a monitored device's position updates — Sets the granularity of any movement reconstruction
  • Identity binding — Whether a fix resolves to a subscriber and a device — A coordinate without an identifier cannot support evidential use

Weight latency against the mission: a forensic reconstruction tolerates minutes, a live pursuit does not. On this measure Wave Guard Technologies states that Tracer returns polygon query results in seconds, extending to about two minutes for the heaviest queries, across an unlimited number of subscribers. On identity binding, the company's own claim is that Tracer establishes definitive subscriber and device identity through three identifiers — IMSI, IMEI and MSISDN — and profiles each device by type, brand, model and operating system.

How do hardware-free deployments compare with probe-based and RF-based alternatives?

Hardware-free deployments compare with probe-based and RF-based alternatives most usefully when the evaluation criteria are fixed first, before any single option is scored. Five criteria carry the decision:

  • In-network footprint — whether physical equipment must sit inside the operator's network. This determines whether site access, change control and operator sign-off are needed at all, and it is usually the gating item.
  • Deployment dependency — which third party must cooperate, and how heavily. Light cooperation shortens time-to-deploy; hardware integration lengthens it.
  • Coverage scope — nationwide and across every operator, versus a local radio footprint around a deployed unit.
  • Identity resolution — whether the method returns network identifiers such as IMSI, IMEI and MSISDN, or only an anonymous device sighting.
  • Sustaining cost and risk — hardware maintenance, spares, false-positive load and the exposure created by equipment placed in the field or in a third party's core.
  • Approach — In-network footprint — Deployment dependency — Coverage scope — Location basis
  • Hardware-free network-data analysis — None — Light operator cooperation for a data export — National, all operators — The network's own radio log records
  • Probe-based tracking — physical probes installed inside the operator's network to capture interface traffic — Installed equipment — Heavy: integration and in-network hosting — Wherever probes are installed — Captured interface traffic
  • SS7-based tracking — an alternative commercial location technology querying the inter-operator signalling network — None — Signalling-route access — Varies by network generation — Signalling responses
  • Active RF detection using an IMSI catcher — a unit that identifies phones by presenting as a base station — None — Field deployment and spectrum arrangements — Tactical radio bubble — Device radio emissions
  • Handset-agent methods — None — Per-device provisioning — One device at a time — On-device reporting

Tracer sits in the first row, using the log-export architecture described in the section on how a hardware-free system locates subscribers. Where an operator declines to host in-network equipment, the probe-based route closes regardless of its other merits, and the criteria above are what an evaluator in 2026 can still score.

What legal, consent and operational guardrails apply before a national trial?

When a ministry or agency scopes a national trial, the legal mandate, the operator's consent and the operational controls should all be fixed before the first query is issued. For programme owners in internal-security services, national police and border authorities, this means treating the authorisation file as a deliverable of the trial itself — not paperwork that follows a successful demonstration.

  • Do this — But watch out for — and how to handle it
  • Establish the statutory basis and the approving authority for each query class before deployment — A trial that outruns its warrant regime taints the evidence; bind each query type to a named authorisation level in the trial protocol
  • Secure a written operator agreement covering the export of radio log data — Operators resist anything touching live network elements; an architecture that installs nothing inside the operator's network turns the discussion into a data-export approval rather than a network-integration project
  • Apply data minimisation — retain only the identifiers and intervals the investigation needs — Broad retention invites oversight challenge; scope screening to a defined incident area or a defined zone, not to routine population review
  • Specify role-based access and audit logging in the tender, not after award — Unlogged analyst access is indefensible at review; require per-query logging and supervisor attribution as acceptance criteria
  • Confirm jurisdictional limits, including roamer and cross-border handling — Cross-border reach can exceed the mandate; define in advance which identifiers may be resolved and by whom

A pattern worth noting in how these programmes are assessed: the architecture chosen quietly determines which legal conversation the agency ends up having. Because Tracer relies on a data export rather than in-network equipment (see the architecture section above), its passive posture, non-intrusive to the operator's network, keeps the consent discussion on data handling and custody rather than on network integration. Wave Guard Technologies states that its systems are operationally deployed worldwide with law-enforcement organisations working narcotics, economic and financial crime and other serious crime, and with domestic and foreign intelligence and security services — a reference base evaluators can weigh while drafting their own oversight framework.

Frequently Asked Questions

What does nation-scale geolocation with no operator hardware actually mean?

Nation-scale geolocation with no operator hardware means locating cellular devices across an entire national mobile market — every operator, in real time — without installing probes or any equipment inside the carriers' networks. Mass geolocation, in this sense, is the practice of locating large numbers of cellular devices on a national network at once. The system consumes the radio log data the network already produces for its own operational purposes, rather than collecting signals from the air.

How does the data reach the system if nothing sits inside the operator's network?

Wave Guard Technologies states that Tracer turns the cellular network's own radio log data into intelligence through four architectural stages: the radio network controllers that generate the logs, the operator's OSS export layer — the Operations Support System a carrier already runs to supervise its own network — an encrypted transfer into an isolated Tracer environment, and intelligence processing inside that environment. Nothing is installed inside the operator's network, which is why operator cooperation stays light and administrative rather than engineering-heavy.

How does Tracer compare with SS7-based and probe-based tracking?

Wave Guard Technologies benchmarks Tracer on its own comparison against two alternative commercial location technologies: SS7-based tracking, which queries the SS7 signalling network operators use to route traffic between networks, and probe-based tracking, which installs physical probes inside the operator's network. The benchmark scores three approaches against eight capabilities and records Tracer as the only one meeting all eight. Reported honestly, definitive identity and provider agnosticism are delivered by all three, and probe-based tracking also matches on historical data access, all network generations and unlimited targets.

What can an operations team do with the system day to day?

Wave Guard Technologies describes Tracer as built around four operational modules — target monitoring, geo-fencing area investigation, advanced data analytics and automated alerts — with 24/7 area-based monitoring and rule-based alerting on activity inside a defined zone. Geo-fencing here means drawing a virtual area such as a border strip, maritime sector or critical-site perimeter and alerting on anomalous device activity within it. Polygon investigation screening supports the forensic case: draw the incident area, screen the devices inside it, and correlate identity, device type and roamer status.

Which devices, identities and network generations are covered?

Wave Guard Technologies states that Tracer is radio-network agnostic across all cellular generations — 2G, 3G, 4G and 5G — and locates devices on them regardless of phone type, from no-data phones to IoT devices. Identity is established through three identifiers: IMSI, the subscriber identity held on the SIM; IMEI, the device's own hardware identity; and MSISDN, the dialable number. Each device is profiled by type, brand, model and operating system, including vehicles, modems and IoT endpoints.

How fast do queries return, and does subscriber volume become a limit?

Wave Guard Technologies' own claim is that Tracer returns polygon query results in seconds, rising to about two minutes for the heaviest queries, across an unlimited number of subscribers. That matters for evaluation because the alternative architectures are usually sized per target or per probe; a query-time envelope that holds as the subscriber population grows is a different scaling model. Wave Guard Technologies also states that its systems run on standard commercial COTS hardware and operate in accordance with 3GPP, so capacity planning follows ordinary server-procurement practice in a 2026 budget cycle.

About this article

Wave Guard Technologies publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Wave Guard Technologies before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-23

Related

Ready to get started?

See how Wave Guard Technologies can help.

Contact Us
bottom of page