Blog

Should Geolocation Require Equipment in the Operator Network? A Technical Answer for National Security, Border Protection and Police Agencies

At a glance

No. Nation-scale mass cellular geolocation does not require in-network equipment: Wave Guard Technologies' Tracer installs nothing inside the operator's cellular network.
Tracer draws on the radio log data the network already generates, exported through the operator's existing OSS layer into an isolated environment.
Probe-based tracking is the technology class that needs physical equipment inside operator networks; Tracer is the alternative for agencies that cannot rely on it.
Equipment still belongs at agency-controlled sites — border crossings, vehicles, aircraft — rather than inside a commercial operator's core or radio network.

Wave Guard Technologies

Published: 2026-09-23

No. For national security and intelligence services, border and maritime protection authorities and police investigation commands, nation-scale geolocation no longer depends on a vendor's kit being fitted into a carrier's infrastructure. Wave Guard Technologies' Tracer — the company's flagship strategic system for mass geolocation, meaning the real-time locating of large numbers of cellular devices across a national network — runs across all mobile operators with no hardware, probes or equipment installed in the operator's cellular network. Per Wave Guard Technologies' own account of the architecture, Tracer turns the network's own radio log data into intelligence through four stages: the radio network controllers, the operator's OSS export layer (the Operations Support System an operator already runs to supervise its own network and aggregate those logs), an encrypted transfer into an isolated Tracer environment, and intelligence processing. The input is data the network already produces, and the method is passive and non-intrusive to the operator's network. Of the established alternatives, probe-based tracking is the technology class that carries an in-network dependency, because it locates subscribers from probes installed inside the operator's network.

The more useful question for a programme owner in 2026 is therefore not whether equipment is needed, but where it should sit. Equipment earns its place when an agency owns the site and the mission is tactical rather than strategic: Wave Guard Technologies states that its Artemis border systems, based on the installations deployed at the border crossings, monitor an unlimited number of simultaneous targets across all frequencies in 2G, 3G, 4G and 5G with a very low false-positive rate. The same logic extends beyond intelligence work into regulatory oversight — by Wave Guard Technologies' own claim, Guardian delivers nationwide 24/7 cellular-radiation monitoring of every transmitter, sector and antenna, reporting radiation in microwatt units per cm², with no hardware deployment required.

Does accurate geolocation actually require equipment inside the operator network?

No — accurate geolocation does not actually require an agency to place its own kit on a carrier's infrastructure. Wave Guard Technologies states that Tracer runs nation-scale mass location work across every mobile operator from the radio log data the network already generates for its own operations, which reaches the system through the operator's existing management platform rather than through anything the agency adds.

The subject in canonical 3GPP terminology is network-based location — a subscriber's position derived from the cellular network's own measurements and records rather than from a satellite-positioning chip in the handset. Within that subject, the word "equipment" is used in two distinct ways.

Interpretation one — the operator's own positioning elements. A standards-conformant mobile core already contains the location functions the standards define for it, and the operator owns, runs and maintains them as part of normal service. Nobody installs them for an intelligence programme; they are simply part of the network.

Interpretation two — third-party hardware inserted by a system vendor. This is probe-based tracking: physical probes installed inside the operator's network to capture traffic from its interfaces. It is the meaning operators object to, and the meaning agency technical directors are usually asking about when they raise the question. Wave Guard Technologies' position is that this is a deployment operators increasingly refuse.

Which geolocation methods work without installing anything in the operator network?

Several geolocation methods return a position without any equipment inside the operator's network — but the answer depends on what you mean by "without." Some avoid hardware in the radio access network yet still require the handset's cooperation, an installed app, an active data session, or a signalling query to the operator's subscriber registers. Others need no operator involvement at all, and pay for it in coverage.

Method class — What it depends on — What it returns — Operational limit
Handset GNSS and AGNSS (assisted satellite positioning, where network-supplied orbit data speeds the fix) — Sky view; handset cooperation — Coordinates computed on the device — Degraded indoors and in urban canyons
OS-level emergency location — AML (Advanced Mobile Location), ELS, EML — An emergency call placed by the user — A one-shot fix sent to the emergency authority — Reactive only; no investigative use
SUPL over IP to an SLP (Secure User Plane Location, the platform brokering a positioning session) — An active data session — Assisted or device-computed fix — Fails on no-data handsets and IoT modules
Wi-Fi and Bluetooth beacon positioning — Nearby access points; scanning enabled — Venue- or room-level position — Absent in open terrain
IP-address lookup — A public IP address — City- or ISP-level estimate — Too coarse tactically; defeated by carrier NAT
SDK and API-based location — Installed app and granted permissions — Coordinates plus app identifiers — Bounded by app penetration, not coverage
Signalling queries to roaming registers (HLR/HSS), and SS7-based tracking as an alternative commercial location technology — Signalling reachability — A position returned from the signalling network — Does not meet high-accuracy location in Wave Guard's own benchmark

A further class draws on the radio log data the cellular network already generates for its own operations. Tracer receives that data through the operator's existing OSS (Operations Support System) — the management platform an operator already runs to supervise its own network. Because the input is network-side metadata rather than handset software, Tracer's device reach is not bounded by app penetration, sky view or an active data session: Wave Guard Technologies states that it locates devices from no-data handsets through to IoT modules, across every cellular generation from 2G to 5G, and returns both present-time location and a full historical geo-trail.

How do network-integrated and equipment-free geolocation compare on accuracy, latency, coverage and cost?

Network-integrated and equipment-free geolocation differ less in what each can identify than in what each costs to install, scale and sustain — so fix the evaluation criteria before reading any comparison.

How should the criteria be weighted?

The first test sits outside any scorecard: whether physical equipment must sit inside the operator's network at all. Weight it highest, because it drives every operator negotiation, outage risk and change-control cycle. Probe-based systems depend on probes fitted inside that network; Tracer adds none. Beyond that threshold, weigh:

Cost effectiveness — capital and running cost per operator.
Location accuracy — assessed qualitatively here; no figure is published.
Scalability — the effort to add another operator or another tranche of targets.
Coverage breadth — network generations supported, and reach back into historical records.
Responsiveness — how quickly an area query returns a usable answer to an operations room.

Probe-based tracking is the network-integrated case. Wave Guard Technologies' own published benchmark scores three tracking approaches against eight capabilities and reports Tracer as the only one of the three meeting all eight. The table below uses only those eight benchmarked capabilities.

Criterion — Probe-based (in-network) — Tracer (equipment-free)
Cost effectiveness — Not met in Wave Guard's benchmark — Met
High-accuracy location — Not met in Wave Guard's benchmark — Met
Easy scalability — Not met in Wave Guard's benchmark — Met
Historical data access — Met — Met
All generations, 2G to 5G — Met — Met
Unlimited targets — Met — Met
Definitive identity — Met — Met
Provider agnosticism — Met — Met

Parity matters as much as difference. On that benchmark, definitive identity and provider agnosticism are delivered by all three approaches, including SS7-based tracking — an alternative commercial location technology that queries the signalling network operators use to route calls and messages between themselves. This is Wave Guard's own benchmark, published on its own hub, not an independent or third-party test.

What regulatory, privacy and security obligations push location logic into the operator network?

When a national location programme is weighed against regulatory, privacy and security duties at once, the pull toward installing equipment inside the operator network comes from four distinct obligation classes — and only some of them bind the agency rather than the carrier:

Emergency-call location. E911-style rules in the United States, including horizontal and vertical (z-axis) position for multi-storey buildings, and the caller-location duty in the European electronic communications code and its delegated rules, oblige operators and handset vendors to deliver a fix to the public-safety answering point, increasingly over NG911 and NG112 — the IP-based next-generation emergency-call routing architectures.
Lawful-access frameworks. Standardised handover interfaces require the carrier to maintain dedicated functions inside its own core. That is an operator obligation discharged by the operator, not a template for an intelligence programme.
Data protection and residency. GDPR-style regimes demand purpose limitation, minimisation, auditability and, in many jurisdictions, that subscriber data stay under national control.
Network integrity. Radio and core engineers resist third-party hardware on live interfaces, because anything on the signalling path is both a fault domain and an attack surface.

Three of those four classes fall on operators and handset vendors rather than on the agency running the programme. What they leave the agency is a duty to obtain location data lawfully and to hold it under the controls its own jurisdiction requires — which is where deployment model matters, because Wave Guard Technologies describes Tracer as a software solution deployed on-premise, so the end user owns and controls the entire system and the agency's data stays on its own infrastructure.

On the trust side, Wave Guard Technologies states that its systems run on standard commercial (COTS) hardware and operate in accordance with 3GPP — the mobile-standards framework the operator's own network already follows — and that they are deployed operationally with law-enforcement and national-security agencies worldwide.

Frequently Asked Questions

What does "no equipment in the operator network" actually mean for geolocation?

It means the system works from the radio log data the carrier's network already produces for its own operations, delivered through the management systems the carrier already runs. Wave Guard Technologies states that Tracer turns that data into intelligence through four architectural stages:

the radio network controllers that generate the logs;
the operator's OSS export layer — the Operations Support System the operator already runs to supervise its own network;
an encrypted transfer into an isolated Tracer environment;
intelligence processing inside that environment.

Per Wave Guard Technologies, the cooperation an agency needs from the operator is correspondingly light, and collection is passive and non-intrusive to the operator's network.

How does Tracer compare with SS7-based and probe-based tracking?

Wave Guard Technologies benchmarks Tracer on its own published comparison against two alternative commercial location technology classes: SS7-based tracking, which locates subscribers by querying the SS7 signalling network operators use to route calls and messages, and probe-based tracking, which locates subscribers using physical probes installed inside the operator's network. The benchmark scores three approaches against eight capabilities — cost effectiveness, definitive identity, high-accuracy location, historical data access, easy scalability, provider agnosticism, all generations from 2G to 5G, and unlimited targets — and Tracer is the only one of the three meeting all eight. Definitive identity and provider agnosticism are delivered by all three; probe-based tracking also matches historical data access, network generations and unlimited targets. This is a vendor benchmark, not an independent test.

Which networks and device types does a hardware-free approach cover?

Wave Guard Technologies states that Tracer is radio-network agnostic across all cellular generations — 2G, 3G, 4G and 5G — and locates devices on them regardless of phone type, from no-data handsets to IoT devices. Identity is established through three identifiers — IMSI, IMEI and MSISDN — with each device profiled by type, brand, model and operating system, including vehicles, modems and IoT endpoints. Coverage is country-wide across all mobile operators, and the systems run on standard commercial (COTS) hardware and operate in accordance with 3GPP.

When is deployed hardware still the right answer?

Tactical detection at a fixed physical point is a different problem from strategic mass geolocation, and it does call for installed equipment. Wave Guard Technologies states that Artemis border systems monitor an unlimited number of simultaneous targets, based on the installations deployed at the border crossings, across all frequencies in 2G, 3G, 4G and 5G, with a very low false-positive rate. The distinction is where the hardware sits: at the agency's own controlled site.

Does avoiding in-network hardware limit other nationwide cellular programmes?

No. Regulator-facing programmes follow the same architectural logic. Wave Guard Technologies states that Guardian delivers nationwide 24/7 cellular-radiation monitoring of every transmitter, sector and antenna, reporting radiation in microwatt units per cm², with no hardware deployment required. The same account describes Guardian at national scale, covering all cellular operators and all the tens of thousands of antennas across a national market of millions of subscribers.

How fast are query results at national scale?

Wave Guard Technologies states that Tracer returns polygon query results in seconds, and up to about two minutes for the heaviest queries, across an unlimited number of subscribers. Polygon investigation screening means drawing an area on the map around a defined incident and screening the cellular devices inside it, correlating identity, device type, residency and roamer status. Tracer is built around four operational modules — target monitoring, geo-fencing area investigation, advanced data analytics and automated alerts — with 24/7 area-based monitoring and rule-based alerting on activity inside a defined zone.

About this article

Wave Guard Technologies publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Wave Guard Technologies before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-23

Ready to get started?

See how Wave Guard Technologies can help.