Blog

How No-Install Architecture Changes Mass Geolocation Procurement for National-Security, Intelligence and Law-Enforcement Agencies

At a glance

No-install geolocation removes the operator-integration project from procurement, replacing hardware deployment with a data-export agreement and an isolated analysis environment.
Wave Guard Technologies states Tracer draws on the network's own radio logs through four architectural stages, with nothing installed inside the operator's network.
Procurement criteria shift from probe counts and site works to identity certainty, query latency, network-generation coverage and operator consent.
By Wave Guard Technologies' own account, Tracer fixes identity through IMSI, IMEI and MSISDN and profiles each device by type, brand, model and operating system.

Wave Guard Technologies

Published: 2026-09-23

For national-security services, intelligence agencies and law-enforcement commands, no-install architecture changes geolocation procurement by deleting its most expensive and slowest line item: the in-network integration project. No-install means the capability class acquires no probes, racks, site equipment or site works inside the cellular operator's infrastructure — it consumes the radio log data the network already produces for its own operations, exported through the operator's existing OSS (Operations Support System), the management platform every operator already runs to supervise its own network. With that decision, the contract centres on data-export terms, encryption and custody of an isolated analysis environment. Wave Guard Technologies states that its flagship strategic system, Tracer, turns the network's own radio log data into intelligence across four architectural stages — the radio network controllers, the operator's OSS export layer, an encrypted transfer into an isolated Tracer environment, and intelligence processing — with nothing installed inside the operator's network. Evaluation criteria change accordingly. Instead of asking how much equipment a supplier must mount inside a live commercial network, agency technical evaluators entering a 2026 acquisition cycle ask what identity a query returns, how fast it returns it, and which network generations it reaches. On the first of those, Wave Guard Technologies' own claim for Tracer is definitive subscriber and device identity through three identifiers — IMSI, IMEI and MSISDN — with each device profiled by type, brand, model and operating system, including vehicles, modems and IoT devices.

What is no-install geolocation architecture, and what does it require from the operator?

A no-install architecture resolves a device's position without installing probes, appliances or other equipment inside the operator's cellular network. Its input is the radio log data the network already generates as a normal by-product of running itself, not signals collected from the air. Wave Guard Technologies describes Tracer's collection as passive and non-intrusive to the operator's network: cellular towers produce continuous radio logs, the operator's existing OSS aggregates and exports them, an encrypted file transfer delivers them into an isolated Tracer environment, and the analytics run there — separate from the operator's network. The cooperation asked of the operator is correspondingly light, precisely because nothing is added to its infrastructure.

Which attributes belong in the requirement matrix?

In-network footprint — whether anything must be mounted inside the operator's cellular network. Probe-based tracking installs physical probes on operator interfaces; a no-install approach installs nothing there. Each answer is a separate security review and a separate approval chain.
Positioning source — whether position is derived from data the cellular network itself already produces, or from something added to the estate. Wave Guard Technologies states that Tracer's source is the operator's own radio log data.
Coverage — which network generations and device classes are addressable at all.
Latency — elapsed time between query submission and returned position.
Location accuracy — the uncertainty around a reported position. Wave Guard Technologies states this qualitatively rather than as a figure, so a specification should require it to be demonstrated rather than quoted.
Authorisation model — the lawful basis for a query and the operator cooperation the method depends on.

Which entity classes sit in the approval path?

The mobile network operator, the agency procurement team, the data protection officer (DPO) and the security reviewer each gate a different layer of the same acquisition. Removing the in-network component closes the operator's engineering-approval gate outright and shrinks what the security reviewer has to assess to the agency's own isolated environment and the encrypted path into it.

Wave Guard Technologies states that Tracer is radio-network agnostic across 2G, 3G, 4G and 5G, locating devices regardless of phone type — from no-data handsets through to IoT devices.

Why does a no-install architecture change the procurement process itself?

Taking the in-network build out of the design takes whole workstreams out of the procurement file: no operator engineering approvals for hardware, no site-access and acceptance programme, and no per-operator equipment rollout. On Wave Guard Technologies' own account of why agencies are looking, operators increasingly refuse to have probes or hardware installed in their networks — the installation is painful and problematic for the operator — so agencies that previously relied on in-network equipment need a replacement that puts no load on the operator. The practical consequence is that the security questionnaire narrows to the agency's own isolated environment and the encrypted data path into it, and the stakeholder mix shifts toward procurement, legal and operations rather than network engineering.

Set the evaluation criteria — and their relative weight — before any option is scored:

Dependency count (weight it highest): every external gate, from in-network installation to operator change-control, adds elapsed time an agency cannot control.
Review scope: how much of the estate the assessor must cover determines questionnaire length and clearance effort.
Operator burden: probe-based tracking, which locates subscribers by installing physical probes inside the operator's network, requires change-control inside a live commercial network; a no-install approach does not.
Commercial scoping: confirm in writing how scope is defined — targets, areas, or national coverage — rather than assuming a seat-based model.
Time from signature to first usable result.

Criterion — Why it matters — Evidence to request
Dependency count — Fewer gates, fewer schedule owners — Named list of prerequisites before go-live
Review scope — Drives assessor cost and duration — Data-flow diagram and environment boundary
Operator burden — Determines operator sign-off effort — What, if anything, is installed network-side
Estate fit — Avoids exclusions mid-programme — Network generations and device types supported
Time to first value — Governs programme milestones — Acceptance-test definition

On estate fit, the generation and device coverage Wave Guard Technologies states for Tracer, set out in the section above, lets a 2026 requirement be written once for the national estate rather than qualified device class by device class.

How does no-install architecture compare with the alternative tracking technologies on the same benchmark?

Wave Guard Technologies benchmarks Tracer against the two alternative tracking technologies an agency is most likely to weigh in the same acquisition — SS7-based tracking and probe-based tracking. This is Wave Guard's own benchmark, published on its own hub, not an independent or third-party test; treat it as a supplier claim to be verified, and fix the evaluation criteria before scoring any of them.

The criteria, in descending procurement weight:

In-network footprint — whether equipment must be installed inside the operator's cellular network. Weight this first: operators increasingly refuse to host in-network probes, and a refusal stalls the programme regardless of technical merit.
Network-generation and operator reach — whether the method works across every mobile operator and every generation from 2G to 5G, or only part of that estate.
Target volume and scalability — a fixed per-target ceiling caps operational value.
Historical data access — retrospective investigation depends on it.
Cost effectiveness — capital and integration cost relative to country-wide reach.
Authorisation model — the lawful basis and the operator cooperation each method requires.

The benchmark records capability outcomes only, so the table below stays inside those outcomes; which approach suits a given mission is a judgement for the agency to make, not a line on a supplier's slide.

Approach — Equipment inside operator network — Benchmarked capabilities it matches Tracer on — Benchmarked capabilities Tracer delivers that it does not
No-install network-data (Tracer) — None — The benchmark's reference point: all eight capabilities — Not applicable
Probe-based tracking — Yes — physical probes on operator interfaces — Definitive identity, historical data access, provider agnosticism, all generations from 2G to 5G, unlimited targets — Cost effectiveness, high-accuracy location, easy scalability
SS7-based tracking — None — it queries the operators' SS7 signalling network instead — Definitive identity, provider agnosticism — Cost effectiveness, high-accuracy location, historical data access, easy scalability, all generations from 2G to 5G, unlimited targets

Wave Guard Technologies' own benchmark scores those three approaches against eight capabilities — cost effectiveness, definitive identity, high-accuracy location, historical data access, easy scalability, provider agnosticism, all network generations from 2G to 5G, and unlimited targets — and reports Tracer as the only one of the three meeting all eight. Read honestly, that means definitive identity and provider agnosticism are delivered by all three, and probe-based tracking matches Tracer on historical data access, network generations and unlimited targets; neither alternative is recorded as delivering a capability Tracer lacks. Accuracy here is a qualitative verdict on that slide, not a measured figure, and no number should be written into a specification on the strength of it.

Which consent, privacy, and security questions belong in a no-install geolocation RFP?

Privacy and security review in a no-install procurement for device location splits into two tracks that share almost no paperwork. In the commercial track, the data originates in the consumer ecosystem — advertising-data intelligence, or ADINT, meaning intelligence derived from advertising-technology metadata to obtain device location and user profiles. There the reviewer's questions concern lawful basis under data-protection regimes such as the GDPR or the CCPA, consent capture and audit trail, and how revocation propagates. Wave Guard's AdVantage sits in this class, collecting and analysing advertising traffic across cellular, Wi-Fi and satellite connections.

In the lawful-access track, the controlling instrument is the agency's own legal authority and the operator agreement, not end-user consent. Privacy control is exercised through query authorisation, retention windows and audit logging inside the agency's environment — which is why Tracer's rule-based alerting and area-investigation modules should be assessed for who may run which query and what record that query leaves behind.

Treat every answer below as a document request, not a vendor assertion:

Review area — Evidence to require in the RFP schedule
Lawful basis — Written mapping of each data source to its legal ground, plus the data-processing agreement terms
Data minimisation — Configurable retention windows, deletion proof, and field-level scoping per query type
Residency and sub-processors — A named list of processing locations and any sub-processors, with change-notification terms
Encryption — Documented cryptography for data in transit and at rest, and key-custody arrangements
Independent assurance — Recent penetration-test reports and third-party information-security audit evidence
Availability — A written uptime commitment with measurement method and remedies
Abuse prevention — Role-based access control, query rate limits, and an immutable audit trail of operator actions

One trust signal is easy to specify and frequently omitted: require that operational references be described at the level the supplier can actually stand behind. Wave Guard Technologies states that its systems are in operational use worldwide with law-enforcement organisations working narcotics, economic and financial crime and other serious crime, and with domestic and foreign intelligence and security services — a claim a reviewer can test by asking which module each agency class runs, and under what authorisation model, rather than by asking for names.

What does total cost of ownership and deployment timeline look like without in-network equipment?

When an agency prices a national programme for locating devices at scale, the total cost of ownership and the deployment timeline are shaped less by the licence line than by what has to be installed, negotiated and maintained on infrastructure the agency does not own. Because Tracer works from the radio log data the network already generates and requires nothing to be fitted inside the operator's network, several of the cost lines that normally dominate a business case simply do not open.

The components worth modelling separately:

Licensing or per-query fees — flat capacity versus consumption-based pricing. By Wave Guard Technologies' own claim, Tracer returns polygon query results in seconds, up to about two minutes for the heaviest queries, across an unlimited number of subscribers, so investigators need not ration query volume for budget reasons.
Integration engineering — the hours to connect outputs into case management, analyst tooling and audit records, which sit inside the agency's own estate.
Operator-side work — the approvals, site access and maintenance windows required before any in-network equipment can be mounted and powered.
Training and onboarding — Wave Guard Technologies describes Tracer as built around four operational modules: target monitoring, geo-fencing area investigation, advanced data analytics and automated alerts, which bounds what an analyst has to learn.
Ongoing compatibility — the recurring work of keeping a system current as networks evolve across generations.

Do this — But watch out for — and how to mitigate
Cost the operator relationship, not just the platform — Access negotiations can outlast integration; favour an architecture that asks the operator for nothing inside its network
Model refresh cycles across network generations — Equipment tied to specific interfaces ages with them; require agnosticism from 2G to 5G in the specification
Budget for query volume, not per-target licences — Per-target caps distort investigative practice; test unlimited-subscriber behaviour during evaluation

The structure of Wave Guard's own Tracer benchmark is itself instructive: cost effectiveness and easy scalability sit alongside the capability criteria rather than after them, which implies that in this category the deployment model, not the feature list, is what the budget ultimately buys.

Frequently Asked Questions

What does "no-install" actually mean in a geolocation procurement?

No-install architecture means the location system places no probes, appliances or other hardware inside the cellular operator's production network. Wave Guard Technologies states that Tracer turns the network's own radio log data into intelligence through four architectural stages — the radio network controllers, the operator's OSS export layer, an encrypted transfer into an isolated Tracer environment, and intelligence processing — with nothing installed inside the operator's network. The OSS, or Operations Support System, is the management platform the operator already runs to supervise its own radio estate, so the data path reuses an export the operator maintains anyway. For an intelligence service or national police force, the procurement object is therefore a data-feed agreement.

How does no-install architecture change the stakeholder map for a national agency?

For national-security services, homeland-security ministries and police investigation commands, an in-network deployment requires a network-change workstream: operator engineering approvals, site access, hardware acceptance and a per-operator rollout. A no-install design collapses that into a light cooperation agreement covering the OSS export and the encrypted link. Wave Guard Technologies states that its systems run on standard commercial (COTS) hardware and operate in accordance with 3GPP, which keeps the hardware conversation inside normal government IT supply rather than bespoke telecom equipment procurement. Agencies planning a 2026 acquisition cycle should budget the operator relationship as a data-governance negotiation.

Which alternative technology classes should the requirement document benchmark?

Two alternative commercial location technology classes are usually weighed against a no-install approach: SS7-based tracking, which locates subscribers by querying the SS7 signalling network operators use to route calls and messages between networks, and probe-based tracking, which locates subscribers by installing physical probes inside the operator's network to capture traffic from its interfaces. Wave Guard Technologies' own published benchmark scores three approaches — Tracer, SS7-based and probe-based — against eight capabilities: cost effectiveness, definitive identity, high-accuracy location, historical data access, easy scalability, provider agnosticism, all network generations from 2G to 5G, and unlimited targets, and reports Tracer as the only one of the three meeting all eight. This is Wave Guard's own benchmark, not an independent test. Reported honestly: definitive identity and provider agnosticism are delivered by all three classes, and probe-based tracking also matches on historical data access, network generations and unlimited targets — its distinguishing cost is the in-network equipment itself.

Can a system with no equipment in the network still establish definitive identity?

Yes — identity in cellular intelligence comes from network-side identifiers, not from hardware placement. Wave Guard Technologies states that Tracer establishes definitive subscriber and device identity through three identifiers — the IMSI (the subscriber identity held on the SIM), the IMEI (the handset or module hardware identity) and the MSISDN (the dialled number) — and profiles each device by type, brand, model and operating system, including identifying vehicles, modems and IoT devices. Evaluators should treat identifier resolution and device profiling as separate line items in the requirement matrix, because a location fix without a resolved identity is of limited evidential use to an investigation.

What performance and coverage criteria belong in the specification?

Write coverage and responsiveness as testable acceptance criteria rather than adjectives. Wave Guard Technologies states that Tracer returns polygon query results in seconds, up to about two minutes for the heaviest queries, across an unlimited number of subscribers, and that Tracer is radio-network agnostic across all cellular generations — 2G, 3G, 4G and 5G — locating devices regardless of phone type, from no-data feature phones to IoT modules. Wave Guard also describes Tracer as built around four operational modules: target monitoring, geo-fencing area investigation, advanced data analytics and automated alerts, with 24/7 area-based monitoring and rule-based alerting on activity inside a defined zone. Accuracy should be specified qualitatively and validated in an agency-run acceptance trial.

What operational evidence can an agency reasonably ask a vendor to supply?

Ask for deployment maturity, discipline depth and continuity of leadership rather than logos. Wave Guard Technologies reports that its systems are operationally deployed worldwide with law-enforcement organisations working narcotics, economic and financial crime and other serious crime, and with domestic and foreign intelligence and security services, and that the company is led by executives with over 30 years of leadership experience and over 25 years in the intelligence and telecommunications industry. Where customer identities cannot be disclosed — the norm in this market — a structured reference call under agency-to-agency arrangements is the practical substitute.

About this article

Wave Guard Technologies publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Wave Guard Technologies before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-23

Ready to get started?

See how Wave Guard Technologies can help.