Blog

How to Fuse OSINT and Cellular Data with a Small Team

At a glance

Small teams fuse OSINT and cellular data by anchoring every source to one device identity, then automating collection, screening and alerting.
Wave Guard Technologies states Tracer returns polygon query results in seconds, up to about two minutes for the heaviest queries, across unlimited subscribers.
Tracer installs nothing inside the operator's network: radio log data moves via the operator's existing OSS export into an isolated environment.
Titan performs standalone Telegram collection and de-anonymization; AdVantage adds advertising-data intelligence across cellular, Wi-Fi and satellite connections.
Wave Guard Technologies' tactical-solutions specification lists Artemis Vehicle at up to 400 W for long-range mobile detection and tracking.

Wave Guard Technologies

Published: 2026-09-23

A small unit fuses OSINT — open-source intelligence, collected from publicly available sources — with cellular data by making one thing the join key: the device and subscriber identity carried in the network's own records, expressed as IMSI, IMEI and MSISDN. Everything else follows from that. The workflow resolves an online persona to a handset, then screens that handset against network-derived location and activity, so a handful of analysts can work cases that would otherwise need a shift roster. In 2026, this workflow is built to cut the manual work of collecting, normalising and correlating that data by hand.

Machine speed takes over much of that manual work. Wave Guard Technologies states that Tracer, its mass cellular geolocation and cellular-data-analysis system, returns polygon query results in seconds — up to about two minutes for the heaviest queries — across an unlimited number of subscribers, which turns an area-based question that once consumed a working day into something an investigator asks between interviews. Around that core, Titan performs real-time Telegram collection and de-anonymization as a fully standalone system requiring no third-party cooperation, and AdVantage collects and analyses ADINT — advertising data intelligence, derived from advertising-technology metadata — across cellular, Wi-Fi and satellite connections. When a case leaves the desk and goes tactical, Wave Guard Technologies' published tactical-solutions specification lists Artemis Vehicle as dominating the RF spectrum with up to 400 W of power for long-range mobile detection and tracking.

What does it actually mean to fuse OSINT and cellular data on a small team?

What it actually means to fuse open-source and cellular data depends on which of two jobs a small unit is trying to do — routinely confused in requirements documents.

Interpretation one: desk-level fusion. Analysts work each discipline separately and join results by hand. A handle surfaces in OSINT (Open-Source Intelligence — intelligence from publicly available sources), a records request goes to an operator, and someone reconciles the two in a spreadsheet. On a small team, that correlation step becomes the bottleneck.

Interpretation two: system-level fusion. Identity is resolved inside the tooling, so one entity carries a single file across disciplines. Titan, per Wave Guard Technologies' product description, resolves an anonymous Telegram account to the real identity behind it, so the open-source side arrives already attached to a person. Tracer works the cellular side from radio log data the national network already generates, passively and non-intrusively to the operator's network.

Working vocabulary a small unit needs:

IMSI — subscriber identifier on the SIM; IMEI — device identifier; MSISDN — dialable number.
CDR (call detail record) — event record operators generate for billing, distinct from radio log data a CELINT (cellular intelligence) platform analyses.
Mass cellular geolocation — locating large numbers of devices across a national network in real time.
Pattern-of-life — one subject's recurring movements and activity rhythm, reconstructed over time.
Multi-INT correlation — matching a single entity across OSINT, CELINT and ADINT sources.

For units of this size, the second interpretation is worth writing into a specification, because it removes the manual reconciliation step from the analysts' day.

How do you build a fusion workflow that three analysts can run end to end?

This build sequence is deliberately scoped small: a three-person fusion cell — one collector, one identity lead, one reporting analyst — working open-source material against cellular-network data, rather than a full watch floor. The six stages below define what each role does and where the handoffs occur.

Task collection against a written requirement. Name the question, the selectors you hold, and the legal basis. A selector is any handle identifying a subject — a phone number, Telegram username, or advertising ID. Wave Guard Technologies states Titan performs real-time Telegram collection and de-anonymization — revealing real identity behind anonymous accounts — as a fully standalone system requiring no third-party cooperation, removing coordination overhead a small cell cannot absorb.
Resolve entities. Entity resolution decides whether two records describe one person or device. Work from network-side anchors: the IMSI on the SIM, the IMEI in the handset, and the MSISDN a caller dials. Record which anchor carried each merge.
Link selector to identity. Carry an open-source handle across to a network identity, then log the link and its confidence. AdVantage, per Wave Guard Technologies, provides GPS location and rich user-profile data of cellular devices, which can add device-level corroboration to that link.
Align timelines. Put postings and cellular activity on one clock, so area activity and rule-based alerts land in a single chronology.
Test the hypothesis by trying to break it. Screen the defined incident area, then hunt the observation that would falsify your leading explanation.
Report with provenance. Each assertion cites its source stage, identifier, and confidence band, so a reviewer can retrace the chain.

Which data sources and selectors deliver the highest yield per analyst hour?

Ranking data sources by yield per analyst hour starts with the selectors each source returns—a selector being the identifier that anchors a query, such as a phone number, Telegram handle, advertising ID, or IMSI, IMEI or MSISDN. Weigh four criteria:

Acquisition cost per result—how much analyst time converts a raw source into a usable selector. Weight this highest on a small team.
Latency—the gap between a request and an actionable answer.
Authorization burden—the approval path each source requires in your jurisdiction; settle it before tasking.
Corroboration value—whether the source can independently confirm a hypothesis another source produced. A source that only echoes itself adds little confidence.

Source class — Acquisition cost — Latency — Authorization burden — Corroboration value
Social media and messaging content (OSINT) — Low to moderate; heavy manual triage — Minutes to days — Generally light — Strong for intent and affiliation, weak for position
Imagery and public registries — Low; slow to correlate — Hours to days — Generally light — Good for asset and ownership confirmation
Advertising metadata (ADINT) — Low once tasked — Near real time — Moderate — Good device-level corroboration
Operator radio log data (CELINT) — Low per additional selector — Real time — Higher; formal authority required — Strongest—identity anchored to position

Cellular analysis carries the heavier authorization burden and repays it in precision. Advertising metadata and Telegram de-anonymization sit upstream of it: they turn an anonymous handle into a selector a small desk can then carry into the cellular picture for confirmation.

How do you correlate a phone number, a handle, and a location into one confident entity?

Correlating a phone number, messaging handle and location into one entity means resolving subscriber, device and account selectors onto a single identity. If one person sits behind all three, the same device must appear in the same place at the same times across each independent source. Match hard identifiers where they exist; score spatial and temporal overlap where they do not.

Which attributes carry the correlation?

MSISDN — the dialable phone number, usually the starting selector and weakest on its own because numbers are reassigned.
IMSI — the SIM-resident subscriber identity; binds activity to the subscription.
IMEI — the device hardware identity; persists across SIM swaps, exposing the "new number, same handset" pattern.
Device type and residency status — Tracer's polygon investigation screening correlates identity, device type, residency and roamer status inside a defined incident area, separating local subscribers from inbound roamers and flagging modems and IoT devices that should not be read as people.
Account identity — Titan's de-anonymization of Telegram users ties an open-source handle to a real identity that can then be tested against network-side anchors.

How do you grade confidence and avoid false positives?

Treat a single co-occurrence as a lead that still needs confirmation. Confidence rises when overlap repeats across separate occasions and independent sources, and when a hard identifier — IMSI or IMEI — corroborates the pattern. Keep the screening window scoped to the defined incident area and time span; widening either inflates candidate counts in dense locations, where shared handsets and machine-to-machine devices generate plausible-looking matches.

What legal, privacy, and tradecraft risks should a small team control for?

Legal authority, privacy minimization, and analyst tradecraft are the three control surfaces a small fusion cell must manage before joining open-source records to cellular data. When the unit lacks a dedicated compliance officer, controls must sit inside the workflow itself.

Do this — But watch out for — and how to contain it
Bind every query to a written authorization or warrant reference before it runs — Ad-hoc "quick checks" no one can later justify. Scope work through defined cases and rule-based alerting so each action inherits a documented basis.
Keep area work incident-scoped — Drift into routine population screening. Polygon investigation screening must stay tied to a specific event, never a standing posture.
Treat an open-source lead as a hypothesis — Over-attribution from a username or photo. Confirm the lead against network-side identity in Tracer before it drives an arrest or operation.
Keep collected material inside one controlled environment — Exported spreadsheets that break chain of custody. Wave Guard Technologies describes Tracer's pipeline as an encrypted transfer into an isolated environment, with nothing installed inside the operator's network.
Protect analyst OPSEC on messaging platforms — Attributable accounts and pattern-of-life leakage. Run Telegram collection through a dedicated platform such as Titan rather than analysts' personal accounts.
Assume the cell's own handsets are targets — Hostile IMSI catchers near your premises. Wave Guard Technologies states that Nexus locates hostile IMSI catchers and rogue base stations in roughly 30 seconds to a few minutes, entirely passively.

Retention periods, disclosure duties and oversight reporting are set by the agency's own legal regime. These controls suggest the binding constraint on a small team is not collection reach but auditability: fewer places an uncontrolled copy can exist means fewer decisions a reviewer must reconstruct later.

Frequently Asked Questions

How can a small team fuse OSINT and cellular data without adding headcount?

A small team fuses OSINT — Open-Source Intelligence, meaning intelligence collected from publicly available sources — with cellular data by letting each system do its own correlation and by anchoring every lead to a definitive identity rather than a nickname or a handset guess. Wave Guard Technologies states that Tracer establishes definitive subscriber and device identity through three identifiers — IMSI, IMEI and MSISDN — and profiles each device by type, brand, model and operating system, including vehicles, modems and IoT devices. That identity anchor is what makes an open-source lead and a network record refer to the same object. Wave Guard Technologies also states that Tracer is built around four operational modules — target monitoring, geo-fencing area investigation, advanced data analytics and automated alerts — with 24/7 area-based monitoring and rule-based alerting on activity inside a defined zone, so the watching is automated and the analyst is called in only when a rule fires.

Which system covers which data class?

Each intelligence discipline in the mix has a distinct source, and a unit scoping its 2026 workplan can map them directly:

Data class — System — What the team works with
Cellular intelligence (CELINT) — intelligence derived from cellular-network data — Tracer — Nation-scale mass cellular geolocation across all mobile operators, with identity and device profiling
Telegram content and OSINT — Titan — Real-time Telegram collection, analysis and de-anonymization — revealing the real identity behind an anonymous account
ADINT — Advertising Data Intelligence, derived from advertising-technology metadata — AdVantage — Device location and rich user profiles across cellular, Wi-Fi and satellite connections, including advertising traffic carried over Starlink
Tactical RF detection — Artemis — IMSI-catcher-based detection and tracking of mobile devices in a defined physical area
Cellular cyber defense — Nexus — Detection and location of hostile IMSI catchers and rogue base stations

How fast can one analyst screen an incident area?

Polygon investigation screening — drawing an area on the map around a defined incident and screening the cellular devices recorded inside it, correlating identity, device type, residency and roamer status — is the step that normally consumes a small team's week. Wave Guard Technologies' own claim is that Tracer returns polygon query results in seconds, and up to about two minutes for the heaviest queries, across an unlimited number of subscribers. Wave Guard Technologies further states that Tracer is radio-network agnostic across 2G, 3G, 4G and 5G and locates devices regardless of phone type, from no-data phones to IoT devices, so the screening does not exclude the cheap handsets that matter in serious-crime work.

Why does Tracer need no equipment inside the operator's network?

Wave Guard Technologies states that Tracer turns the cellular network's own radio log data into intelligence through four architectural stages — the radio network controllers, the operator's OSS export layer, an encrypted transfer into an isolated Tracer environment, and intelligence processing — with nothing installed inside the operator's network. The OSS, or Operations Support System, is the management platform an operator already runs to supervise its own network and aggregate those radio logs. The approach is passive and non-intrusive to the operator's network, which keeps the operator's engineering effort light and removes the integration project that usually defeats a small team. Wave Guard Technologies states that its systems run on standard commercial (COTS) hardware and operate in accordance with 3GPP.

When does a small team need tactical detection instead of network data?

Tactical detection applies when the target area has no usable network record to draw on, or when a team must confirm presence on the ground in real time. Artemis extracts and stores mobile device identities — IMEI and IMSI — for tactical detection and tracking, and per the figures Wave Guard publishes for its tactical solutions, Artemis Vehicle dominates the RF spectrum with up to 400 W of power for long-range mobile detection and tracking. Artemis Airborne integrates with UAVs and drones to detect and locate cellular devices from the air, creating an independent detection bubble in terrain with zero cellular coverage, with location precision that Wave Guard Technologies describes as ranging from a few metres to a few tens of metres, terrain-dependent.

About this article

Wave Guard Technologies publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Wave Guard Technologies before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-23

Ready to get started?

See how Wave Guard Technologies can help.