How First Wap Tracks Phones Around the World

In an article for Lighthouse Reports, Gabriel Geiger, Crofton Black, Riccardo Coluccini, Bashar Deeb, Elena de Bre, Sabrina Slipchenko, Sarasvati Thuppadolla, Christo Buschek, Maria Retter, Lea Hruschka, Hannes Munzinger, Elisa Simantke, Bastian Obermayer, and Omer Benjakob investigate a vast archive of data on the deep web, from a surveillance company called First Wap. Investigation shows how phone network collections can be leveraged to allow tracking all over the world, without authorization from the targeted networks.

In the spring of 2024, Lighthouse found a vast archive of data on the deep web. It contained thousands of phone numbers and hundreds of thousands of locations from nearly every country in the world.

The data came from a little-known surveillance company called First Wap. Headquartered in Jakarta but run by a group of European executives, First Wap has quietly built a phone tracking empire spanning the globe.

There have been leaks of telecom network targeting data in the past (some of which Lighthouse has written about). But none of them has included this amount of successful targeting of individual phone numbers.

The archive was a starting point for Surveillance Secrets, a collaboration between Lighthouse Reports, paper trail media and 12 other partners that lifts the lid on First Wap’s activities. The team found material inside the archive for dozens of stories, including how the company’s tracking tech was used against Rwandan dissidents targeted in an assassination campaign, a journalist investigating corruption in the Vatican, and a businessman being investigated for compromising material.

Getting to those stories took months of analyzing 1.5 million rows of obscure telecom data. Unlike top-tier spyware firms, such as the notorious NSO Group, phone-tracking firms like First Wap have flown under the radar. Standard tools used in spyware investigations — such as device forensics — were unavailable to us; there was no blueprint examining a firm such as First Wap. In this technical explainer, we explain how we approached the data to understand the company’s operations.