Investigating Location-Tracking Surveillance Systems

Last year, at a secretive European trade fair, an executive from a little-known surveillance company thought he was selling the latest phone tracking software to a representative from a mining company in West Africa. In fact, the person being briefed on the astonishing, people-locating power of the Altamides phone tracking tool was an undercover journalist from Lighthouse Reports, fitted with a hidden camera.

Combined with a vast trove of data dug up by a newsroom colleague, Gabriel Geiger, and the sleuthing work of 13 partner newsrooms, that fake sales meeting was the final element in a blockbuster collaborative investigation that revealed surveillance on thousands of individuals, and the chilling threat posed by lesser-known players in the world’s booming spyware marketplace.

In a panel presentation at the recent NICAR26 data journalism summit, Geiger explained that this rare undercover tactic was necessary because “the public and journalists are strictly forbidden from entering” the world’s premier surveillance fair: ISS World, in Prague, Czechoslovakia. Also, “to better understand what red lines the company placed around the use of its products.”

The story echoed a warning given by The Citizen Lab founder Ron Deibert in his keynote address at the 13th Global Investigative Journalism Conference: “The ‘new normal’ is mercenary surveillance firms, that are almost entirely unregulated, selling to the world’s worst sociopaths” — adding that numerous democratic governments were also enthusiastic clients of these spy firms. This industry, Deibert noted, ranged from major espionage companies — often staffed by former state intelligence agency operatives — to tiny “hacking-for-hire” startups.

While the major surveillance firms such as NSO Group — makers of the near-unstoppable Pegasus “zero-click” spyware — attract a lot of media attention, Geiger emphasized that smaller firms now also command formidable phone and cyber surveillance tools, and that they are securing major contracts with government agencies around the globe.

“A lot of people focused on the top-tier surveillance players, and these other guys have gone under-scrutinized, even though their tech is cheaper, and therefore easier to scale,” Geiger explained. “Altamides is software capable of tracking any phone anywhere on the planet, in seconds; you just type in a phone number and you can see where it is.”

He added: “What brought us to that conference was a large dataset I found on the deep web via an undocumented API, and this dataset contained 1.5 million attempts to track people in the world using that software; and targeted 15,000 phone numbers in almost every country.”

He said his reporting team found surveillance targets in the data that ranged from the founder of the private military contractor Blackwater and an executive with genomics firm 23andMe to a Hollywood actor and an Italian journalist. The latter, Geiger found, was targeted during his research into corruption in the Vatican.

In response to this reporting, the company that sells Altamides denied “any illegal activities” or “human rights violations.” It further added that it does not conduct any tracking itself and that it has no knowledge of or control over how Altamides is used once its clients purchase the tool.

The Lighthouse Reports investigation into phone tracking software, with partner newsrooms listed. Image: Screenshot, Lighthouse Reports

The NICAR session also featured Andrew Couts, senior editor for security and investigations at Wired, and Aaron Sankin, data editor at The Marshall Project, who discussed surveillance threats posed by app location data and third-party website tools, respectively. Beryl Lipton, senior investigative researcher at the Electronic Frontier Foundation, joined the panel to showcase updated resources for street-level surveillance.

Geiger said that phone location products have been developed, generally, around an understanding among surveillance entrepreneurs that our phones are constantly in touch with telecom networks. These networks, he added, use “really antiquated protocols from the eighties — and that these protocols can be exploited to trick telephone networks into revealing the locations of their users.” The latest versions can even breach encrypted platforms, such as WhatsApp.

However, these same systems also offer investigative reporters an opportunity to obtain the data they need to expose illicit surveillance and harmful procurement.

“That’s because a telecom network is a relatively closed-loop system, and these malicious signaling requests move through a number of intermediaries, and all of that activity is logged, leaving an extensive data trail,” he explained. “A relatively broad range of people have insight into phone network traffic.”

As a result, datasets can be obtained by cultivating relationships within the sector, particularly with people who have helped build firewalls meant to protect networks against malicious requests, or former security officials who worked to protect domestic networks from foreign surveillance.

This reflected a major theme of the session — that reporters should not be dissuaded by the technical and secretive reputation of surveillance firms, and can investigate them like any other potential source of harm.

“People tend to describe surveillance companies and government organizations [that contract with them] as ‘shadowy,’” Sankin said. “But I want you to banish that word from your mind. These are real organizations with real offices; they have plumbers that come in, and if you track the things that go in and out of these organizations, it will tell you a lot.”

Location Data for Sale from the Online Ad Ecosystem

Meanwhile, Couts explained how personal data — including detailed location data points — collected by smartphone apps can simply be purchased, or obtained as free samples, by anyone, for both legitimate and illicit surveillance. Also, reporters can obtain this same data, which is generally sold for targeted advertising, to identify abusive surveillance and unwitting victims. Indeed, some reporters who have made undercover requests from one data broker found alarming, unsolicited dataset samples flooding in from others hoping to secure a new client.

Wired’s collaborative investigation into security breaches from unregulated advertising data sales. Image: Screenshot, Wired

One example of this happened in 2024, when Bayerischer Rundfunk (BR), and Netzpolitik.org in Germany obtained a database of 3.6 billion data points — location coordinates, precise times, and advertising IDs from smartphone apps — which could be used to track the movements of millions of people in the country. A US data broker had been happy to hand over the data as a free sample.

BR then used the data to reveal a flaw in security procedures at highly sensitive agency buildings in Germany, where supposedly secret employees must hand their phones in at the entrance — because the easily-available data showed all of their phones arriving in those parking lots every morning.

A subsequent Wired collaboration with BR and Netzpolitik revealed astonishing security risks posed by the unregulated sale of this app data, showing how it could track the daily movements of military and intelligence personnel in Germany, everywhere from their children’s schools to nuclear storage facilities.

“Ad data can also be used for clandestine operations,” said Couts, echoing BR’s warning that “location data can be a gateway for espionage.” Referring to the journalistic use of app-generated phone location data, he warned that — while detailed — it is also extremely unreliable. “This needs careful verification, but it is a good starting point for further legwork.”

Courts pointed to useful databases for tracking location surveillance procurement, which include the System for Award Management (SAM.gov); USAspending; and GovSpend.

Lipton noted that the Electronic Frontier Foundation’s surveillance hub resource includes detailed explainers of how street-level surveillance technologies work around the world, from license plate readers and automated facial recognition systems to cell site simulators and gunshot detection systems. The EFF’s Atlas of Surveillance tool is a searchable database of how, and where, US law enforcement agencies actually deploy these technologies, and its new Journalist’s Guide to Covering Police Technology equips reporters with information with which to challenge new public spending, and claims made by suppliers and agencies about the effectiveness and fairness of these tools.

Rowan Philp is GIJN’s global reporter and impact editor. He was formerly chief reporter for South Africa’s Sunday Times. As a foreign correspondent, he has reported on news, politics, corruption, and conflict from more than two dozen countries around the world.