How First Wap Tracks Phones Around the World

Summary

In the spring of 2024, Lighthouse found a vast archive of data on the deep web. It contained thousands of phone numbers and hundreds of thousands of locations from nearly every country in the world. The data came from a little-known surveillance company called First Wap. Headquartered in Jakarta but run by a group of European executives, First Wap has quietly built a phone tracking empire spanning the globe. There have been leaks of telecom network targeting data in the past (some of which Lighthouse has written about). But none of them has included this amount of successful targeting of individual phone numbers. The archive was a starting point for Surveillance Secrets, a collaboration between Lighthouse Reports, paper trail media and 12 other partners that lifts the lid on First Wap’s activities. The team found material inside the archive for dozens of stories, including how the company’s tracking tech was used against Rwandan dissidents targeted in an assassination campaign, a journalist investigating corruption in the Vatican, and a businessman being investigated for compromising material. Getting to those stories took months of analyzing 1.5 million rows of obscure telecom data. Unlike top-tier spyware firms, such as the notorious NSO Group, phone-tracking firms like First Wap have flown under the radar. Standard tools used in spyware investigations — such as device forensics — were unavailable to us; there was no blueprint examining a firm such as First Wap. In this technical explainer, we explain how we approached the data to understand the company’s operations. The Surveillance Pyramid We sometimes think of the surveillance industry as a pyramid. At the top are the elite spyware companies, selling expensive, highly targeted and invasive tools like NSO Group’s Pegasus or Intellexa’s Predator. At the bottom sit the preliminary tools that help enable surveillance operations: OSINT and social media scraping tools to develop profiles of targets, internet infrastr...