Lighthouse Reports exposed First Wap using leaked tracking data and a fake-buyer sting

First Wap, a Jakarta-based phone-tracking firm run by European executives, has sold surveillance software for two decades. Its Altamides tool exploits SS7, a decades-old telecom protocol, to pinpoint any phone number in the world within seconds — no trace left on the device — and can also intercept messages and breach encrypted apps. Clients reached it through shadowy middlemen, and the surveillance industry's standing line was that such tools went only to governments fighting serious crime, with misuse a rare exception.

Lighthouse Reports had no easy way to test that claim. Altamides leaves no forensic trace on a victim's phone, victims rarely know they were tracked, and the vendor could simply deny abuse. Standard spyware-expose playbooks such as device forensics did not apply to a network-level firm that had spent twenty years below the spotlight.

In spring 2024 a Lighthouse reporter found a leaked archive on the deep web: 1.5 million rows of tracking operations, more than 14,000 phone numbers, targets in over 160 countries. More than ten reporters ran the numbers through OSINT tools, accepting an identification only when several independent datapoints matched, and named over 1,500 high-confidence targets. Clustering targets connected in time and space exposed coordinated abuse: Rwandan opposition figures tracked minutes apart, Nigerian election officials followed before a 2011 vote, a Vatican corruption journalist polled every hour.

Reporters then built fake identities — a South African 'research consultancy' in the British Virgin Islands — and met First Wap's sales director at ISS World in Prague in June 2025, pitching what the company publicly ruled out: monitoring opponents abroad, cracking WhatsApp, surveilling environmental protesters for a sanctioned mining magnate. On hidden camera the salesman said the deal would go through Jakarta with a shell company masking the paper trail: 'we can find a way.' Published in October 2025 by 70+ journalists across 14 outlets, the findings let each partner localize the archive.

Posed as buyers at a spy-tech fair so the vendor's own salesman admitted sanctions evasion on camera

The archive was a system of record: 1.5 million rows of operations from the vendor's own systems, so the findings did not rest on any informant's word.

Demanding several independent datapoints per identification turned 14,000 anonymous numbers into more than 1,500 named targets, and clustering in time and space exposed coordinated abuse.

The undercover buy entered the vendor's own sales floor, where its staff volunteered how they would dodge sanctions — directly contradicting the company's public claim that it vets every client.

Co-publishing across 14 outlets turned one archive into dozens of local stories, each with a local newsroom to pursue the trails at home.

When a vendor's claims resist outside verification, become a fake buyer, film its staff's admissions, and build the story on the accused's own records.

The investigation ran on 14 Oct 2025, co-published by 14 outlets including Der Spiegel, Le Monde, NRK. First Wap denied any illegal activity or human-rights violations, called the Prague statements 'misunderstandings' about technical feasibility, and repeated that its tools serve law enforcement. Telecom Liechtenstein said it suspended its business relationship with First Wap. Partners kept reporting local threads — Red Bull executives in Austria, a former Telenor executive in Norway — while the archive stands as the fullest public record of a network-level phone-tracking firm's operations.