At present digital privacy hangs by a thread, so the revelation of First Wap's operations has sent shockwaves through the cybersecurity and human rights communities. This Indonesian-based company, shrouded in secrecy for over two decades, has built an empire on exploiting vulnerabilities in global telecom networks. Their flagship tool, Altamides, enables traceless phone tracking on a massive scale, raising profound questions about ethics, legality, and the unchecked proliferation of surveillance tech. Drawing from a landmark investigation by Lighthouse Reports and partners like Mother Jones, this deep dive explores First Wap's origins, technology, clientele, and the far-reaching implications of their activities.
First Wap was founded in 1999 by Austrian engineer Josef Fuchs, who immigrated to Indonesia in the 1990s after working for Siemens. Initially focused on wireless application protocol (WAP) for mobile messaging, the company pivoted to surveillance around the early 2000s at the request of an unspecified law enforcement agency seeking counterterrorism tools. Operating from Jakarta, where lax export regulations allow such businesses to thrive, First Wap transformed into a "global phone-tracking laboratory." Fuchs, who passed away in 2024, led the firm until recently, with executives like sales director Guenther Rudolph and current owner Jonny Goebel continuing its legacy.
The company's website, captured in investigative reports, markets Altamides as a solution for governments, telecom operators, and enterprises, emphasising "empowering mobility" while downplaying its invasive capabilities. Unlike high-profile firms like NSO Group, First Wap has avoided scrutiny by staying under the radar, eschewing flashy marketing and focusing on discreet sales through resellers.
At the core of First Wap's prowess is Altamides, an acronym for "Advanced Location Tracking and Mobile Information and Deception System." This platform leverages Signalling System No. 7 (SS7), an antiquated telecom protocol from the 1970s used for routing calls and texts worldwide. By sending queries through leased global titles (GTs) from operators like Telecom Liechtenstein, Altamides pinpoints a phone's location via nearby cell towers without infecting the device or leaving traces, no overheating, no battery drain, no malicious links required.
Over time, Altamides evolved beyond mere geolocation. It now intercepts calls, SMS (including two-factor authentication codes), and even penetrates encrypted apps like WhatsApp by cracking verification processes. Promotional materials describe it as a "unified platform" for monitoring suspects, detecting patterns, and analysing movements, ideal for law enforcement but ripe for abuse. Industry insiders note First Wap was pioneering in SS7 exploitation, predating Snowden's revelations and outpacing competitors by offering global, real-time access from anywhere.
A leaked archive of over a million tracking instances from 2007-2014, obtained by Lighthouse Reports, reveals operations in 100 countries, including extensive US surveillance, typically a red line for the industry. Telecom Liechtenstein suspended ties with First Wap post-exposure, denying knowledge of misuse.
First Wap claims to sell only to vetted government entities with legal mandates, denying involvement in tracking post-installation. However, documents and former employees paint a different picture: no "red lines" on clients, with sales to repressive regimes like Belarus, Saudi Arabia, UAE, Nigeria, Malaysia, Singapore, Uzbekistan, Syria, Algeria, and Morocco. Resellers like UK's KCS Group pitched Altamides during upheavals like the Arab Spring, targeting Bahrain and Thailand's military junta.
Undercover interactions at the 2025 ISS World conference in Prague exposed executives' willingness to circumvent sanctions via shell companies in South Africa or the British Virgin Islands. Rudolph boasted of dumping high-value deals to avoid "bad marketing" like competitors, while offering solutions for tracking activists disrupting mining operations. Prices range from $1 million to $20 million, depending on features.
Amnesty International has condemned such firms for exploiting weak regulations, calling for stricter export controls.
The archive unmasks a web of surveillance:
Journalists and Dissidents: Italian reporter Gianluigi Nuzzi was tracked over 200 times during the 2012 Vatileaks scandal, coinciding with Vatican police actions. Rwandan dissident Patrick Karegeya's entourage was monitored before his 2014 assassination.
US Targets: Despite industry taboos, thousands of operations hit Americans, including 23andMe's Anne Wojcicki (tracked 1,000+ times), Google engineers, Blackwater's Erik Prince, and actor Jared Leto. Sen. Ron Wyden decried telecom vulnerabilities.
Private Misuse: Altamides infiltrated corporate espionage, tracking Eni's Roberto Casula and investor Alessandro Benedetti. A personal case involved a Russian woman stalked by her driving instructor, linked to a Pakistani defence firm.
Other victims: Qatar's ex-PM, Syria's Asma al-Assad, and ordinary citizens like a Hawaiian coach.
Citizen Lab's Ron Deibert labels this "despotism as a service," enabling authoritarians to undermine democracy. Unlike sanctioned spyware like Pegasus, Altamides' SS7 approach evades patches and scrutiny, highlighting telecom flaws. Experts call for SS7 migration to secure protocols like Diameter in 5G networks.
First Wap denies wrongdoing, emphasising client confidentiality and compliance. Yet, the investigation underscores the need for global regulations, as small firms like this fill gaps left by crackdowns on bigger players.
As of October 2025, First Wap remains active, upgrading Altamides amid growing calls for accountability. This exposé not only maps a hidden empire but warns of a surveillance landscape where privacy is increasingly illusory. Until recently we did not know about any of this, either. It makes one speculate just what other surveillance operations are undergoing.