What do you do when a company quietly assembles a system that can pinpoint a person’s phone anywhere on earth, and the legal fences meant to keep that power in check have gaps as wide as a country’s coastline? That is the unsettling dilemma raised by recent reporting on First Wap, a surveillance firm whose Altamides platform promises real‑time location tracking, movement‑pattern detection, and proximity analysis — capabilities with clear public‑safety uses and equally clear potential for abuse.
First Wap’s story, as reconstructed by investigative reporting, illustrates a recurring pattern in the global surveillance market: sophisticated capabilities developed by private vendors, marketed to states and other buyers, and routed through jurisdictions with lax export or regulatory controls to avoid scrutiny. Investigations tracing similar companies and products show how permissive legal environments and corporate opacity let surveillance technologies proliferate beyond the narrow law‑enforcement use cases the vendors advertise. Independent research and reporting have repeatedly documented this dynamic, warning that it weakens checks on who gets to surveil—and how broadly they can do it—when oversight is weak or inconsistent across borders.
Background: technology, markets, and loopholes
The modern surveillance ecosystem melds high‑end software, telephony metadata, and sometimes direct access to carrier systems to provide near‑continuous tracking and data extraction from personal devices. Commercial vendors position these products as tools for tackling serious crime and terrorism, but the same primitives—location, contacts, movement patterns—are precisely the data that can silence critics, identify journalists’ sources, or map political networks when misused. Security researchers and civil‑society groups have documented examples where such tools were deployed against activists, reporters, and political opponents rather than in narrowly targeted criminal investigations. These findings underscore that the commercial market for surveillanceware is as much a regulatory problem as a technical one.
Why Jakarta — and similar permissive jurisdictions — matter
When a firm operates from a jurisdiction with permissive export rules or weak enforcement, vendors can route sales and contracts through those bases to reach buyers that would trigger controls elsewhere. This routing can defeat export‑control regimes and corporate compliance processes that would otherwise limit sales to repressive actors. Investigations into the market show that companies use corporate structures and geographic dispersion to obscure end users and to evade restrictions, effectively creating an international grey market for intrusive tools. The result is a surveillance supply chain that is hard to police, slow to hold accountable, and fast to evolve.
The product: Altamides and capabilities that cut both ways
According to promotional materials and reporting, First Wap’s Altamides platform markets features such as:
- Real‑time location of single or multiple targets;
- Detection of movement patterns and habitual locations;
- Proximity analysis to determine whether suspects are near one another.
Those functions can be invaluable in a lawful, narrowly scoped investigation: finding a kidnapped person, tracking a violent criminal, or supporting cross‑border cooperation in complex cases. Yet the same functionality also enables mass or targeted tracking without transparent oversight—turning a policing tool into an instrument of political control if in the wrong hands. Independent scrutiny of comparable products has shown how quickly capabilities can be repurposed when safeguards are absent.
Current situation: proliferation despite scrutiny
Regulatory responses have been uneven. Some countries have tightened export controls and imposed sanctions on vendors linked to abuses, while international norms and enforcement mechanisms lag behind the technology’s pace. Civil‑society groups and academic labs have filled part of the accountability gap by publishing forensic analyses and attribution work, but industry secrecy, commercial confidentiality, and complex corporate chains hamper systematic oversight. In effect, the marketplace for surveillance tools continues to expand even as public exposure of abuses increases.
Why it matters—multiple perspectives
Technologists: Security researchers emphasize that these systems exploit vulnerabilities and trust relationships in telecommunications infrastructure; they argue for transparency, independent audits, and rapid disclosure to patchable vendors. They warn of a “dual‑use” danger: the same flaws exploited for lawful interception can be weaponized by criminal groups or leaked, widening the attack surface for everyone.
Policymakers: Regulators face difficult tradeoffs. Restricting exports and tightening procurement rules can curb misuse, but overbroad bans can also impede legitimate law‑enforcement cooperation and innovation in defensive tools. Effective policy requires precise definitions of permissible use, mandatory audit trails, judicial oversight for sensitive deployments, and international cooperation to prevent regulatory arbitrage.
Users and victims: For people targeted by misuse, the harms are immediate and personal—loss of privacy, chilling of free expression, physical danger if surveillance data is paired with coercive power. Remedies are slow, costly, and often unavailable across borders, placing the burden on researchers and journalists to document abuses and on courts to adjudicate harms after the fact.
Adversaries and opportunists: The existence of commodified surveillance tools lowers the bar for state and non‑state actors alike. If offensive capabilities proliferate, so does the risk that they will be repurposed—by hostile states, criminal syndicates, or opportunistic insiders. That dynamic amplifies systemic risk in cyberspace and in democratic institutions.
What can be done?
- Strengthen export controls and close jurisdictional loopholes: Harmonize rules so vendors cannot simply relocate to avoid restrictions.
- Increase transparency and auditing: Require vendors and buyers to provide verifiable audit trails and to allow independent forensic review when abuse is alleged.
- Protect legal and procedural safeguards: Mandate judicial authorization and strengthen domestic controls on acquisition and deployment.
- Support technical mitigations: Encourage rapid disclosure of exploited vulnerabilities and investment in defensive technologies to reduce the pool of exploitable weaknesses.
Journalism and research play a critical role in this ecosystem. Independent investigations have been the primary mechanism for surfacing corporate practices, contractual flows, and instances of misuse. Those revelations create political pressure for reform and provide the technical community with leads for forensic analysis. Yet that work is painstaking and often conducted at risk, which is why policy and corporate governance should not depend solely on ad hoc exposure.
Conclusion
The First Wap story is not unique; it is a chapter in a broader tale about how powerful surveillance technologies diffuse into the world when legal and institutional fences are porous. The capabilities marketed by Altamides — and by other vendors documented in recent reporting — can protect lives and prosecute criminals, but they can just as easily dissolve the boundary between legitimate security and pervasive monitoring. The essential question for democracies and rights‑respecting states is whether they will accept that trade‑off, or whether they will build the rules, oversight, and international cooperation necessary to keep such tools focused on lawful, proportionate purposes. If powerful surveillance can be moved across borders as easily as software updates, what will it take to ensure that its use remains accountable?
Source: https://www.schneier.com/blog/archives/2025/10/first-wap-a-surveillance-computer-youve-never-heard-of.html
