Loading summary
Progressive Insurance Announcer
This episode is brought to you by Progressive Insurance. You chose to hit play on this podcast today. Smart Choice make another smart choice with Auto Quote Explorer to compare rates from multiple car insurance companies all at once. Try it@progressive.com, progressive Casualty Insurance Company and affiliates. Not available in all states or situations. Prices vary based on how you buy. This show is supported by Odoo. When you buy business software from lots of vendors, the costs add up and it gets complicated and confusing. Odoo solves this. It's a single company that sells a suite of enterprise apps that handles everything from accounting to inventory to sales. Odoo is all connected on a single platform in a simple and affordable way. You can save money without missing out on the features you need. Check out odoo d o o.com that's o d o o.com
Jane Butcher
want to make a lasting difference to Reveal and protect independent journalism? Right now, it won't cost you a thing. Hi, it's Jane Butcher from Boulder, Colorado. I've spent my life fighting for justice, which is why I'm a longtime supporter of Reveal and the center for Investigative Reporting. I'm stepping up to protect the future of fearless independent journalism, and you can too, by joining CIR's Legacy Challenge. Just let Reveal know you're going to include them in your legacy plans, provide some basic information, and here's the really exciting part. A generous donor will contribute up to $10,000 now to fund Reveal's essential reporting in honor of your gift. Your legacy gift of any size makes an impact not just in the future, but right now. If you'd like to join me or want to learn more, please reach out to giftsevealnews.org again, that's giftsrevealnews.org the Legacy Challenge is only available for a limited time. Stand up for the Truth Today from
Al Letson
the center for Investigative Reporting and prx, this is Reveal. I'm Al Letson. Picture a map of the world laid out on a giant screen. It's pulsing with tiny points of light. From San Francisco to Tokyo, Stockholm to Cape Town. In countries like Nigeria and Thailand, the points of light are so dense they spill across the map. Other places are marked with just a single pinprick. Shawnee, Kansas Sauron, Iraq. There are 700,000 points covering 160 countries on this map. Each one represents a cell phone that was tracked at a specific place and time. Some phones are tracked multiple times over the course of an hour, day or week. This map shows how over 10,000 people were tracked using one surveillance company's software. It was created by a group of journalists who spent a year and a half piecing together how the technology works. The software had been unknown to the public or even many experts. It predates the leaks of NSA whistleblower Edward Snowd. It's wider in scale than the hacks connected to Pegasus, the spyware that's been blacklisted by the U.S. but here's the thing. Those scandals involved governments spying on people. This tech is also helping corporations and even some private citizens get in on the spying. This week's show lifts the lid on this surveillance and what it means for all of us. We first aired it in October of 2025, and it was the product of a blockbuster collaboration with the investigative newsroom. Lighthouse Reveal was one of 13 media partners from around the world who worked with Lighthouse to break this story.
Michael Montgomery
The story is that a couple of reporters from Lighthouse report.
Al Letson
Thousands of people fell victim to this digital dragnet. Who are they? Who was doing the spying and why? We begin with the discovery of a database that sent the whole investigation into overdrive. His reveals. Michael Montgomery.
Michael Montgomery
Ever since finishing college a few years ago, Gabriel Geiger has been working as an investigative journalist in Europe. In that short time, he's developed a specialty covering the surveillance industry. Not surprisingly, Gabe spends a lot of time online trawling for secrets.
Gabriel Geiger
When you think about the Internet, it's almost like an iceberg. And you have the top of the iceberg, the tip of the iceberg. That's everything that you can find on the Internet via Google search.
Michael Montgomery
Then there's the deep web. Hidden parts of the Internet that aren't indexed by standard search engines.
Gabriel Geiger
A sort of ocean beneath the iceberg.
Michael Montgomery
So Gabe sees his job as something like an explorer searching for mysterious creatures in the vast uncharted ocean of the deep web.
Gabriel Geiger
My bosses would be very angry if they understood how much time I spend fishing and getting nothing out of it. But every once in a while, you find something that's actually pretty interesting.
Michael Montgomery
That happened one evening in 2024. Gabe is at home on his living room couch, his laptop open and glowing. A colleague had given him a tip. The name of an obscure company that develops surveillance tools.
Gabriel Geiger
I look at their website and looks like it's from the 2000s or something. You know, it's kind of run down website, old web design.
Michael Montgomery
Even the company's name, first wap, seems obsolete. The WAP stands for Wireless Application Protocol, a mobile Internet technology that was abandoned years ago.
Gabriel Geiger
I'm sort of poking around, trying to find out more about this company. And I come across this set of data lying on the Internet unsecured. Downloading it takes quite a long time.
Michael Montgomery
As the data slowly streams into his computer, Gabe sees phone numbers and geographic coordinates. They were collected by first WAP over a span of eight years.
Crofton Black
And it becomes sort of clear that
Gabriel Geiger
something is being tracked or monitored. I don't know if it's consensual or not consensual, but, you know, there's numbers attached to geographic coordinates that are sort of changing over time.
Michael Montgomery
Gabe is burning to figure out who is being tracked.
Gabriel Geiger
So I'm looking through these phone numbers, and I see a 39 number. 39 is the country code of Italy, where my mom is from. And I spent a lot of time in. So I was sort of, okay, well, let me. Let me try and identify this Italian and phone number that I see here.
Michael Montgomery
He plugs the number into a web service that can identify names, email addresses, and social media accounts.
Gabriel Geiger
And when I do that, I get the name Gianluigi Nuzzi. And I put that name into Google, and I see that Gianluigi Nuzzi is an Italian journalist. And not just any Italian journalist. He's quite a famous Italian journalist, and he's quite famous for his investigations into the Vatican corruption at the Vatican. And when I saw that, I kind of realized that I think I. I think I stumbled across something, something really important here.
Michael Montgomery
Gabe works all night downloading as much data as he can. It will eventually total a million and a half lines with hundreds of columns along the way. He texts his boss, Lighthouse's managing director,
Gabriel Geiger
Daniel Howden, and I'm excited. I thought, of course he's gonna be convinced. As soon as I show him this, he's gonna be like, wow, like, good job, you know?
Michael Montgomery
So he gets Daniel on the phone.
Daniel Howden
It's still incredibly early. It's like, you know, pre coffee hour.
Michael Montgomery
It's 7am on a Sunday.
Daniel Howden
And Gabe is so excited. He's zealous. I mean, he's found something. I found the new Pegasus. I found our Pegasus, Obviously talking about this massive surveillance spyware investigation that went all over the world. And my first thought is, like, this is going to be a good laugh for everyone over beers for weeks to come. He is full of this kind of puppyish enthusiasm, and I kind of pat him on the head a little bit, calm him down, and ask him a few questions.
Michael Montgomery
Questions like, how is this different from the last three massive scoops that Gabe
Daniel Howden
brought in, which turned out not to be what we thought?
Michael Montgomery
Daniel knows from experience that it can take months, even years to unravel a complex data set. And even then there might not be a story. He's also concerned that the information Gabe has dug up is old. The data trails off in 2015. Editor and reporter Crofton Black is also cautious of Gabe's discovery.
Crofton Black
He's young enough and like naive enough to think that he can take a million and a half row data set and turn it into a story just like that.
Michael Montgomery
Still, something about all this is intriguing to Crofton. I mean, it's just so much data. So he shares a sample with some trusted sources in the telecoms industry.
Crofton Black
They were pretty stunned by the size of the data. You know, they were like, how did you get a million and a half rows of this? You know, it's floated up from the depths of the deep web. It's like the Kraken.
Michael Montgomery
The Kraken, you know, the legendary sea monster.
Crofton Black
You know, you can measure it, you can weigh it, you can count how many tentacles it's got, you can, like how many eyes has it got? But you don't have a guide, you know, you don't have Jacques Cousteau to tell you actually what it does, what it is.
Michael Montgomery
Two months after Gabe discovers the Kraken, Lighthouse decides to move forward with the investigation. Thirteen other newsrooms join the Lighthouse team. They include Paper Trail Media from Germany, whose founders broke the Panama Papers investigation. With Crofton and Gabe tag teaming as the famous ocean explorer Jacques Cousteau, they begin the tedious work of putting names and stories to many of those phone numbers. And while they're not able to trace all the numbers, what they find is pretty a broad range of people from more than 100 countries, including the US all being tracked on their mobile phones.
Crofton Black
You see heads of state, you see award winning journalists, you see human rights activists, you see leaders in industry, you see people inside the surveillance industry itself. It's this sort of extraordinary cross section of important people doing important things in their lives all over the world.
Michael Montgomery
Turns out that FirstWap, the company that makes the technology, has been around for two decades. But some surveillance experts, they've never heard of it.
Ron Deibert
I was not familiar with this company.
Michael Montgomery
Ron Deibert is an author, cyber sleuth, and director of Citizen Lab, the digital human rights group based in Toronto. He says the fact that he hadn't heard about First Wab isn't really a surprise.
Ron Deibert
It's a relatively crowded space. There are many companies that have been able to operate in the shadows, which I think says something about this sector As a whole.
Michael Montgomery
As the Lighthouse team begins to make sense of the data, it also obtains company documents, marketing material, and connects with former employees. A picture emerges of this mysterious company. First, WAP and the software developed to track all those phone numbers. They learn the software's name, Altimedes, and what it stands for. Advanced Location Tracking Mobile Information and Deception System.
Crofton Black
And the selling point of this piece of software is that you can type in virtually any phone number and it'll be able to track it anywhere in the world with no trace on the phone.
Michael Montgomery
Ultimedis doesn't leave a trace because, unlike spyware like Pegasus, it doesn't get inside your phone.
Ron Deibert
It's important to remember that our devices, our smartphones, sit on and function through a broader telecommunications ecosystem, which itself has been for decades notoriously insecure and poorly regulated. They can exploit these signaling protocols in order to package up a service that is not quite the same as getting inside a device, but can accomplish a lot.
Michael Montgomery
Altimedes works in a couple ways. If a customer, say, a government, wanted to track a phone number, they could buy a system and run it themselves through a local phone network. Another way the software works is through a web based portal. It taps into the global phone network through telecom companies in Liechtenstein or Indonesia. And it's not just about tracking someone's movements. Altimedes also makes it possible to listen in on voice calls, read texts, and hijack communications on encrypted platforms like WhatsApp. In its marketing materials and in a response to the reporting team, First WAP says Altamides was developed to help governments fight serious crime and track down terrorists. That's a common refrain in the surveillance industry. But many of the phone numbers from first wap's own database challenge that narrative. And this is where Italian investigative journalist Gianluigi Nuzzi comes back into the picture. In May 2012, Nuzi's blockbuster book about Pope Benedict XVI was getting worldwide attention this morning. An author is defending his explosive allegations against the Vatican. His new book accuses powerful members of
Jane Butcher
the church hierarchy of greed and financial mismanagement.
Michael Montgomery
Nuzi's book drew on leaked documents, including private correspondence between Pope Benedict and his secretary. And Crofton says the Holy See was irate.
Crofton Black
At this moment in time, Gianluigi Nuzzi was the Vatican's public enemy number one. He was the guy who was splashing all their dirty secrets and hanging out their dirty laundry to, like, an enormous audience in Italy. And they wanted to know where he got the stuff.
Gabriel Geiger
We know at the time from reporting that there's a sort of mad hunt that to uncover who Nutzi's source is, who's inside the Vatican leaking all these documents to him.
Michael Montgomery
Gabe took a closer look at the data he discovered, and I'm looking at
Crofton Black
the dates, and I realize Nutzi is being tracked just days after he publishes his big book.
Michael Montgomery
Gabe says the data shows Nutzi was tracked for about a week. Then the day after the Vatican police arrested his source, the tracking suddenly stopped. A scandal worthy of a Hollywood blockbuster is rocking the Vatican. The detention of Pope Benedict's butler capped one of the most convulsive weeks in recent Vatican history. The butler, Paolo Gabriele, was charged with stealing the Pope's private papers and leaking them. He was convicted by a Vatican court and sentenced to 18 months in prison. Nuzzi was also indicted.
Portia Karagaya
Defendant Gianluigi Nuzzi arrives to the first
Michael Montgomery
day of a Vatican trial over the
Portia Karagaya
alleged theft of confidential DO from the Holy See.
Michael Montgomery
After years of legal wrangling, Nuzi and another reporter were finally acquitted. Fast forward about nine years to July 2025, Nuzi is approached by the Lighthouse team. Like most people who show up in the tracking data, he has absolutely no idea he was being monitored. In a noisy cafe, they show him a map on a laptop with dots indicating all the locations where he was tracked, like his home in Milan.
Gabriel Geiger
He's sort of zooming in, zooming in, zooming in at one of the points. Oh, that's my apartment. And they were tracking him everywhere he was going while he was at the airport, while he was on a train or driving. They'd sort of scheduled the tracking every hour. So he was systematically being tracked as he moved across Italy.
Michael Montgomery
Nuzi is surprised at the precision with which he was tracked. But he's also circumspect. Crofton says he didn't want to jump to any conclusions that it was the Vatican that was behind the surveillance.
Crofton Black
He was like, well, you know, it's not really their style. Like, I would expect them to be sending, you know, people to follow my car or, like, people to break into my house maybe.
Michael Montgomery
Then there's a breakthrough in the investigation. Lighthouse obtains emails and documents that show there is a connection to the Vatican. Here's what they learned. A British company, KCS Group, was acting as a middleman for first wab. They were preparing a pitch to the Vatican showing them how they could use altimedes. Crofton says KCS was planning to ask the Vatican which phone numbers they should monitor.
Crofton Black
Four days after they ask that, we see that Nutzi's Numbers start being tracked. Then another five days later, KCS has their meeting with officials from the Vatican. KCS's employee goes to the meeting and he's got a presentation, a presentation that shows on a map Nudzi's movements over the last week. After the meeting, the employee from kcs, he actually emails first wap, saying, presentation fine, client happy.
Michael Montgomery
We sent First WAP and KCS Group a detailed list of questions about how the Altimedia software was used to track Nutc. First WAP responded, saying it does not provide tracking services and that they aren't involved with how its product is used once it's delivered to a client. And KCS Group says they have not been involved in selling or using inappropriate surveillance materials. Today, Gianluigi Nuzzi believes the Vatican was tracking him and he's disturbed by it. He says he's still angry over the jailing of his source. He believes his only crime was exposing corruption.
Gabriel Geiger
It was a shock to me because the Vatican never arrested pedophile priests. They never arrested money launderers. Money laundering was not even a crime. But they arrested a family man with a clean record who had committed the terrible crime of making photocopies and give it to a journalist.
Crofton Black
You can really tell over the course of that interview that he's genuinely disturbed. He sort of felt that this showed the chilling effect this type of technology can have on the work of journalists like himself and other journalists all around the world.
Michael Montgomery
So if the Vatican tracked Nutzi, were they breaking the law? Well, the Vatican is its own state, and it wouldn't necessarily be illegal to track someone within the walls of Vatican City. But Nuzi was tracked outside the Vatican in Rome, in Milan, all over Italy. To do that legally, the Vatican would need to make a formal request to Italian authorities. We asked the Vatican if they made a deal with KCS to use the Altamides software. We also asked whether they made a request to Italian authorities to track Nutzi. They never responded.
Al Letson
Gianluigi Nuzzi was one of a number of high profile figures whose lives were secretly monitored. There were also hundreds of other people who weren't public figures at all.
Sophia
I felt really violated. I felt very vulnerable.
Al Letson
That's next on Reveal.
Crofton Black
Storms, floods and fires are ever more extreme.
Michael Montgomery
And yet the Federal Emergency Management Agency is fighting for its life. I've never been a big fan of FEMA.
Jane Butcher
FEMA's a disaster.
Al Letson
FEMA's a dirty word.
Michael Montgomery
People are waking up in droves to the FEMA camps.
Crofton Black
Can the agency survive the stories that
Michael Montgomery
have been told about it. And can we survive without fema? The Movement to Kill FEMA is a brand new series from WNYC's on the Media. Wherever you get your podcasts
Al Letson
from the center for Investigative Reporting and prx, this is Reveal. I'm Al Ledson. Today we're bringing back a collaboration with Lighthouse Reports about a global surveillance software that can track virtually any mobile phone user around the world. After discovering the software was used to spy on an Italian reporter as he was releasing a book about corruption inside the Vatican, Gabe and the team at Lighthouse Reports started digging deeper into the data set. They found that a wide range of public figures were being monitored.
Crofton Black
There's the actor Jared Leto in there. There's Erik Prince, the controversial founder of Blackwater Security. You have this guy, Adam Siralski, who's a Netflix producer and a former lawyer for the CIA. There's 23andMe co founder Anne Wojcicki, the Prime Minister of Qatar, the wife of Bashar Al Assad, executives at the energy drink company Red Bull. It's this sort of dizzying number of important people from all over the world,
Al Letson
but they also came across names that didn't fit that profile or any profile, really. Seemingly random people whose movements were also being tracked. Reveal's Michael Montgomery expl.
Michael Montgomery
Gabe learned that lots of regular people were being tracked, like a teacher, a driver, even a softball coach in Hawaii.
Gabriel Geiger
And we have no idea why. You can understand why a journalist investigating the Vatican is being tracked. It's not good, obviously, but you can understand why it happens, the motivation behind it. But why is a therapist inside there? That's a bigger mystery.
Michael Montgomery
One phone number had a British country code, and they traced it to a person we're going to call Sophia.
Sophia
Hi, Gabriel.
Gabriel Geiger
How are you doing?
Sophia
I'm all right.
Crofton Black
Sophia is a Russian woman who fled the country in the late 90s and eventually ended up in the UK where she worked in the corporate sector for many years.
Michael Montgomery
The first WAP data showed that Sophia was tracked for almost a year without her knowledge or consent. Sophia learned she was monitored in Britain and even on her travels abroad.
Sophia
I could recognize the place where I stayed, the hotel, the restaurants area, the beach. So disturbing. Quite accurate and disturbing.
Michael Montgomery
All of these searches put her in the top 10% of all the phone numbers that Lighthouse analyzed. Sophia asked that we not use her real name out of concern for retaliation. But she wanted her voice heard.
Sophia
This needs to be shared as widely as possible for people to be aware that dangers like this are lurking just around the corner.
Michael Montgomery
At the time, she was Tracked. Sophia was working in a highly competitive industry that put a premium on new patents. As a company executive, she had access to all kinds of confidential information.
Sophia
I thought, well, most likely it was a competitor. And then I thought, oh, my gosh, maybe it was actually my own company, because I've read stories of the companies also spying on their employees. And then a less likely but plausible scenario, maybe I have been surveilled by a Russian state because I have been a fairly vocal critic of the inhumane policies of the Russian government in my own humble ways.
Michael Montgomery
To figure out who was behind the tracking, Gabe went back into the data, where he noticed something unusual, which is
Gabriel Geiger
that her phone number is being tracked at the same time as a bunch of Pakistani phone numbers.
Michael Montgomery
Sophia recalled knowing only one person from Pakistan while she was living in Britain. He was an instructor her company had hired to help her get a driver's license.
Sophia
He had to sometimes meet me and pick me up at my home, and we would have to drive all the way to the office together. So he already knew where I worked. He knew where I lived.
Michael Montgomery
Sophia says the man regaled her with stories about his time in the army and about his connections to Pakistani intelligence agencies.
Sophia
He was quite keen to stay in touch with me, and over time, he started to pursue me romantically.
Michael Montgomery
Something about this guy felt off. Sophia definitely wasn't interested, so she broke off contact. But for months, the man kept calling and texting. Years later, after speaking with Lighthouse reports, Sofia learned something important. The man wasn't just a driving instructor. He was also a sales manager for a private security company. It seems somehow he got access to Altimedes and used it to track Sophia and several of his colleagues.
Gabriel Geiger
This software became a sort of plaything of some people who had access to it, and they used it to track people they were romantically pursuing or harassing. They used it to track their wives. They used it to track their kids. They used it to track the people their kids were dating.
Sophia
It's really alarming and disturbing how easy it is to use this type of technology.
Michael Montgomery
The unwanted calls and texts eventually stopped. But since learning about the man who was secretly surveilling her, Sophia says she's been asking herself a lot of questions. How do you build relationships with people and how do you maintain them?
Sophia
It makes me definitely rethink how to deal with people, you know, without turning into a paranoid or a bitter person. It sort of put my own perceptions of safety upside down. Like there is no privacy. There is no safe space where I can just be. Just be Left alone.
Michael Montgomery
When you think about it, it's kind of amazing that this massive data set that Gabe stumbled on would include a journalist covering corruption in the Vatican and just a regular person like Sophia. The Lighthouse Report's investigation continued, and Gabe says they figured out one way to make sense of the mobile numbers in the datase. Look for patterns or clusters.
Crofton Black
We're talking about groups of numbers that are related to each other. So maybe every day these two numbers are being tracked within one minute of each other, or they can be connected in terms of place. So these two numbers are being tracked in the same building, or they're being tracked, you know, 100ft away from each other.
Michael Montgomery
That's how they came upon a trail of South African phone numbers.
Crofton Black
And we can notice that they're all being tracked at the same time. This tracking is highly correlated. We start digging in further, and we realize that these aren't South Africans. We see that they're actually Rwandans in exile living in South Africa.
Michael Montgomery
Turns out some of the numbers were connected to an opposition movement called the Rwanda National Congress that was actively campaigning for a more democratic government.
Crofton Black
The movement was gaining momentum when one of its leaders was found strangled in a hotel room in Johannesburg.
Portia Karagaya
A former head of the Rwanda External Intelligence Service has been found murdered in
Progressive Insurance Announcer
a hotel in South Africa, the country where he has been living in exile for several years.
Michael Montgomery
The man's name was Patrick Karagaya. He was a rebel fighter who became Rwanda's foreign intelligence chief after the genocide in 1994. He was a close ally of President Paul Kagame, but the two had a bitter falling out. As a result, Patrick was imprisoned and then went into exile. Here's Patrick talking about the dangers he and his comrades faced. Some have died. Some are in prison.
Gabriel Geiger
Others are in exile like us, and it will continue.
Michael Montgomery
Even in exile. Patrick says he knew they were being targeted by the Rwandan government. That's why my colleague. Good shot. I probably was a bit lucky. I went off without a scar. Still, he continued to speak out against Kagame, and for that, he was branded an enemy of the state.
Crofton Black
There's been a wealth of reporting that's
Gabriel Geiger
sort of shown how Kagame's regime was incredibly paranoid about potential opposition to his government.
Crofton Black
And it's been well documented that Kagame has set up a sort of intelligence apparatus that tracks and hunts down dissidents abroad.
Michael Montgomery
Patrick believed he was a marked man, but he would make light of it using his dry sense of humor. This is Patrick's daughter, Portia.
Portia Karagaya
He used to joke in a way That I didn't enjoy that he was a dead man walking verbatim.
Michael Montgomery
Journalist and author Michaela Wrong knew Patrick and also remembers his dark sense of humor. She wrote a book about him and his murder called Do Not Disturb. In it, she writes about how Patrick would joke about Rwanda's intelligence operations.
Michaela Wrong
Patrick Karagaya used to joke, hey, you know, you think they're James Bond, but I was James Bond. I'm the spy chief. You know, I know how this stuff works. I'm ahead of the game. And he was more vulnerable than he realized. And events proved that to be the case.
Michael Montgomery
The Lighthouse team wanted to know if there was any, any connection between Patrick's killing in 2013 and the tracking of people around him before his death. They knew one thing. Patrick's phone number didn't show up in the cluster. But they uncovered the identities of others, including a man named Jack Inziza, and shared them with Michaela Wrong.
Michaela Wrong
If you follow Rwanda closely, or even if you don't follow it closely at all, Jack and Za is infamous. He's been associated really throughout his career with top level assassination. I mean, people. People sort of shudder when they mention his name.
Michael Montgomery
Mikayla recognized a second person who showed up in the cluster, the wife of an opposition figure who worked closely with Patrick, and a third, Patrick's bodyguard and driver.
Michaela Wrong
So you've got the wife of one dissident, the bodyguard and driver of another, and a man who is associated with top level hits.
Michael Montgomery
Those clusters that Gabe and the Lighthouse team found are known as relational targeting in the world of surveillance technology. It's a concept that's very familiar to Ron Deibert from Citizen Lab.
Ron Deibert
You have a principal target in mind, and you want to gather as much information about that target as possible. But you might have difficulty, for example, hacking their device because they put in place all sorts of defense mechanisms.
Michael Montgomery
This is where relational targeting comes into play. You track people whose movements mirror those of your targets.
Ron Deibert
So you get at their daughter, their son, their cousin, their uncle, or whatever, and you track them collaterally. We see it in just about every case that we investigate.
Michael Montgomery
You know, you can't kill someone if you don't know where they are. You can't kill people if you don't have real time intelligence showing you their locations. As a former officer in the Rwandan army, Robert Higuero had organized sensitive military operations where intelligence gathering was crucial. Robert was also living in exile and was close to Patrick. He says he knew the government wanted to kill his friend, but he didn't know someone was Using first wap's software, altimedes, to track people close to him. Learning about it today, he's not surprised. They do these things. They choose these methods of eliminating people by killing in cold blood because of they want to terrorize the population. The tracking stopped months before Patrick's murder, and it's unclear if other people close to him were being monitored at the time of his death. Portia was in Canada when she got word that her father was dead. It was New Year's Day, 2014.
Portia Karagaya
Even when I used to visit and say goodbye, you would always wonder, is that the last time I say goodbye to my dad and then that he actually ultimately is killed? You know, I just remember thinking, okay, so the world is just chaos, and people are. And there's not much you personally can do to get away from that. And it is absolutely a part of your life and your story.
Michael Montgomery
The Rwandan government was widely suspected of ordering Patrick's killing, and arrest warrants were issued for two Rwandan men. But there's never been a trial. Portia says her father's murder had the intended effect of splintering the opposition movement.
Portia Karagaya
There's a certain something that happens when you feel like you've lost good people, and so I think folks just didn't quite know how to stay together in the same way.
Michael Montgomery
It remains a mystery who had access to the First WAP software that was used to track people close to Patrick Karagaya. A representative from the Rwandan Embassy in Washington said the government of Rwanda has never had nor sought to have such software directly or indirectly. In response to this investigation, First WAP denied it was involved in any human rights violations. The company also said it couldn't address specific allegations because of client confidentiality. There is other evidence showing how the company and its executives have been connected to a list of governments with poor human rights records, such as emails, interviews with former employees, and the original data that Gabe collected. According to that data, First WAP founder Josef Fuchs visited more than 25 countries between 2007 and 2015.
Crofton Black
One of the unique things that you see in this data set is that Fuchs and other company executives are tracking their own phone numbers hundreds of thousands of times as they crisscross the globe.
Michael Montgomery
Lighthouse reports suspects that Fuchs and other First WAP executives traveled to many of these places while drumming up business for Altamedes.
Crofton Black
And what kind of ties a lot of them together is that, one, they're authoritarian, and two, they have a history of abusing surveillance tech against their own citizens.
Michael Montgomery
Like Thailand in 2013. Fuchs is there. Just as anti government protests surge.
Crofton Black
We see Fuchs tracking his phone number and other Thai phone numbers. You know, maybe this is a way for him to show off how the software is working. But in any case, right after that, we see a huge uptick in activity in Thailand.
Michael Montgomery
Gabe says hundreds of Thai phone numbers were monitored with altimedes just as the authorities stepped up a brutal crackdown. According to documents and interviews with former employees, Lighthouse learned that Altamedes customers included the governments of Belarus, Indonesia, Malaysia, Nigeria, Saudi Arabia, Singapore, the United Arab Emirates, and Uzbekistan.
Ron Deibert
This is essentially despotism as a service.
Michael Montgomery
Ron Deibert from Citizen Lab says working with repressive governments is a common feature throughout the surveillance industry.
Ron Deibert
These are companies that are facilitating human rights abuses and some pretty horrible, egregious practices. So we're dealing with the facilitation through this service of transnational authoritarianism.
Gabriel Geiger
This is just probably a small sliver of the company's total activities. It's clearly not the entire set, and we don't have activities from, you know, 2015 onwards. So what happened after that point? Yeah, that keeps me up at night.
Michael Montgomery
In a statement, FirstWap said it had not offered or sold its products to repressive regimes. And it noted that it had no knowledge of any discussions or presentations that may have been carried out by the company's founder, Josef Fuchs. Fuchs died in 2024.
Al Letson
In a moment, the team at Lighthouse Reports goes undercover to learn how this mysterious company markets its surveillance technology.
Crofton Black
Today, we wanted to know in 2025, is there anything that these guys would ball cap? Do they have any red lines?
Al Letson
That's next on Reveal. From the center for Investigative Reporting and prx, this is Reveal. I'm Al Letson. This week's show is about an investigation that began with a trove of data from one of the world's oldest surveillance companies. First WAP. That data drops off in 2015, which left the team at Lighthouse Reports wondering what's happened to the company in the decades since. How has their software advanced and who are they willing to sell it to Today, to answer those questions, Lighthouse Reports decided to go undercover. Michael Montgomery explains how they did it.
Michael Montgomery
The Lighthouse Reports team is holed up in a rented apartment in Prague. It's filled with breakfast dishes, luggage, a collection of laptops, and the sweat of anticipation. They've come to the Czech Republic to attend ISS World Europe, a premier gathering for intelligence agencies, police, and companies that build and sell surveillance systems. Outsiders, especially the media, aren't allowed in.
Emanuel Freudenthal
We're going to keep discreet about exactly where the cameras.
Michael Montgomery
Emanuel Freudenthal is an editor at Lighthouse. He's dressed up in a flashy suit that's been fitted with a hidden camera.
Emanuel Freudenthal
And basically you can't see this, like a tiny hole, but you really can't tell where. It's a very beautiful fashion accessory.
Michael Montgomery
Emanuel is getting direction from his colleague, editor and reporter Crofton Black. Crofton's been planning this operation for six months.
Crofton Black
You've got that in your. In your trouser pocket.
Just coming through with the wire.
Emanuel Freudenthal
My underwear and your underwear.
Gunter Rudolf
Okay.
Crofton Black
But let's hope it doesn't fall out in the middle of your conversation. This is what makes a podcast into a hit.
Instead of being like, just kind of
Gabriel Geiger
run of the mill. Yeah.
Michael Montgomery
To get inside the conference, Emmanuel is posing as Albert, a French business broker based in South Africa with lots of connections to governments and mining interests throughout the continent. Reporter Gabriel Geiger explains why Emmanuel is perfect for the role.
Crofton Black
He's someone who just has a perfect poker face. You have no idea what this guy is thinking.
Michael Montgomery
They crafted Albert's backstory as a test to see how far First Wap would go to make a deal.
Crofton Black
We intentionally designed him to be very shady. He's working for unnamed governments, private clients. His company is supposedly registered in the British Virgin Isles, like a sort of post. Post box address. A bunch of red flags that anybody who's doing serious due diligence would. Would pick up on.
We decided to approach First Swap undercover for one very simple reason. We wanted to know, is there anything that these guys would balk at? Do they have any red lines?
Michael Montgomery
Today, Albert is representing clients in French speaking West Africa, where First Swap doesn't seem to do much business. Lighthouse hopes First Wap will see meeting Albert as an opportunity to increase sales in a new region. He's joined by a man they're calling Abdu, one of Albert's clients, who's looking to acquire some surveillance tech. Albert's hidden camera is rolling as he and Abdu arrive at the conference. They ride an escalator up to the sales floor, where tiny cameras and drones are on display. But the busiest vendors are focused on smartphones. Albert moves smoothly through the crowd. So far, so good.
Gunter Rudolf
Yeah.
Emanuel Freudenthal
Hi, Gunther. How's it going?
Gunter Rudolf
Are you quite busy?
Emanuel Freudenthal
I guess.
Michael Montgomery
He and Abdu have set up a meeting with First Wap's sales director, a man named Gunter Rudolf.
Emanuel Freudenthal
I wanted to introduce you to Mr. Mala.
Gabriel Geiger
Hello.
Crofton Black
Abdul Mada Gunteruda Rudolph is in full sales mode. He doesn't show Any sort of skepticism towards Albert, and he just like, launches right in.
Gunter Rudolf
Please take a seat.
Michael Montgomery
Albert and Abdu move quickly to learn more about the company's software, Altimedes. First, they get a look at it. When one of the executives demonstrates the tracking function by locating Rudolph's cell phone on a laptop, they track his phone to a point on a map. This is the same software that was used to secretly track all those people, like Italian journalist Gianluigi Nuzzi. Then Rudolph explains how you could use Altimedes to crack into an encrypted WhatsApp account.
Gunter Rudolf
So what I can do now is when it's sending the OTP to his phone.
Crofton Black
So what Rudolph explains is that FirstSwap software allows you to hack into WhatsApp accounts by stealing and intercepting these authentication text messages, and that allows you basically to take over someone's account.
Gunter Rudolf
Then I take the OTP clock, put it in my mobile phone, and I have his WhatsApp on my phone. His favorite thing.
Michael Montgomery
Then Albert presents Rudolf with one of those red lines that Crofton had mentioned. He says there's a client, a private mining company in West Africa that's having trouble with people protesting its operations.
Emanuel Freudenthal
So he's wondering what would be the best approach for that, to monitor those activists and check that they're not disrupting business?
Michael Montgomery
Rudolph asks Albert.
Gunter Rudolf
He knows already who are the leaders, what he want to find out.
Michael Montgomery
Does the client already know who the leaders are, or does he want to find out?
Gunter Rudolf
The point is, do you know already the target, and we want to monitor them to know what they are doing, or do you have to find out who's the organizer?
Michael Montgomery
Rudolf explains that Altamides has another feature called geofencing. It can track large numbers of cell phones in a specific area, like a protest. He said they can even use it to identify the organizers. Gabe says the fact that Rudolph is even talking about sharing their surveillance system with this private mining company is shocking.
Gabriel Geiger
I think that the moment where we're like, wow, they're actually playing ball with this.
Michael Montgomery
Rudolph goes on to talk about why First, WAP is special. Their headquarters are in Indonesia, which places fewer restrictions on the export of sensitive technology like Altimedes. He says that gives them a competitive advantage. That basic idea, the lack of strong export restrictions leads them to a conversation about another red line scenario. Working with a client on a sanctions list. Someone like that is known as a specially designated national designated nationals.
Gunter Rudolf
That means there are some speakers in Africa and also entities in Africa which are under sanction and export limitations.
Crofton Black
You have to understand that sanctions are something that the United States and European countries put in place that bans you from doing business with a sanctioned entity. And that can be an individual, it can be a company, it can be a government.
Michael Montgomery
Rudolph explains how First WAP could make a deal with someone who's on a sanctions list.
Gunter Rudolf
If you're just holding a German passport, like Johnny.
Michael Montgomery
He's talking about his colleague Johnny Goebel
Gunter Rudolf
for an Austin passport, like me, I have not even allowed to know about the voce because otherwise I can go to prison.
Michael Montgomery
The audio isn't great here, but what Rudolf is basically saying is that he could go to prison in his home country of Austria because it's illegal for him to help someone avoid sanctions. Then he explains how the company could run the deal through its office in Indonesia instead.
Gunter Rudolf
So that's why we make such a deal. For example, we make it through Jakarta and signature.
Crofton Black
And then he goes on to say, you know, slyly, we will never know about this project, quote, unquote, and then sort of smiles. What Rudolph is talking about here is a way to circumvent sanctions.
Michael Montgomery
At the end of the conference, Albert tells the executives he'll follow up to continue the conversation.
Emanuel Freudenthal
All right, thanks a lot.
Gunter Rudolf
Okay, good feedback. Bye.
Michael Montgomery
With the undercover operation behind them, the Lighthouse team is stunned by what they've learned. First, there was all that data Gabe discovered and the people who were tracked more than a decade ago, and now this. Here's Crofton.
Crofton Black
We spent like six months trying to figure out every possible permutation of what could happen, from the sublime to the ridiculous. But I never anticipated that they were going to basically offer us a sanctions busting recipe.
Michael Montgomery
There was just one thing left to do. This September, Albert set up one final call with Gunter Rudolph and two other First WAP executives, Johnny Goble and Evgeny Karakanovsky, on the agenda. Follow up on the proposed deal from the trade fair.
Emanuel Freudenthal
Hi, Gunter, how are you?
Gunter Rudolf
Hello, hello, hello.
Emanuel Freudenthal
I can see Dubai behind you.
Michael Montgomery
Rudolph is in Dubai, where FirstWap has offices. The conversation starts out with smiles and laughs. Albert asks about things like pricing for Altamedes.
Gunter Rudolf
Depends on what the client chooses on the different modules, on the features. Minimum 1 million to whatever, 15, 20 million. Theoretically.
Michael Montgomery
Albert mentions that proposed deal he talked about at the trade fair. The client under sanctions who wanted to acquire Altamedes.
Emanuel Freudenthal
So I think we can all agree we found a good way around the sanctions, but I have to to admit.
Michael Montgomery
And then, without missing a beat, Albert reveals his true identity.
Emanuel Freudenthal
I'm actually working for A coalition of investigative journalists. And so I was wondering, why did you agree to do a deal with a sanctioned client when you said yourself that you could go to prison for that?
Michael Montgomery
Rudolph and his partners are silent, almost frozen, after hearing what Emmanuel Freudenthal has just said. They're not moving, just staring into their computers, listening as Emmanuel asks again about their conversation in Prague.
Emanuel Freudenthal
You agreed to the sale and it was clear against the law and the European sanctions regime, but you agreed. What's your comment on that?
Michael Montgomery
Eventually, Rudolf responds, we are not doing.
Gunter Rudolf
We did not agree to deliver. Right.
Michael Montgomery
He's pointing out they never actually signed a deal.
Gunter Rudolf
So when we make a contract with you, you will see the clauses that we are not dealing with people under sanction.
Michael Montgomery
What he's saying here is that when we make a contract with you, there would be a clause that says we don't deal with people under sanctions. And then he says, Emmanuel must have the wrong company altogether.
Gunter Rudolf
Either you really have the wrong company, you talk to the wrong company or your sources or whatever is completely wrong. I don't know.
Emanuel Freudenthal
Okay, we. We're. Thanks for taking the time to answer the questions. So we'll be sending you an email with. With more question and for the opportunity to respond. Have a good afternoon. Bye.
Gabriel Geiger
Thank you.
Gunter Rudolf
Bye.
Gabriel Geiger
Bye.
Michael Montgomery
Just about a week before we published this investigation, First WAP issued a statement. The company said there had been misunderstandings at the conference in Prague and that their executives only spoke about what was, quote, technically feasible. First WAP also told us they don't sell to corporate clients, only governments.
Crofton Black
When you get to the end of one of these big investigations, there's always this question of, you know, what does it all mean? And I think that for me, it kind of redefines who uses these tools. It redefines who can get targeted by them. And that image to me of them laughing about breaking sanctions is just something that really sticks with me. And I find it kind of haunting in a way.
Al Letson
This was a big investigation with 13 reporting partners each releasing their own version of the story. Right after the publication In October of 2025, there was immediate reaction in Europe. A telecom company in Liechtenstein suspended its business with FirstWap after learning that Altimedes may have used it to tap into phone networks around the world. And in the US Oregon Senator Ron Wyden responded to our investigation, saying it underscore. Underscores the glaring weakness in our phone system, which the US Government and phone companies have failed dismally to address. A lot of people from a lot of places pitched in on this week's show. Special thanks to our friends at Lighthouse reports and the 12 other media outlets that were part of this collaboration. We've got the full list on our website. We've also got a terrific package from Mother Jones, including a video that follows reporter Gabe Geiger's journey from the moment he discovered the massive trove of data. Check it all out@revealnews.org our lead producer for this week's show is Michael Montgomery. Lou Okowski edited the show. We have production help from Nadia Hamdan, Ricardo Coluccini and Artis Cheriscus. Artis is also our fact checker. Special thanks to Flavio Pompetti. Victoria Baranetsky is our general counsel. Our production manager is Ulema Cobb. Score and sound design by the dynamic duo Jay Breezy, Mr. Jim Briggs and Fernando My Man Yo Arruda. They had help this week from Claire C. Note Mullen. Taki Telenides is our deputy executive producer. Our executive producer is Bret Myers. Our theme music is by Cameraado Lightning. Support for reveals provided by the Reva and David Logan foundation, the John D. And Catherine T. MacArthur foundation, the Jonathan Logan Family foundation, the Robert Wood Johnson foundation, the park foundation, the Schmidt Family foundation and the Hellman Foundation. Support for reveal is also provided by you our listeners. We are a co production of the center for Investigative Reporting and prx. I'm Al Letson and remember there is always more to the story.
Sophia
From prx.
Date: April 18, 2026
Host: Al Letson
Original Collaboration: The Center for Investigative Reporting, PRX, Lighthouse Reports, and 12 additional global media organizations
This gripping episode of Reveal explores a sprawling, previously unknown global surveillance operation run by an obscure company, First WAP. Through the discovery of a vast, unsecured data set and an in-depth cross-border investigation, the episode lays bare the alarming reach of First WAP’s surveillance technology—Altimedes—which enabled not only governments but also corporations and private actors to track, eavesdrop, and monitor individuals almost anywhere in the world. The episode chronicles how this software has been used against high-profile figures, dissidents, and seemingly ordinary people, and culminates in an undercover sting operation at an industry conference, challenging the company’s current-day practices and ethical boundaries.
Gabriel Geiger [05:09]: “My bosses would be very angry if they understood how much time I spend fishing and getting nothing out of it. But every once in a while, you find something that's actually pretty interesting.”
Ron Deibert [12:19]: “It's important to remember that our devices, our smartphones, sit on and function through a broader telecommunications ecosystem, which itself has been for decades notoriously insecure and poorly regulated.”
Gianluigi Nuzzi [18:58]: “It was a shock to me because the Vatican never arrested pedophile priests. They never arrested money launderers... But they arrested a family man with a clean record who had committed the terrible crime of making photocopies and give it to a journalist.”
Sophia [24:00]: “This needs to be shared as widely as possible for people to be aware that dangers like this are lurking just around the corner.”
Michaela Wrong [30:29]: “Patrick Karagaya used to joke, hey, you know, you think they're James Bond, but I was James Bond... And he was more vulnerable than he realized. And events proved that to be the case.”
Ron Deibert [31:59]: “You have a principal target in mind, and you want to gather as much information about that target as possible... So you get at their daughter, their son, their cousin, their uncle.”
Ron Deibert [37:01]: “This is essentially despotism as a service.”
Gunter Rudolf [44:16]: “So that’s why we make such a deal, for example, we make it through Jakarta and signature... we will never know about this project.”
Crofton Black [50:14]: “It kind of redefines who uses these tools. It redefines who can get targeted... the image of them laughing about breaking sanctions is just something that really sticks with me.”
The investigation unsettles preconceptions about who wields surveillance technology and who is vulnerable. The hidden empire unmasked by the data leaks and undercover reporting demonstrates a world where advanced mobile phone tracking is commodified—accessible not just to repressive states and intelligence agencies, but to private firms and even individuals with the right connections. The disturbing ease of abuse, lack of effective oversight, and enthusiastic salesmanship—captured on tape—leave listeners with a haunting vision of a world where privacy has become frighteningly obsolete.
For further reading, related video content, and reaction from key players and politicians, visit revealnews.org.