How agencies put the platform to work: recorded meetings, captured instructions, reconstructed movement, camera and call records, and the secure handling that keeps the resulting evidence intact.
Capability coverage
What each scenario draws on
Every case below is built from the same platform capability set, combined differently according to the operation.
Centralized device oversight
Every enrolled Android handset appears in the C2 dashboard with live status, last synchronization and remote tasking.
Location & movement history
GPS position tracking with operational movement history, corroborated by cell-tower identifiers and nearby Wi-Fi networks.
Authorized call recording
Cellular and VoIP calls recorded on the handset, including WhatsApp, Telegram and Signal, with full call-log metadata.
Messaging & social capture
Text messaging across all platforms and social media, SMS and call logs, retained independently of the handset.
People, accounts & calendar
Contacts, accounts, emails and calendar entries linked into a single identity picture.
Camera, microphone & screen
Front and rear camera access, microphone recordings of the environment and screen recording, requested from the dashboard.
File system & applications
File system data, installed applications and the full inventory of the device.
Evidence gathering
Six operations, one monitored handset
Each scenario shows the situation the operative was in, what the platform captured while it happened, and what that material is worth in a case file.
These scenarios are illustrative composites prepared for authorized agencies. They describe lawful operations conducted under a documented mandate, and do not represent identifiable cases, persons or investigations.
UC-01
The meeting that recorded itself
An operative attends a coordination meeting where nothing may be written down and no device may be handled. The handset lies face down on the table, untouched for the entire hour.
Situation
The operative is invited into a private apartment for a planning meeting. Bringing recording equipment openly would end the relationship, and note-taking is out of the question. The handset is left face down beside a coffee cup and is never picked up.
Captured by the platform
Microphone recording of the room for the full session, started remotely from the C2 dashboard.
A GPS fix and the nearby Wi-Fi fingerprint of the address where the meeting took place.
The participants' voices, captured alongside the operative's own remarks.
Evidence value
A continuous audio record of who said what, an independently verified address, and a duration that matches the operative's written report. Investigators can listen, transcribe and cite the exact minute an instruction was given.
Audio exhibit + location confirmation
UC-02
Criminal instructions, captured message by message
Tasking arrives as a stream of messages across two messengers and one phone call. By morning, several of them have been deleted from the handset.
Situation
A suspect sends the instruction over WhatsApp, repeats it on Telegram when the operative does not answer immediately, then calls to confirm. The operative replies, agrees, and later deletes the conversation to protect themselves if the phone is checked.
Captured by the platform
WhatsApp, Telegram and Signal conversations as they arrive, with sender, direction and delivery timestamps.
SMS and call-log entries recording the confirming call, its duration and the originating number.
Contact records tying the sending numbers and handles to one identity.
Evidence value
The dashboard holds the conversation independently of the handset, so deleting it on the device does not remove the record. Message, repeated message and confirming call read as instruction, pressure and acknowledgment - in order, with times.
Chronological transcript + call log
UC-03
Three days of movement, reconstructed from the map
The operative visits a storage unit, a meeting point and a handover location across three days, describing each move only verbally in a debrief.
Situation
The debrief afterwards is vivid but imprecise: no times, no addresses, and road names that do not quite match the map. The operation needs to know exactly where the operative stood, and when.
Captured by the platform
GPS position history with arrival and departure times at each stop.
Cell-tower identifiers recorded along the route where GPS reception dropped.
Nearby Wi-Fi networks at each location, giving an address-level fingerprint of every stop.
Evidence value
The dashboard replays the route and fixes each stop in time and place, then checks it against the operative's account. Where the verbal timeline drifts, the record holds: the storage unit, the exit and the service station match to addresses and to surveillance footage windows.
Route replay + stop-by-stop timeline
UC-04
Seeing the place without taking a photograph
The operative is admitted into a warehouse used to store goods and carries no camera. The dashboard produces images of the interior and of the people present.
Situation
During a delivery, the operative is walked through a warehouse. Taking a phone out to photograph the interior would be noticed immediately, and the visit will not be repeated.
Captured by the platform
Rear and front camera frames requested from the dashboard while the handset stayed in a pocket.
Short screen recording of the operative's own device view where written instructions appeared.
Environmental audio of the conversation during the walk-through.
Evidence value
Still images of the premises, of the goods in storage and of the people present - each timestamped and tied to the same location record as the visit. Material that can be matched against whatever is recovered from the premises months later.
Image set + time and location anchor
UC-05
Every conversation on record
Threats in one call, a price negotiated in another, and a Signal call confirming the payment method - all recorded from the handset under an existing authorization.
Situation
Over two weeks the operative is called six times by the same suspect over the cellular network, once over WhatsApp and once over Signal. The content moves from threats to payment arrangements, and nothing is ever put in writing.
Captured by the platform
Recordings of cellular calls in both directions, with call-log entries for time, duration and counterpart number.
VoIP call recordings from WhatsApp, Telegram and Signal.
Contact records for the numbers and accounts involved.
Evidence value
Eight verbatim conversations, each tied to a call-log entry so the recording can be checked against the network record. The threat, the negotiation and the confirmation are all present in the suspect's own voice.
Audio files + matching call-log extract
UC-06
From one handset to the whole network
Contacts, accounts, email, calendar entries, installed applications and stored documents are drawn together into one picture of who the operative deals with.
Situation
After an arrest, investigators need the structure behind the operative's role: who they met, which accounts they share, which documents passed through the phone, and which applications the group uses to organize.
Captured by the platform
Contacts and accounts linked to the same people, including the email addresses used for coordination.
Calendar entries showing planned meetings, often recorded before the operative reports them.
File-system documents, downloaded material and the installed-application inventory of the handset.
Evidence value
The links turn scattered items into relationships: a calendar entry names a meeting, a contact names the counterpart, an email account carries the instructions and an installed app explains how the group coordinates. Documents in storage provide the paper trail.
Identity graph + document set
Secure communications & evidence protection
Protecting the operative and the record
Gathering evidence is only half the operation. The material has to reach the agency unexposed, stay readable only to the officers assigned to it, and hold up when it is challenged.
SC-01
Encrypted tasking between handler and operative
Operational instructions move between the handler and the handset over the C2 protected channel, not over a commercial messenger that can be read or found on the device.
Operational context
The handler needs to move a meeting by two hours. Sending the change over WhatsApp would place the agency's own instruction into an ordinary chat log and expose the handler's number to the operative's handset.
Controls in place
Command traffic routed over the out-of-band protected channel with hardware-bound session keys.
Mutual authentication in both directions before the handset accepts a command.
Tasking recorded in the C2 audit trail instead of a consumer message store.
Protection outcome
The agency's tasking stays out of the commercial messaging record entirely. There is no chat history for the monitored user to find, for network inspection to read, or for whoever handles the phone after a seizure.
Signed tasking entry in the audit trail
SC-02
Collected evidence that never travels in the open
Audio, camera and location material is streamed to the agency through an encrypted channel separated from the handset's ordinary data path.
Operational context
The operative works inside a group that watches local network traffic. Uploads from the handset's own data connection would appear as an anomaly and point straight back at the operative.
Controls in place
Telemetry streamed over the protected out-of-band transport rather than the standard cellular data path.
Payloads encrypted with keys anchored to the hardware implant.
Retention in the agency's own infrastructure instead of a third-party cloud.
Protection outcome
Material reaches the agency without announcing itself in the operative's visible network activity, and without passing through a provider that a foreign request could reach. Evidence that is never exposed in transit cannot be intercepted on the way.
Encrypted transport record + agency-side receipt
SC-03
From capture to court: a custody chain that holds
Every item is timestamped at capture, hashed on arrival and held in the agency's own environment, so the exhibit in court is the one that left the handset.
Operational context
Defence counsel challenges a recording: how do you know it has not been edited, and how do you know when it was made?
Controls in place
Capture timestamp generated at the device and preserved through the pipeline.
Cryptographic hash of each item recorded on arrival at the agency.
The original item retained alongside any transcript or excerpt used in the case file.
Protection outcome
The hash proves the file the analyst worked on is identical to the one delivered, and the capture timestamp fixes when it was made. With the access log, the challenge is answered from the record rather than from trust.
Hash manifest + access audit trail
SC-04
Compartmentalized access to sensitive evidence
Only the officers assigned to an operation see its material, and every view is recorded - the evidence is protected from internal leak as carefully as from outside intrusion.
Operational context
A case depends on a source inside a local unit. Investigators need the material, but circulating it through a wider organization would expose the source and could taint the evidence.
Controls in place
Role-based access to operations and to the items collected under each one.
Administrator control over who is enrolled, who may task a device and who may export evidence.
Audit records of every access and export event.
Protection outcome
The evidence sits in one controlled location with a named list of who may see it. When an item is contested, the access log shows every hand it passed through - or that it never left the assigned team.
Access log + export register
SC-05
Seizure contingency for the operative's handset
If the operative is stopped and the phone is taken, the intelligence layer is encrypted at rest, isolated from the everyday file system, and the session can be revoked immediately.
Operational context
The operative is detained at a checkpoint and the handset is confiscated for examination. The examination will look for applications, accounts and anything that ties the operative to an agency.
Controls in place
Intelligence stored separately from the Android file system and encrypted at rest.
Remote revocation of the device session from the dashboard, after which no tasking is accepted.
Persistence of the intelligence layer across reboots and factory resets, so oversight resumes when the device returns.
Protection outcome
The examination finds a normal handset. The material already delivered to the agency is untouched, because it was never held only on the device. The operation's evidence survives the loss of the phone.
Session revocation record
Evidence handling
From a voice in a room to an exhibit in a file
A recording is only evidence when it can be placed, protected and accounted for. The platform carries each item through four stages, and each stage leaves a trace.
01
Capture on the handset
Audio, images, messages, location and documents are collected on the enrolled device under the operation's authorization.
02
Anchor in time and place
Each item is stamped at capture and tied to location, network and device identifiers, so it can be placed rather than assumed.
03
Encrypted relay
Material travels to the agency over the protected channel, never over the handset's visible data path.
04
Custody, hash and export
Items are hashed on arrival, stored in agency infrastructure, access-logged, and exported as a case package for review or court.
Agency deployment under a documented lawful mandate
This platform is provided exclusively to government intelligence agencies, police departments and law enforcement organizations for the authorized monitoring, protection and coordination of their undercover operatives. Every operation requires lawful authority within the acquiring jurisdiction, and the acquiring agency remains responsible for the authorization covering each enrolled device. We do not provide the platform for unauthorized surveillance, stalking, or use outside a lawful investigation. Each request is reviewed before any acquisition, and all deliveries are conditional upon acceptance of our legal notice.