About this investigation

How this investigation was conducted

This investigation was conducted by a small team of industry participants over more than a year. One member of the team is a Russian speaker who joined to help with the Russian-language Telegram corpus and the controlled outreach experiment that produced much of the public record on this site. All members are people who work, or have worked, inside U.S. wireless tower-construction.

This investigation was conducted with substantial AI assistance under human direction and review. AI tools handled the bulk of the language-intensive work: reconstructing conversation threads, decoding Russian slang and code-switched text (English written in Cyrillic letters and Russian written in Latin letters), translating quoted material, surfacing candidate findings from roughly 30,000 messages spanning more than five years, and drafting much of the prose presented here. To reduce error, four independent AI-assisted analyses of the group chats were run in parallel and then reconciled into a single dataset. Human oversight was applied at every stage. Every finding was reviewed by a member of the investigation team and anchored to a specific message ID, with the verbatim Russian text and an English translation preserved alongside it for verification. The interpretive work — the editorial framings on the per-company pages and the structural arguments in the Open Letter — was produced with AI assistance and finalized under the investigation team's review and judgment. Every conclusion was checked against the underlying evidence before publication. Errors may remain; the substantial majority of the conclusions are accurate.

Investigator anonymization

The corpus this publication draws from was assembled by the investigation team. The team member whose Telegram account joined the source channels and posted into the corpus has been anonymized at the data layer: that member's numeric Telegram identifier — the unique ID Telegram assigns to every account — has been replaced throughout the site with the literal value 0000000000, and any place a name would otherwise appear renders the word Investigator. The substitution is consistent across every page: company narratives, finding modals, person-page cross-references, and the message context windows that surround each citation.

The investigation team is anonymized to protect the source of evidence, not to obscure it. The corpus itself remains the public record; the publication's editorial role is to surface that record without putting the people who assembled it at risk.

Severity & provenance definitions

Severity

CRITICAL
Direct evidence of unsafe work, undocumented hire, wage theft of a magnitude that endangers a worker's livelihood, or coercive employment relationships. Surfaces in the corpus as a quoted statement of practice or a quoted recruiter pitch.
HIGH
Substantial breach of regulation or contract that does not meet the immediate-harm bar of CRITICAL: shell-LLC payroll routing, cert-seller activity, supplier-chain misrepresentation, or recruiting through banned channels.
MEDIUM
Material editorial concern that is documented but does not on its own constitute a regulatory breach: ambiguous chain-of-custody, vague legal status of an arrangement, or pattern evidence that requires aggregation across messages to be load-bearing.
LOW
Background context that anchors a higher-severity finding: roster confirmations, ambient mentions of company names, or one-off references that did not develop into structured arrangements.

Provenance

PROVEN
Direct quoted statement of a practice by a participant in that practice. The Russian-language quote is in the corpus and is reproduced verbatim in the citation modal.
INFERRED
Strong pattern evidence across multiple messages, each individually circumstantial, that converges on a conclusion. The (i) marker following the label flags this provenance class on every surface.
ALLEGED
A claim made by one participant about another, where the corpus contains the assertion but no corroborating quoted statement of the practice itself. The (?) marker following the label flags this provenance class on every surface.

Identifier convention in evidence surfaces

Evidence surfaces — the citation modal's context windows, finding-card metadata strips, and source-meta rows — surface speaker identity as three orthogonal pieces of data:

Telegram Name
The display handle the speaker chose for themselves on Telegram. May be a real name ("Andrei Lysevich"), a single letter ("A"), an emoji ("🤗"), a self-styled title ("vice president"), or any other string the user set. Surfaced verbatim from the corpus, with no editorial intervention.
Telegram UID
The numeric Telegram account identifier. Always shown alongside the Telegram Name. The investigation team's anonymized account UID 0000000000 always renders as Investigator with the parenthetical (anonymized); no team member is ever named.
Speaker role
When present, an editor-curated descriptor of who this person is in the context of a specific finding (for example, "insider witness" or "PA Group LLC recruiter"). Distinct from the Telegram Name: the role is the editorial framing, the name is the corpus data. When the editor has not curated a role for a finding, the row is omitted rather than fabricated.

The Telegram Name surfaces on every finding regardless of how the user chose to present themselves on Telegram — including surnames, single letters, emojis, and self-styled titles. The "no surnames in narratives" editorial rule, which governs the prosecutorial prose on the company pages and the open letter, does not apply to evidence-surface display. Evidence surfaces show the corpus as it is; disambiguation reaches the reader through the Speaker role label, not through name suppression.

Compliance-positive operators

The companies index distinguishes operators that produced explicit compliance-positive evidence in the corpus and have zero proven CRITICAL or HIGH severity adverse findings. The classification is computed by a deterministic build-time rule applied to the same finding records that drive every other count on the site: a company qualifies if at least one finding shows it affirmatively requiring documentation, work authorization, or W-2 status, and no finding attributed to it carries PROVEN provenance at CRITICAL or HIGH severity.

Six operators currently meet that bar. They are documented as the counter-examples that demonstrate the LLC scheme is a choice the rest of the documented industry made, not a necessity imposed by the work itself.

What is not in this investigation

  • No subpoena power. The investigation team did not compel the production of documents from any company, carrier, or individual.
  • No carrier-side records. Internal records from Tier-1 wireless carriers — site-management contracts, vendor compliance audits, badge-access logs — are not in the corpus.
  • No payroll evidence. No W-2 forms, 1099 forms, payment-processor records, ACH transfers, or bank statements were obtained. Findings about payroll routing rest on quoted statements of practice from recruiters and workers, not on payment records.
  • No comprehensive coverage. The corpus is bounded by what the three source channels and the 29 DM threads (about 25 produced documented findings) contained. Companies absent from those channels do not appear here. The investigation does not assert that the 93 companies represent the complete population of operators in U.S. wireless tower construction.

Unproven allegations preserved as editorial framing

Three structural-corroboration claims surface on the per-company pages and in the Open Letter as ALLEGED, not asserted as fact. They appear in the published record because the structural patterns they sit on top of are documented elsewhere in the corpus — the patterns are corroborated; the underlying transfers, payments, or arrangements named in the claims are not.

The publication's standard for these claims is consistent across every surface they appear on. ALLEGED claims are marked with the (?) provenance label. Narrative prose says who alleges, not that the practice occurred. The claims name the parties — the subcontractor, the prime, the role of the named individual where one is named — without certifying the underlying transfer.

The full account of the three claims, including the originating tips that began the investigation and the corpus material that corroborates the structural patterns, is in the Open Letter. The relevant per-company pages are TSC Construction, LLC, 4Tech, and UTT Group / Sparta Telecom.

A federal inspector general, the Department of Labor's Wage and Hour Division, a properly resourced state attorney general, or a federal grand jury with subpoena power could verify or rule out any of these claims in a matter of weeks. Until that work is done, the publication preserves them on the record without certifying them.

These three claims, and every other unproven allegation on this site, are collected and labeled on the What Is Alleged — and Not Proven page.

Corrections and removals

Companies or individuals named on this site who believe a finding is inaccurate, incomplete, or misleading may submit documentation for review through the channels listed on the Contact page. Please include the specific finding identifier (for example, m0073), the page on which the finding appears, the substance of the disputed claim, and any supporting documentation you can provide.

All correction requests are read. The investigation team will review the supporting documentation and decide on a case-by-case basis whether to issue a correction, clarification, or removal.

Before you read

The Shadow Zone Investigation documents labor violations in U.S. wireless tower construction — including wage theft, undocumented-labor schemes, fraudulent safety certifications, child labor, and immigration coercion. 339 documented findings across 93 named subcontractors and 384 individuals. Anonymous investigation team.

Three editorial commitments:

  • Every finding carries a PROVEN, ALLEGED, or INFERRED label. The label is the editorial commitment, not decoration.
  • Russian-language source quotes are preserved verbatim, with English translations.
  • Three corruption allegations against named primes are framed as ALLEGED throughout. The corpus does not prove them. They are surfaced because named industry sources, separately, raised them. Every unproven allegation on this site is collected on the What Is Alleged — and Not Proven page.

Mistakes may exist. The corpus runs to ~30,000 messages over 5+ years; translations were AI-assisted across four independent analyses. Some errors likely remain. To report a factual error or dispute a finding's framing, see the corrections policy on the About page.