The challenge

Key Information

HMGCC Co-Creation will be hosting a two-stage competition process.

Phase 1. The objective is to rapidly assess one-page proposals. Those unsuccessful will be informed with feedback. Successful applicants will be invited to phase 2. For further information please see How to apply – phase 1.

Phase 2. Following a feedback phase, successful phase 1 applicants will be requested to submit a proposal directly to [email protected]. For further information please see How to apply – phase 2.

Context of the challenge

When apps are installed on mobile devices, they can typically access certain types of information about a phone and how it is used. Core collection tools used are:

• Advertising IDs – a unique device specific code to track digital advertising.
• Advertising software development kits – code in apps that harvest data.
• Pixels and cookies – code trackers embedded in websites and mobile browsers that follow a user’s behaviour.
• Device fingerprinting – combining technical details to uniquely identify a device without using cookies.

Types of data gathered include:

• Geolocation of the device.
• Device status such as IP address and battery level.
• Behavioural activities, such as which app is being used and for how long.

Although the information is usually anonymised, in practice it can often be linked to email addresses or phone numbers. Coupled with this, companies can sometimes sell or share this data with brokers who may then aggregate, build device-level movement histories, and resell this to advertisers.

For privacy sensitive individuals, such as those working in national security and defence, this creates a direct threat to their identity and safety.

The gap

There are existing tools that can reduce data exposure, including VPNs, advertising blockers and privacy-first browsers. While these can be useful, some information is always needed to allow the app to work properly. This challenge is looking to minimise what is revealed and actively manage the aggregated risk of data exposure.

HMGCC Co-Creation is seeking a simple to use, on-device solution that enables a user to monitor their data exposure, that can:

• Capture as much advertising related information as possible.
• Aggregate the data into a simple understandable feed.
• Present a clear visual data exposure / risk dashboard.

Example use case

Gwen is an undercover officer. Most of her work is done from the passenger seat of a patrol car, sometimes for hours at a stretch. She needs a dedicated work phone so she can stay in touch with her team and receive emergency alerts, but she also needs to be sure the phone isn’t a hidden back-door for hostile actors.

She has installed the new data-footprint tracker on her device. At regular intervals, she opens a single dashboard and instantly sees a colour-coded list of every app that has spoken to an advertising network, the time of each connection, and the type of identifier that was transmitted (for example device ID, location, OS version).

When she taps on a row, the app explains in plain English: “The ‘NewsToday’ app sent a request to ‘ads.doubleclick.net’ at 14:32, including your unique ID and approximate location. This is used to build a behavioural profile for targeted ads.”

With this clear picture of her data footprint, she can see what data has left her phone and, if needed, contact her security team for advice.

Project scope

The focus of this challenge is to package mature techniques for monitoring advertising-tracking on internet connected devices, visualise the collected data, and deliver a user-friendly interface that can be interrogated by non-technical users.

The outcome, following the 12-week project, should be a demonstrator to a minimum Technology Readiness Level (TRL) 5 – technology basic validation in a relevant environment. The software should be demonstrated to the sponsors.

Essential requirements:

• Capture advertising-related network traffic.
• Store data locally with no cloud upload and ability to export data.
• Present a clear, colour-coded dashboard on the phone.
• Include a description for each entry.
• Deliver a prototype that runs on a single common mobile operating system.

Desirable requirements:

• Provide a data export facility, to aid retrospective analysis of aggregated data.
• A prototype that runs on multiple common mobile operating systems.

Constraints:

• All processing must stay on the device – no external servers.
• No specialised hardware beyond a standard consumer smartphone.

Not required:

• Horizon scanning.
• Re-packaging of a third-party commercial system.
• Full commercial-grade hardening for large-scale deployment.

Eligibility

This challenge is open to sole innovators, industry, academic and research organisations of all types and sizes. There is no requirement for security clearances.

Solution providers or direct collaboration from countries listed by the UK government under trade sanctions and/or arms embargoes, are not eligible for HMGCC Co-Creation challenges.

Invitation to present

Successful phase 2 applicants will be invited to a pitch day, giving them a chance to meet the HMGCC Co-Creation team and pitch the proposal during a 20-minute presentation, followed by questions.

After the pitch day, a final funding decision will be made. For unsuccessful applicants, feedback will be given in a timely manner.

Clarifying questions

Clarifying questions or general requests for assistance can be submitted directly to [email protected] and  [email protected] before the deadline with the challenge title as the subject. These clarifying questions may be technical, procedural, or commercial in subject, or anything else where assistance is required. Please note that answered questions will be published to facilitate a fair and open competition.

How to apply

Please submit your application on the HMGCC Co-Creation website. Any queries please email [email protected] and [email protected].

Please refer to the information document linked below for further scoring criteria for phases 1 and 2.

All information you provide to us as part of your application will be handled in confidence.