This challenge is open to sole innovators, industry, academic and research organisations of all types and sizes. There is no requirement for security clearances.

Solution providers or direct collaboration from countries listed by the UK government under trade sanctions and/or arms embargoes are not eligible for HMGCC CoCreation challenges.

Collaboration is encouraged but the maximum budget per challenge will remain the same.

When apps are installed on mobile devices, they can typically access certain types of information about a phone and how it is used. Core collection tools used are:

• Advertising IDs – a unique device specific code to track digital advertising.
• Advertising software development kits – code in apps that harvest data.
• Pixels and cookies – code trackers embedded in websites and mobile browsers that follow a user’s behaviour.
• Device fingerprinting – combining technical details to uniquely identify a device without using cookies.

Types of data gathered include:

• Geolocation of the device.
• Device status such as IP address and battery level.
• Behavioural activities, such as which app is being used and for how long.

Although the information is usually anonymised, in practice it can often be linked to email addresses or phone numbers. Coupled with this, companies can sometimes sell or share this data with brokers who may then aggregate, build device-level movement histories, and resell this to advertisers.

For privacy sensitive individuals, such as those working in national security and defence, this creates a direct threat to their identity and safety.

There are existing tools that can reduce data exposure, including VPNs, advertising blockers and privacy-first browsers. While these can be useful, some information is always needed to allow the app to work properly. This challenge is looking to minimise what is revealed and actively manage the aggregated risk of data exposure.

HMGCC Co-Creation is seeking a simple to use, on-device solution that enables a user to monitor their data exposure, that can:

• capture as much advertising related information as possible
• aggregate the data into a simple understandable feed
• present a clear visual data exposure / risk dashboard

Gwen is an undercover officer. Most of her work is done from the passenger seat of a patrol car, sometimes for hours at a stretch. She needs a dedicated work phone so she can stay in touch with her team and receive emergency alerts, but she also needs to be sure the phone isn’t a hidden back-door for hostile actors.

She has installed the new data-footprint tracker on her device. At regular intervals, she opens a single dashboard and instantly sees a colour-coded list of every app that has spoken to an advertising network, the time of each connection, and the type of identifier that was transmitted (for example device ID, location, OS version).

When she taps on a row, the app explains in plain English: “The ‘NewsToday’ app sent a request to ‘ads.doubleclick.net’ at 14:32, including your unique ID and approximate location. This is used to build a behavioural profile for targeted ads.”

With this clear picture of her data footprint, she can see what data has left her phone and, if needed, contact her security team for advice.

The focus of this challenge is to package mature techniques for monitoring advertising-tracking on internet connected devices, visualise the collected data, and deliver a user-friendly interface that can be interrogated by non-technical users. The outcome, following the 12-week project, should be a demonstrator to a minimum Technology Readiness Level (TRL) 5 – technology basic validation in a relevant environment. The software should be demonstrated to the sponsors.

Essential requirements:

• Capture advertising-related network traffic.
• Store data locally with no cloud upload and ability to export data.
• Present a clear, colour-coded dashboard on the phone.
• Include a description for each entry.
• Deliver a prototype that runs on a single common mobile operating system.

Desirable requirements:

• Provide a data export facility, to aid retrospective analysis of aggregated data.
• A prototype that runs on multiple common mobile operating systems.

Constraints:

• All processing must stay on the device – no external servers.
• No specialised hardware beyond a standard consumer smartphone.

Not required:

• Horizon scanning.
• Re-packaging of a third-party commercial system.
• Full commercial-grade hardening for large-scale deployment.

HMGCC Co-Creation will be hosting a two-stage competition process:

Phase 1. The objective is to rapidly assess one-page proposals. Phase 1 applications must be no more than one page or one slide in length (excluding title pages, references, personnel CVs and organisational profiles). Following assessments, the successful applicants will be invited to submit a more in-depth proposal in phase 2. There will be feedback given to the successful applicants to aid their full proposal submission.

Phase 2. Following a feedback phase, successful phase 1 applicants will be requested to submit a proposal directly to cocreation@hmgcc.gov.uk. Phase 2 applications must be no more than six pages or six slides in length (excluding title pages, references, personnel CVs and organisational profiles).

Successful phase 2 applicants will be invited to a pitch day, giving them a chance to meet the HMGCC Co-Creation team and pitch the proposal during a 20-minute presentation, followed by questions. After the pitch day, a final funding decision will be made. For unsuccessful applicants, feedback will be given in a timely manner.