Built at Data Sovereignty & Responsible AI · submitted 20 September 2026
TraceGuard — Privacy-Preserving Analytics Pipeline for Mobile Network Telemetry TraceGuard is a data-sovereignty engineering project that turns raw mobile-network event-window telemetry (per-subscriber/device throughput, latency, data-volume, and location metadata) into analytics-ready datasets that minimise re-identification risk while preserving statistical utility. The dataset combines direct identifiers (MSISDN, IMSI, IMEI) with fine-grained spatiotemporal fields (enb, time_start, province) and behavioural signals (app-category usage, video/audio volume, tethering). Individually these look like standard network KPIs; combined, they form a movement and behaviour trace — de Montjoye et al. (2013) showed just four spatiotemporal points uniquely identify ~95% of individuals in comparable mobile datasets. TraceGuard treats that as the central design constraint, not an afterthought. What it does: Strips and re-keys direct identifiers — MSISDN/IMSI/IMEI are dropped or replaced with keyed HMAC-SHA-256 pseudonyms (key held outside the repo/dataset), never plain hashes. Generalises quasi-identifiers — enb is clustered to coarser cell-areas, time_start rounded to hour/day, rare cell/time combinations suppressed. Enforces measurable k-anonymity — rather than assuming anonymisation worked, the pipeline computes and reports uniqueness/k-anonymity on its own output (docs/anonymisation-report.md), following ISO/IEC 20889 and NIST SP 800-188 methodology. Aggregates behavioural fields (data volume, app category, media usage) into bands to reduce profiling/inference risk. Documents every privacy design decision against its legal basis — GDPR Art. 5/25/32, ePrivacy Arts. 6 & 9, WP216's three anonymisation tests (singling out, linkability, inference) — so outputs can be defended to a DPO, not just an engineer. Why it matters for a Data Sovereignty hackathon: the project demonstrates that "anonymisation" is a verifiable engineering property, not a label — pseudonymisation ≠ anonymisation (GDPR Art. 4(5), EDPB Guidelines 01/2025), and claims of anonymity must be tested, not assumed. It also models safe agent/AI-assisted workflows around sensitive telecom data (strict raw-data handling rules, synthetic-data-only testing, no data egress to third-party tools), which is directly relevant to any hackathon environment where external participants or AI tooling touch real personal data. Tech scope: Python-based pipeline (src/) run only by humans in a controlled environment; unit tests use synthetic/Faker-style fixtures only; raw CSVs are gitignored and never committed or fed to external services.
