About a year ago Telefonica's startup accelerator Wayra got a mystery visit from British intelligence agency GCHQ.
Two months later, a phone call: "GCHQ is opening an accelerator and they're accepting bids," remembers Wayra director Gary Stewart. "We said, OK, let's do it."
Three months ago GCHQ launched its first ever Cyber Accelerator, designed to bring new, innovative ideas into the highly secretive organisation and provide technical and commercial mentoring to a set of selected startups. Last week the programme drew to a close with an event at Cheltenham Race Course, just a few miles away from GCHQ's infamous 'Doughnut' building.
GCHQ – short for Government Communications Headquarters – is a secretive signals intelligence agency that was barely known until the 1970s. The organisation recently gained newfound infamy in the wake of the leaks from Edward Snowden, a contractor for the GCHQ's counterpart in the USA, the National Security Agency, when it emerged that both GCHQ and the NSA had been collaborating on a worldwide surveillance dragnet and other wide-reaching information gathering capabilities.
"It was July when we won the bid, and in September and October we started to announce it to the world," Wayra's Gary Stewart said, speaking at the event. "For the first time Wayra was in the news in Iran and in China." The three-month scheme was launched in January this year.
Opening the event, the director general for technology at GCHQ said that the threat landscape is "constantly changing, constantly evolving, and that is constantly challenging us and our colleagues."
"Innovation is the lifeblood of our business," he said. "It's as true today as it was in our formative years in Bletchley Park – we are only effective today because of the innovation we did yesterday."
Verimuchme is a digital wallet for personal identification, while Cyberowl is an early-warning system for cyber attacks. Cybersmart automates implementation, certification and compliance across security standards. Elemendar is described by Wayra as a "collective intelligence platform that provides data visualisations to make sense of complex, uncertain, or volatile issues". Spherical Defence a "banking API intrusion detection system that uses deep learning to detect hacking attempts by establishing a baseline of normal communication".
StatusToday is a platform that uses machine learning to try to make sense of human behaviour in the workplace, including insider attacks but also defending against plain human error. Speaking with Techworld, StatusToday's cofounder Ankur Modi said that the incubator had been essential in advancing his business.
"The incubator was an interesting experiment for us," Modi said. "As a very young startup in the UK, we have been very keen to engage with GCHQ to understand how to mature the technology and the business.
"One of the things it's helped us with is we got access to very senior experts within GCHQ, both technical and commercial, who helped us refine the technologies. Our machine learning capabilities, I would say, certainly have improved as a result of the conversations and discussions we've had with them – around what are the things that really matter when it comes to threat and risk, and what are the things that don't have that big a damage impact."
Chris Ensor of the UK's new National Cyber Security Centre (NCSC), which ran the programme, told Techworld that as well as helping the startups, the accelerator also brought fresh ideas into the 'razor-wired' GCHQ.
"From an NCSC perspective, the role of the NCSC is to help protect the UK," Ensor said. "To do that you need product services, all sorts of things organisations can buy and use. We don't have a monopoly on what those things should be, but industry's got some really great ideas – and particularly small startups who have new concepts and new ways of doing things, and can work in an agile way."
"What we want to do is combine our understanding of the problem space, the challenges organisations face in securing themselves, with those innovative ideas and with our experts. So that's kind of what we're trying to do – to work beyond the razor wire of GCHQ in a much more agile and sometimes interesting environment, with a lot of new ideas and new people."
The help afforded by GCHQ was largely technical mentoring but the programme also introduced the startups to potential customers and investors.
According to StatusToday's Modi, who opened his five-minute pitch with the James Bond theme on loop, the incubator helped introduce the company to serious movers and shakers in the technology and defence sectors. The startup is now in talks with the enormous defence manufacturer BAE Systems.
"We were able to interface with some of the largest tech and defence companies out there to see how our technology could potentially help them enhance the capabilities they are providing to national infrastructure, critical infrastructure," Modi said. "We talk to the right folks, we have already had conversations, and we were able to accelerate our engagement."
According to Modi, the fact that the company had vetting from GCHQ was also helpful in networking with the right people at the right companies.
"The accelerator allowed us to increase our credibility and presence," he explained. "In January I got listed by Forbes as 30 Under 30, and we were invited to Parliament where I talked to the All Party Parliamentary Group on AI, and how we imagine AI will change the UK's landscape.
"It's helped us massively to put us in a more central position, to say we're not a random startup using the buzzword of AI – that I hate, honestly – we are doing something that can have a meaningful impact not just on data protection but actually the way companies are run today."
This won't be the last incubator, according to the NCSC's Chris Ensor. The reaction from all of the startups was positive, and this first programme served as an experiment to figure out where to go to next.
What will be different about the next run? Ensor explained that there could be more of a focus on "selecting the problem set" – specifically, which problems the accelerator would hope to solve, plus getting in as many technical experts from within the organisation as possible.
"Next time we do it we'll try something different, we'll have a longer period to work with the startups," he said. "It will be another experiment, to see how we as an organisation that lives behind razor wire, works with industry, with startups, and we'll continue to learn as we go."