Building Accountability into the Internet of Things



The Internet of Things (IoT) will embed computing in millions of mundane objects distributed throughout everyday life. This array of Internet-enabled things will generate even greater amounts of personal data, which is a matter of widespread concern. On the one hand it concerns industry and government, as personal data is seen as the new currency that oils the wheels of the digital economy. On the other, it concerns citizens as it is their data and data about them that is being exploited, and in largely unaccountable and uncontrollable ways.

This fellowship seeks to address both of these concerns. It exploits ethnographic studies to understand human data interaction practices, and the interactional work that is involved in leveraging sensor-based data to deliver innovative digital services. And it exploits these studies to inform the development of a technological platform that enables accountable, user controlled, personal data processing by industry and government alike. The platform is called the IoT-Databox, and it was first unveiled at the Mozilla Festival in October 2016.


The basic gist of the IoT-Databox platform is that parties who would consume personal data generated by IoT devices build apps that can be downloaded and installed on a physical device – the IoT-Databox – which acts as a gateway to an individual’s or a household’s IoT data. Apps are accompanied by interactive service level agreements that account for data usage as per the requirements of general data protection regulation, and allow people to exercise fine-grained granular choice over data collection and processing. Apps do not send raw personal data back to third parties, but rather process data locally and either send back the results of a query run by an app on the box to a third party or perform some local actuation in response to local data processing.

The IoT-Databox Ecology (see Crabtree et al. 2016)

The IoT-Databox is unique in its approach to the use of personal data generated by IoT devices. Instead of putting that data online, processing is done on the box, and data transfer is thus highly constrained. The benefits of this are not only that citizens can control the flow of personal data, but that in doing so data transfer is minimised and even entirely dispensed with. This means that third party risks and costs of handling personal data are significantly constrained too.

The IoT-Databox is being further developed in partnership with Hamed Haddadi (Queen Mary University London) and Richard Mortier (Cambridge Computer Lab) in the Databox project. The IoT-Databox ecology is outlined in the figure below and the IoT-Databox SDK, including an adapted Node Red app building environment, can be downloaded here, though please note the software is the early stages of development and subject to major upgrades.

This fellowship is funded by the Engineering and Physical Sciences Research Council, grant EP/M001636/1, and supported by the BBC, BT, the Digital Catapult and Unilever. If you would like to know more about the IoT-Databox, or wish to become a fellowship partner, please contact Further outputs, including publications, emerging from the fellowship can be found below.



Chamberlain, A., Crabtree, A., Haddadi, H. and Mortier, R. (2017) “Editor’s note: special theme on privacy and the Internet of Things” Personal and Ubiquitous Computing, Online First: DOI 10.1007/s00779-017-1066-5

Tolmie, P. and Crabtree, A. (2017) “The practical politics of sharing”, Personal and Ubiquitous Computing, Online First: DOI 10.1007/s00779-017-1071-8

Crabtree, A., Tolmie, P., Knight, W. (2017) “Repacking privacy for a networked world”, Computer Supported Cooperative Work: The Journal of Collaborative Computing and Work Practices, vol. 26 (1), pp. 453-488.

Fischer, J., Crabtree, A., Colley, J. and Rodden, T. (2017) “Data work: how advisors and clients make IoT data accountable”, Computer Supported Cooperative Work: The Journal of Collaborative Computing and Work Practices, vol. 26 (1), pp. 597-626.

Crabtree, A., Lodge, T., Colley, J., Greenghalgh, C. and Mortier, R. (2017) “Accountable IoT? Outline of the Databox model”, International Symposium on a World of Wireless, Mobile, and Multimedia Networks, pp. 1-6, Macau, IEEE.

Sailaja, N., Crabtree, A. and Stenton, P. (2017) “Challenges of using personal data to drive personalised electronic programme guides”, Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, pp. 5226-5231, Denver, ACM.

Perera, C., Wakenshaw, S., Baarslag, T., Haddadi, H., Bandara, A., Mortier, R., Crabtree, A., Ng, I., McAuley, D. and Crowcroft, J. (2017) “Valorising the IoT Databox: creating value for everyone”, Transactions on Emerging Technologies, vol. 28 (1), DOI 10.1002/ett.3125


Mortier, R., Zhao, J, Crowcroft, J., Li, Q., Wang, L., Haddadi, H., Amar, Y., Crabtree, A., Colley, J., Lodge, T., Brown, A., McAuley, D. and Greenhalgh, C. (2016) “Personal data management with the Databox: what’s inside the box?”, Proceedings of the ACM Workshop on Cloud-Assisted Networking, pp. 49-54, Irvine, ACM.

Crabtree, A., Lodge, T., Colley, J., Greenhalgh, C. and Mortier, R. (2016) “Building accountability into the Internet of Things”, Social Science Research Network, DOI 10.13140/RG.2.2.27512.44803

Crabtree, A. and Mortier, R. (2016) “Personal data, privacy and the Internet of Things: the shifting locus of agency and control”, Social Science Research Network, DOI 10.13140/RG.2.2.34496.12809

Mortier, R., Haddadi, H., Henderson, T., McAuley, D., Crowcroft, J. and Crabtree, A. (2016) “Human Data Interaction”, Encyclopedia of Human-Computer Interaction, Chapter 41, Interaction design Foundation.

Crabtree, A., Lodge, T., Colley, J., Greenhalgh, C., Mortier, R. and Haddadi, H. (2016) “Enabling the new economic actor: data protection, the digital economy, and the Databox”, Personal and Ubiquitous Computing, vol. 20 (6), pp. 947-957.

Fischer, J., Crabtree, A., Rodden, T., Colley, J., Costanza, E., Jewell, M. and Ramchurn, S. (2016) “‘Just whack it on until it gets hot’ - working with IoT data in the home”, Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, May 7-12, San Jose, ACM.

Crabtree, A. (2016) “Enabling the new economic actor: personal data regulation and the digital economy”, The 2nd IEEE Worksop on Legal and Technical Issues in Cloud Computing and Cloud-supported Internet of Things, April 8, Berlin, IEEE.

Tolmie, P., Crabtree, A., Rodden, T., Colley, J. and Luger, E. (2016) “‘This has to be the cats’ - personal data legibility in networked sensing systems”, Proceedings of the 19th Conference on Computer Supported Cooperative Work, pp. 491-502, San Francisco, ACM.

Crabtree, A. and Tolmie, P. (2016) “A day in the life of things in the home”, Proceedings of the 19th Conference on Computer Supported Cooperative Work, pp. 1738-1750, San Francisco, ACM.


Crabtree, A. and Mortier, R. (2015) “Human data interaction: historical lessons from social studies and CSCW”, Proceedings of the 14th European Conference on Computer Supported Cooperative Work, pp. 1-20, Oslo, Springer.

Button, G., Crabtree, A., Rouncefield, M and Tolmie, P. (2015) Deconstructing Ethnography: Towards a Social Methodology for the Design of Ubiquitous Computing and Interactive Systems, London: Springer.



Sarajevo Unlimited, The Living Room of the Future in collaboration with the British Council, BBC R&D, and the Foundation for Art and Creative Technology (FACT), November 2-5, Sarajevo.

Mozilla Festival, Decentring Personal Data Analytics, October 28, Ravensbourne College, London.

Mozilla Festival, Databox Hack Day, October 26, RSA House, London.

Cabinet Office Policy Lab, “Design Research”, September 20, 1 Horse Guards Road, London.

Foreign and Commonwealth Office UK - Japan Socio-Cyber Physical Systems Workshop,  September 7-8, Japanese Embassy, Toyko.

BT Innovation Showcase, Databox in a “Smart World”, June 12-16, Adastral Park, Ipswich.

Smart Energy GB Roundtable, Leveraging Energy Data for Digital Health and Care Monitoring, May 2, London.


Mozilla Festival, Databox: Hack an App, October 29-30, Ravensbourne College, London.

Mozilla Festival, The Kitchen Databox Demo in collaboration with BBC R&D, October 29, Ravensbourne College, London.


EC Roundtable, Personal Information Management, November 27, Brussels

Horizon Digital Economy Research Institute, Privacy and Trust in the Digital Economy, March 10, DE Hub

DE Catapult Roundtable, Proposals for the Budget IoT Investment Package, Feb 2, London

Ofcom Workshop, Digital Media and Big Data, January 14, Nottingham


EP/N028260/1 Databox: Privacy-Aware Infrastructure for Managing Personal Data, £1,230, 248

EP/N014243/1, Future Everyday Interaction with the Autonomous Internet of Things, £806,241

EP/M02315X/1, From Human Data to Personal Experience, £4,062,954