OSW-FutureG SBIR OSW26BZ06-NV028: 5G Signature Tracking Mitigation via Cyber Deception
Quick Answer
OSW26BZ06-NV028 is a Phase I SBIR topic under the OSW FutureG Office, FY26 SBIR Broad Agency Announcement, Release 6. When military and government personnel use commercial cellular networks abroad, the metadata their phones generate is enough for an adversary to map their routines, spot when something unusual is happening, and locate sensitive facilities. This topic funds a system that generates convincing fake cellular signatures to bury the real ones. The award is up to $323,090 over 6 months, with a 20-page technical volume. The topic opens September 23, 2026 and closes October 21, 2026 through the Defense SBIR/STTR Innovation Portal.
The threat model is stated concisely and it is worth reading twice. Accessing foreign mobile phone networks exposes individuals and organizations to surveillance and espionage threats due to their digital exhaust, meaning the metadata required to operate on a cellular network such as credentials, location data, and device identifiers. Adversaries can leverage this data to track daily routines, identify deviations indicating special events such as VIP visits or mission preparation, and map sensitive facilities based on cell phone concentration or periods of inactivity.
That last item is the subtle one. A facility can be identified not only by phones being present but by their absence, and a sudden change in the pattern is itself the signal. Any deception system has to be believable in both directions.
Phase I is a design study, not a build. Six months produces initial application concepts, algorithms, and a comprehensive design document outlining the software architecture, plus a detailed plan for a Phase II prototype effort aiming at Technology Readiness Level 7.
Topic At a Glance
Topic number: OSW26BZ06-NV028
Title: 5G Signature Tracking Mitigation via Cyber Deception
Agency: Office of the Secretary of War, FutureG Office, under OUSW(R&E)
Solicitation: OSW FutureG Office, FY26 SBIR Broad Agency Announcement, Release 6, Proposal Submission Instructions
Program type: Phase I
Base award: must not exceed $323,090
Base period of performance: 6 months
Technical volume limit: not to exceed 20 pages. Pages over 20 will not be considered in proposal evaluations
OUSW (R&E) Critical Technology Area: Contested Logistics Technologies (LOG)
Component Technology Priority Areas: FutureG, Emerging Threat Reduction, Sustainment and Logistics
Projected CMMC level requirement: Level 2 (Self)
Export control status: no topic-level ITAR or EAR restriction paragraph appears on this topic, and none appears on any of the three topics in this release
Phase II target: Technology Readiness Level 7, with follow-on Phase II funding of $2,153,927 over 18 months
Phase II form factors: hardened decoy boxes, for example Wi-Fi router-sized team devices and puck-sized personal devices
Technical and Business Assistance: Phase I up to $6,500, Phase II up to $50,000 per project, in addition to the cost ceilings and not subject to profit or fee, using the mandatory SBIR/STTR TABA Request Form in Volume 5
Percentage of Work: the FutureG Office will not accept any deviation to the POW requirements
Company Commercialization Report: information contained in the CCR will be considered by the FutureG Office during proposal evaluations
Topic open date: September 23, 2026
Proposal deadline: October 21, 2026
Submission portal: DSIP at dodsbirsttr.mil
Keywords: digital signature management, digital exhaust, operating on untrusted networks
The Objective and the Threat
The objective
The objective of this effort is to develop an advanced digital signature management and deception system that obfuscates cellular metadata, described as digital exhaust, to protect personnel, small units, and critical facilities from adversarial surveillance, tracking, and pattern-of-life analysis on third-party commercial networks.
Three protected entities are named, and they are different problems. An individual needs a personal device small enough to carry. A small unit needs coordinated signatures that do not contradict each other. A critical facility needs a persistent baseline of plausible activity that does not go quiet when the real population leaves.
The problem
As military and government personnel increasingly rely on commercial mobile networks, the management of digital signatures has become a critical operational concern.
Accessing foreign mobile phone networks exposes individuals and organizations to surveillance and espionage threats due to their digital exhaust, the metadata required to operate on a cellular network, for example credentials, location data, and device IDs.
Adversaries can leverage this data to track daily routines, identify deviations indicating special events, for example VIP visits or mission preparation, and map sensitive facilities based on cell phone concentration or periods of inactivity.
What that implies technically
The phrase "third-party commercial networks" is doing a lot of work. You do not control the network. The metadata that leaks is the metadata the network requires to function, which means you cannot simply suppress it and still have a working phone. The only options are to change what the metadata says, to add plausible metadata that dilutes the real signal, or both. The topic's answer is deception rather than suppression, and it names the two mechanics in the Phase I deliverable list: AI-persona generation and identity-swapping.
Note also that the adversary in this model is doing automated analysis at population scale, not manual surveillance of one target. That is why realism against machine learning matters more than realism to a human analyst, and the performance metrics reflect it.
Key Performance Metrics, Which You Must Propose Yourself
Proposers must define specific, relevant, measurable, and quantifiable key performance metrics for their proposed solutions. The topic offers suggested metrics with threshold and objective values, explicitly stated as including but not limited to the following four.
Persona capacity
The metric is AI-powered personas broadcast simultaneously per decoy device. The suggested threshold, meaning minimum success, is 2 personas. The suggested objective, meaning desired success, is 4 or more personas.
Two personas per device is the floor, which tells you the intended ratio: a decoy is not a one-to-one substitute for a phone, it is a multiplier. Four or more per device is where a small team's footprint becomes genuinely ambiguous.
Operational endurance
The metric is battery life for highly mobile and pluggable decoy form factors. The suggested threshold is 12 hours. The suggested objective is 24 to 36 hours.
Twelve hours is a working day. Twenty-four to thirty-six hours is an operational cycle without recharge. Note the phrase "highly mobile and pluggable," which suggests two power models, a carried battery-powered unit and a unit that plugs into available power, and the endurance metric applies to the mobile case.
System weight
The metric is the weight of the personal decoy device. The suggested threshold is under 2 pounds. The suggested objective is approximately 1 pound.
Two pounds for a carried radio with multiple simultaneous cellular personas and 12 hours of battery is a demanding target, and one pound is aggressive. The Phase II description calls the personal form factor puck-sized, which is the physical envelope to design against.
Obfuscation realism
The metric is the ability of AI-generated traffic to mimic realistic patterns of life to defeat automated network analysis. The suggested threshold is defeating basic heuristic analysis. The suggested objective is defeating advanced machine-learning-based behavioral tracking.
This is the metric that decides whether the system works, and it is the hardest to quantify. The threshold and objective are stated qualitatively, which means the burden is on you to make them measurable. That is exactly what the topic asks for when it says proposers must define specific, relevant, measurable, and quantifiable metrics.
A credible answer proposes an adversary model and an evaluation method. What classifier are you testing against, what features does it use, what does its detection rate look like against your generated traffic versus real traffic, and how do you avoid overfitting your generator to one detector. Proposing the red-team methodology is as important as proposing the generator, and most proposals will neglect it.
Why the metrics section deserves real effort
The topic says proposers must define the metrics and that the four above are suggestions. That is an invitation with a catch: a proposal that simply restates the four suggested metrics has not done what was asked. Add the metrics your architecture actually turns on. Plausible candidates include persona persistence over time, the number of distinct network attach events per hour and whether that rate is itself anomalous, geographic consistency between a persona's claimed movement and physically possible movement, cross-persona correlation, meaning whether your personas accidentally look like each other, and time to detection under sustained observation.
What Phase I Requires
During Phase I, proposers are required to present a comprehensive concept design and feasibility study for a digital exhaust deception system. Solutions should outline the proprietary software required to conduct AI-enabled mission planning and operations.
Phase I will consist of a six-month period of performance to develop the initial application concepts, algorithms, and a comprehensive design document that outlines the software architecture for future development and deployment.
Key activities
Phase kickoff, comprising a Technical Interchange Meeting and a Preliminary Design Review.
Before the end of Phase I, the performer must develop and present a detailed plan for addressing Phase II prototype development, testing, and evaluation, aiming to advance the technology from its current state to Technology Readiness Level 7.
Phase I deliverables
Kickoff and Technical Interchange Meeting slides.
Monthly Status Reports.
A Preliminary Design Document detailing AI-persona generation and identity-swapping mechanics.
A Phase II Plan.
A Final Phase I Report.
Reading the Phase I scope
This is a software architecture and algorithm effort with a formal design review, not a hardware build. Five deliverables in six months, three of which are reporting artifacts. The substantive output is the Preliminary Design Document, and the topic names its two required subjects precisely: AI-persona generation and identity-swapping mechanics.
Note "AI-enabled mission planning and operations." The system is not only a signature generator, it is a planning tool. Someone has to decide what personas to run, where, for how long, and with what pattern, and the topic says the software supports that decision. Address the operator's workflow, not just the signal generation.
Note also the phrase "advance the technology from its current state to TRL 7." TRL 7 means a prototype demonstrated in an operational environment. A six-month Phase I design study followed by an 18-month Phase II reaching TRL 7 implies you are starting well above TRL 1. Be explicit in your proposal about your actual current maturity, because the Phase II plan has to be credible against it.
Phase II, For Planning Purposes
Phase II proposals may only be submitted by Phase I awardees. For successful Phase I efforts, there may be a follow-on Phase II topic released within six months of Phase I completion, and Phase II efforts may be funded at $2,153,927 for an 18-month period of performance.
A Phase II follow-on effort will focus on prototype production, testing, and evaluation to reach a TRL 7 capability. The effort should result in the delivery of fully integrated mission management software and hardened decoy box form factors, for example Wi-Fi router-sized team devices and puck-sized personal devices.
Phase II milestones as stated
Month 1: Monthly Status Reports, and Kickoff and Technical Interchange Meeting.
Month 6: Critical Design Review.
Month 9: Prototype demonstration of single and multi-node networked operations.
Month 11: Final design review, field demonstration, for example 5G test network execution, and assessment.
Months 12 through 18: Final Phase II Report.
What the Phase II milestones tell you
Prototype demonstrations will be performed at the proposer's site or an approved DoW test range. Performers should address scalability, including the ability to run multiple linked decoy boxes from a single operations laptop.
Three things worth planning for now, in Phase I.
Two form factors, not one. A router-sized team device and a puck-sized personal device are different thermal, power, and antenna problems from the same software base. Your Phase I architecture should anticipate both.
Networked multi-node operation is a Month 9 milestone. Multiple decoy boxes linked and coordinated, run from a single operations laptop, means your persona generation has to be consistent across devices. Two decoys independently generating personas will produce contradictions an analyst or classifier can exploit. Design the coordination layer in Phase I.
A 5G test network is named as the Phase II field demonstration environment. Access to a 5G test network, whether your own, a partner's, or a DoW range, is a Phase II dependency worth identifying in your Phase I Phase II Plan.
Note that the Phase II milestone list places the final design review at Month 11, before the Months 12 through 18 reporting window, which leaves a long tail after the last technical milestone. If you are writing the Phase II Plan deliverable, propose what fills Months 12 through 17 rather than treating it as report-writing time.
Phase III Dual Use
The proposed digital signature management technology presents significant dual-use potential. While fundamentally designed to protect military assets from advanced signals intelligence, the core capability of obfuscating cellular metadata directly translates to protecting high-value corporate assets, personnel, and intellectual property from commercial espionage and tracking.
The commercial case is real but it needs specificity to be persuasive. Executive protection, corporate travel to high-risk jurisdictions, journalist and non-governmental organization safety, merger and acquisition activity where travel patterns leak deal information, and research facility protection are all identifiable buyers with the same exposure. Naming a segment and a buyer is stronger than the general claim.
There is also a legal and policy dimension worth acknowledging rather than avoiding. A device that broadcasts fabricated cellular identities operates in a regulated radio environment and interacts with third-party carrier networks. A proposal that addresses spectrum authorization, the difference between operating on a test network and on a live commercial network, and the compliance posture for commercial sale will read as more mature than one that treats the technology as purely technical. This is a legitimate place to say what you would use TABA for.
Funding, Cost Structure, and FutureG Mechanics
The award
The Phase I base amount must not exceed $323,090 and a duration of 6 months.
Note the phrasing: this is a not-to-exceed ceiling on both cost and duration, stated in the Volume 3 instruction rather than in a per-topic table. Roughly $323,000 over six months is a high burn rate, which suits a focused software architecture effort with an existing team and does not suit one that has to hire and ramp.
Cost volume
A detailed cost volume must be submitted online in the proper format shown in the Cost Breakdown Guidance in the DoW 2026 SBIR BAA. Some items in the cost volume template may not apply to the proposed project, and there is no need to provide information for every item. Provide enough information to allow evaluators to assess your plans to use the requested funds.
Justify items of equipment to be purchased, including Government Furnished Equipment. All requirements for government furnished equipment or other assets, and associated costs, must be determined and agreed to during Phase II contract negotiations. If your Phase I work needs access to cellular test equipment, network emulation, or a test network, say so.
Percentage of Work, with no exceptions
Review the updated Percentage of Work calculation details included in the DoW SBIR Program BAA. The FutureG Office will not accept any deviation to the POW requirements.
For this topic, the temptation is to subcontract the cellular protocol stack work, the machine learning generator, or the hardware form factor design. Model your POW before you assemble the team.
Technical and Business Assistance
The OSW SBIR/STTR Program will consider TABA requests in accordance with 15 U.S.C. 638(q). Phase I awardees may request up to $6,500 in TABA funding. Phase II awardees may request up to $50,000 per Phase II project. TABA funding is in addition to the Phase I and Phase II cost ceilings and is not subject to profit or fee.
All requests for TABA must be completed using the SBIR/STTR TABA Request Form. The completed form must be included in Volume 5 of the proposal submission in DSIP. OSW will not accept requests for TABA that do not utilize the SBIR/STTR TABA Request Form or that are not included as a submission document in Volume 5.
The form requirement is absolute. A TABA request made any other way is not accepted. For this topic, regulatory and spectrum counsel is the standout use, given that the commercial product transmits fabricated cellular identities.
The Company Commercialization Report is evaluated
Completion of the CCR as Volume 4 is required. Information contained in the CCR will be considered by the FutureG Office during proposal evaluations.
FutureG states this consistently in both its Phase I and Direct to Phase II instructions, which is worth noting because it is not universal across components. Your prior Phase II commercialization history is part of your score. Fill it out completely rather than treating it as a formality.
Note that the commercialization strategy in the technical volume is separate from the CCR. The strategy addresses how you propose to commercialize this research; the CCR covers what you have done to commercialize the results of past Phase II awards.
Proposal format
The technical volume is not to exceed 20 pages and must follow the formatting requirements provided in the DoW SBIR Program BAA. Any pages in the technical volume over 20 pages will not be considered in proposal evaluations. Use the Phase I Proposal Template provided in the DoW SBIR Program BAA, Appendix A.
Note what this document does not say. It does not state that figures, tables, charts, and references count inside the page limit, and it does not prohibit appendices. Some other OSW program offices impose those rules explicitly; FutureG defers to the DoW SBIR Program BAA formatting requirements instead. Read that BAA for the governing rules rather than assuming another component's restrictions apply.
The proposal cover sheet must include a brief technical abstract describing the proposed R&D project and an anticipated benefits and potential commercial applications discussion, each no more than 3,000 characters. Do not include proprietary or classified information in the cover sheet. If selected for negotiation and possible award, the technical abstract and anticipated benefits discussion may be publicly released online.
DSIP assigns a proposal number once the cover sheet is saved, and you may modify the cover sheet as needed until the topic closes.
Volumes 5 through 7
Volume 5 is for additional documentation supporting the cover sheet, technical volume, and cost volume, and it is where the TABA request form goes if you are requesting TABA.
Volume 6 is Fraud, Waste and Abuse training, which must be thoroughly reviewed once per year to proceed with proposal submission.
Volume 7 is the Disclosures of Foreign Affiliations or Relationships to Foreign Countries webform. It will not be accepted as a PDF supporting document in Volume 5, and you should not upload any previous versions of the form to Volume 5.
Evaluation and selection
All proposals will be evaluated in accordance with the evaluation criteria listed in the DoW solicitation.
Proposing firms will be notified of selection or non-selection status for a Phase I award within 90 days of the closing date of the topic via DSIP. This notification will be sent to the individual listed as the Corporate Official on the proposal cover sheet.
Ninety days from October 21, 2026 is approximately January 19, 2027. Note that the notification goes to the Corporate Official only, not to the Principal Investigator, so make sure the Corporate Official on the cover sheet is someone who will act on it.
Refer to the DoW solicitation for procedures to protest the announcement. Protests after award should be submitted, as prescribed in FAR 33.106(b) and FAR 52.233-3, to osd.ncr.ousd-r-e.mbx.SBIR-STTR-Protest@mail.mil.
Questions
Specific questions pertaining to the administration of the FutureG SBIR Program and these proposal preparation instructions should be directed to the OUSW(R&E) FutureG Office at OSDRE-FutureG@groups.mail.mil.
The FutureG instructions do not state that DSIP Topic Q&A is unavailable, so the standard DoW SBIR Program BAA Topic Q&A process applies. Topic Q&A closes to new questions two weeks before the topic closes, which is October 7, 2026. Use it for technical questions about the topic and the program office address for administrative ones.
The References
One, and it is a link rather than a citation: DoD Instruction 8520.02, at esd.whs.mil.
DoDI 8520.02 governs Public Key Infrastructure and Public Key enabling across the Department. Its relevance here is credentials. The topic's own definition of digital exhaust names credentials first among the metadata that leaks, and a system that swaps identities on a commercial network has to manage credentials somehow.
The single reference is a signal about the topic's character. Unlike topics that cite a research literature to point at an approach, this one gives you a policy instruction and leaves the technical approach entirely open. That means two things. Your Related Work discussion carries the full burden of demonstrating awareness of the state of the art, so bring the relevant literature yourself: cellular metadata privacy research, IMSI and subscription identifier handling in 5G including SUPI and SUCI concealment, pattern-of-life analysis methods, and generative modeling of network traffic. And you should read DoDI 8520.02 and say something concrete about how your credential handling relates to it, because a reviewer who put that reference in the topic will look for it.
Timeline and What to Do When
The dates
Topic opens: September 23, 2026
DSIP Topic Q&A closes: October 7, 2026, two weeks before the topic closes, per the DoW SBIR Program BAA
Proposal deadline: October 21, 2026
Selection notification: within 90 days of the closing date, approximately January 19, 2027
Period of performance: 6 months from award
A working backward plan
Before September 23. Define your adversary model, because obfuscation realism is the metric that decides whether the system works and it is stated only qualitatively. Decide what classifier or analysis method you are defeating and how you will measure that. Draft your own key performance metrics beyond the four suggested, since the topic requires you to define specific, measurable metrics rather than restate its suggestions. Assess your current technology readiness honestly against a Phase II that must reach TRL 7 in 18 months. Identify your cellular test environment, whether an in-house network emulator, a partner network, or a DoW range. Read DoDI 8520.02. Model your Percentage of Work before subcontracting protocol stack, machine learning, or hardware work. Confirm SAM registration and CMMC Level 2 self-assessment in SPRS. Download the DoW SBIR Program BAA Appendix A Phase I Proposal Template.
September 23 through October 5. Draft the 20-page technical volume against the DoW Appendix A template. Structure it around the threat model, the persona generation approach, the identity-swapping mechanics, the AI-enabled mission planning workflow, your proposed key performance metrics with justification, the software architecture, and the path to two Phase II form factors and networked multi-node operation. Address the legal and spectrum dimension rather than avoiding it. Draft the 3,000 character cover sheet abstract and the 3,000 character anticipated benefits and commercial applications discussion.
October 6 through October 7. Submit any technical questions through DSIP Topic Q&A before it closes, and send administrative questions to OSDRE-FutureG@groups.mail.mil.
October 8 through October 14. Build the cost volume online following the Cost Breakdown Guidance in the DoW 2026 SBIR BAA, against the $323,090 and 6-month ceiling. Price the software development, the machine learning work, the red-team evaluation effort, any network emulation or test access, and the design review and reporting deliverables. Identify any Government Furnished Equipment needs. Complete the SBIR/STTR TABA Request Form if you want the $6,500 and place it in Volume 5.
October 15 through October 18. Complete Volume 4, the Company Commercialization Report, carefully, since FutureG states it will be considered during evaluations. Assemble Volume 5. Complete Volume 6 training and the Volume 7 foreign affiliations webform, remembering it must be the webform and will not be accepted as a PDF in Volume 5, and that no previous versions should be uploaded there. Run compliance: 20 pages maximum, no proprietary or classified information on the cover sheet, 3,000 character limits on each cover sheet section.
October 19 through October 20. Submit and certify in DSIP.
Frequently Asked Questions
What is OSW-FutureG SBIR topic OSW26BZ06-NV028?
OSW26BZ06-NV028 is a Phase I SBIR topic titled "5G Signature Tracking Mitigation via Cyber Deception," released under the OSW FutureG Office FY26 SBIR Broad Agency Announcement, Release 6. The objective is to develop an advanced digital signature management and deception system that obfuscates cellular metadata, described as digital exhaust, to protect personnel, small units, and critical facilities from adversarial surveillance, tracking, and pattern-of-life analysis on third-party commercial networks.
How much funding is available?
The Phase I base amount must not exceed $323,090 with a duration of 6 months. Phase I awardees may also request up to $6,500 in Technical and Business Assistance, in addition to the cost ceiling and not subject to profit or fee, using the mandatory SBIR/STTR TABA Request Form in Volume 5.
When is the proposal deadline?
The topic opens September 23, 2026 and proposals are due October 21, 2026 through the Defense SBIR/STTR Innovation Portal at dodsbirsttr.mil.
How long can my technical volume be?
Not to exceed 20 pages, following the formatting requirements in the DoW SBIR Program BAA. Any pages over 20 will not be considered in proposal evaluations. Use the Phase I Proposal Template in Appendix A of the DoW SBIR Program BAA.
Do figures and references count against the 20 pages?
The FutureG instructions do not say so. They defer to the DoW SBIR Program BAA formatting requirements. Some other OSW program offices explicitly require figures, tables, charts, and references to count inside the limit and evaluate no appendices; FutureG does not state that, so follow the DoW BAA rules rather than assuming another component's restriction applies.
What is digital exhaust?
The topic defines it as the metadata required to operate on a cellular network, giving credentials, location data, and device identifiers as examples. Adversaries use it to track daily routines, identify deviations indicating special events such as VIP visits or mission preparation, and map sensitive facilities based on cell phone concentration or periods of inactivity.
What are the suggested key performance metrics?
Four, stated as suggestions and not limits. Persona capacity, measured as AI-powered personas broadcast simultaneously per decoy device, with a threshold of 2 and an objective of 4 or more. Operational endurance, measured as battery life for highly mobile and pluggable decoy form factors, with a threshold of 12 hours and an objective of 24 to 36 hours. System weight for the personal decoy device, with a threshold under 2 pounds and an objective of approximately 1 pound. And obfuscation realism, the ability of AI-generated traffic to mimic realistic patterns of life to defeat automated network analysis, with a threshold of defeating basic heuristic analysis and an objective of defeating advanced machine-learning-based behavioral tracking.
Do I have to use those metrics?
You have to define your own. The topic states that proposers must define specific, relevant, measurable, and quantifiable key performance metrics and that the four listed are suggestions including but not limited to. A proposal that only restates the four suggestions has not done what was asked. Add the metrics your architecture actually turns on and justify them.
How do I make obfuscation realism measurable?
That is the central proposal problem, since the threshold and objective are stated qualitatively. A credible answer proposes an adversary model and an evaluation method: what classifier you test against, what features it uses, its detection rate against your generated traffic versus real traffic, and how you avoid overfitting the generator to one detector. Proposing the red-team methodology matters as much as proposing the generator.
What does Phase I actually deliver?
Five deliverables. Kickoff and Technical Interchange Meeting slides, Monthly Status Reports, a Preliminary Design Document detailing AI-persona generation and identity-swapping mechanics, a Phase II Plan, and a Final Phase I Report. Key activities include a phase kickoff comprising a Technical Interchange Meeting and a Preliminary Design Review.
Is Phase I a hardware build?
No. Phase I develops initial application concepts, algorithms, and a comprehensive design document outlining the software architecture for future development and deployment. The hardware form factors appear in Phase II.
What is the Phase II target?
Technology Readiness Level 7, meaning a prototype demonstrated in an operational environment. Phase II focuses on prototype production, testing, and evaluation, delivering fully integrated mission management software and hardened decoy box form factors such as Wi-Fi router-sized team devices and puck-sized personal devices.
What are the Phase II milestones?
Month 1 for Monthly Status Reports plus Kickoff and Technical Interchange Meeting. Month 6 for Critical Design Review. Month 9 for prototype demonstration of single and multi-node networked operations. Month 11 for final design review, field demonstration such as 5G test network execution, and assessment. Months 12 through 18 for the Final Phase II Report.
How much is Phase II funded at?
Phase II efforts may be funded at $2,153,927 for an 18-month period of performance. Phase II proposals may only be submitted by Phase I awardees, and for successful Phase I efforts there may be a follow-on Phase II topic released within six months of Phase I completion.
Where will the Phase II prototype be demonstrated?
At the proposer's site or an approved DoW test range. The topic names 5G test network execution as an example field demonstration, so identifying your test network access is worth doing in the Phase I Phase II Plan.
What does networked multi-node operation require?
Running multiple linked decoy boxes from a single operations laptop, which the topic lists under scalability. That means persona generation has to be coordinated across devices, since independently generated personas can produce contradictions an analyst or classifier could exploit. Design the coordination layer in Phase I.
What CMMC level applies?
The projected requirement for this topic is CMMC Level 2 with self-assessment.
Is this topic ITAR restricted?
No topic-level ITAR or EAR restriction paragraph appears on OSW26BZ06-NV028, and none appears on any of the three topics in this FutureG release.
Is the Company Commercialization Report evaluated?
Yes. FutureG states in both its Phase I and Direct to Phase II instructions that information contained in the CCR will be considered during proposal evaluations. Complete it fully rather than treating it as a formality. Note that it is separate from the commercialization strategy in the technical volume: the CCR covers what you have done with past Phase II awards, the strategy covers how you propose to commercialize this research.
Are there Percentage of Work restrictions?
Yes. The FutureG Office will not accept any deviation to the Percentage of Work requirements described in the DoW SBIR Program BAA. Model your POW before subcontracting cellular protocol stack, machine learning, or hardware form factor work.
How do I request TABA?
Using the SBIR/STTR TABA Request Form, included in Volume 5 of the DSIP submission. OSW will not accept requests that do not use the form or that are not submitted in Volume 5. Phase I is up to $6,500 and Phase II up to $50,000 per project, both in addition to the cost ceilings and not subject to profit or fee.
Can I ask questions about the topic?
Yes. The FutureG instructions do not state that DSIP Topic Q&A is unavailable, so the standard DoW process applies and Topic Q&A closes two weeks before the topic closes, on October 7, 2026. Administrative questions about the FutureG SBIR Program and these proposal instructions go to OSDRE-FutureG@groups.mail.mil.
When will I hear back, and who gets notified?
Within 90 days of the closing date of the topic, approximately January 19, 2027, via DSIP. The notification is sent to the individual listed as the Corporate Official on the proposal cover sheet. Note that unlike some components, FutureG does not state that the Principal Investigator is also notified, so make sure the Corporate Official is someone who will act on it.
What is the commercial market?
The topic identifies protection of high-value corporate assets, personnel, and intellectual property from commercial espionage and tracking. Concrete segments worth naming include executive protection, corporate travel to high-risk jurisdictions, journalist and non-governmental organization safety, merger and acquisition activity where travel patterns leak deal information, and research facility protection.
What is the single reference about?
DoD Instruction 8520.02, which governs Public Key Infrastructure and Public Key enabling. Its relevance is credentials, which the topic names first among the metadata that leaks. Read it and say something concrete about how your credential handling relates to it, because a reviewer who included that reference will look for it.
Positioning Advice for Companies Considering This Topic
Define your adversary before you define your system. Obfuscation realism is the metric that determines whether any of this works, and the topic states it qualitatively: defeat basic heuristic analysis at threshold, defeat advanced machine-learning-based behavioral tracking at objective. Name the analysis you are defeating, the features it uses, and how you measure success against it. A proposal that describes a persona generator without describing the detector it beats has skipped the hard half.
Propose your own metrics, and say why. The topic requires specific, relevant, measurable, and quantifiable metrics and offers four as suggestions. Restating those four is the minimum and it will not distinguish you. Add persona persistence, attach-event rate plausibility, geographic consistency, cross-persona correlation, and time to detection under sustained observation, with threshold and objective values you can defend.
Solve the absence problem, not just the presence problem. The threat description says adversaries map sensitive facilities based on cell phone concentration or periods of inactivity. Deception that adds plausible activity is half the answer. Maintaining a plausible baseline when the real population leaves, and avoiding a suspicious change in pattern when it returns, is the other half, and most proposals will only address the first.
Design for three protected entities, not one. An individual, a small unit, and a facility have different requirements. A puck on one person, a coordinated set of personas across a team that do not contradict each other, and a persistent facility signature are three modes of the same system. Say which you optimize for and how the others follow.
Take the mission planning software seriously. The topic asks for AI-enabled mission planning and operations, and the Phase II deliverable is fully integrated mission management software. Someone has to decide which personas to run, where, for how long, and with what pattern of life, under time pressure and without deep technical knowledge. Show that workflow.
Design the coordination layer in Phase I. Multi-node networked operation is a Month 9 Phase II milestone and running multiple linked decoy boxes from one operations laptop is a stated scalability requirement. Independently generated personas will collide statistically. Solving that in Phase I architecture rather than discovering it in Phase II integration is the difference between a plan and a hope.
Be honest about your current TRL. Phase II must reach TRL 7 in 18 months following a 6-month design study. That arithmetic only closes if you are starting from working components. State what you have, and let the Phase II Plan be credible against it rather than aspirational.
Address the legal and spectrum question head on. A device broadcasting fabricated cellular identities on or near third-party commercial networks raises authorization questions, and the commercial market raises them again. A proposal that names the compliance posture, distinguishes test network operation from live network operation, and identifies where it needs counsel reads as more mature than one that treats the problem as purely technical. It is also a good use for TABA.
Read DoDI 8520.02 and use it. It is the topic's only reference and it is about credentials, which the threat description names first. A paragraph connecting your identity and credential handling to that instruction shows you read what the Government pointed you at.
Bring your own literature. With one policy reference and no research citations, your Related Work section carries the whole burden of demonstrating awareness of the state of the art, which the DoW template requires. Cellular metadata privacy research, subscription identifier concealment in 5G, pattern-of-life analysis, and generative traffic modeling all belong there.
Fill out the Company Commercialization Report properly. FutureG says twice that it is considered during evaluations. If you have prior Phase II awards, their outcomes are part of your score here.
Model Percentage of Work first. No deviations accepted, and this topic invites subcontracting the protocol stack, the machine learning, and the hardware. Run the calculation before you commit to a team.
Make the Corporate Official someone who watches email. FutureG sends the selection notification to the Corporate Official on the cover sheet and, unlike some components, does not say the Principal Investigator is copied.
Plan for the weight and endurance targets from the start. Under 2 pounds with 12 hours of battery, objective approximately 1 pound with 24 to 36 hours, for a device broadcasting multiple simultaneous cellular personas, is a genuine radio and power engineering problem. Even in a Phase I software effort, a preliminary power and thermal budget against the puck form factor makes the Phase II plan credible.
