Privacy Factors in Video-based Media Spaces

1. Privacy Factors in Video-based Media Spaces Presented by: Anurodh Joshi & Nikhil Komawar

2. Authors • Michael Boyle • SMART Technologies, ULC • Carman Neustaedter • Kodak Research Labs • Saul Greenberg • University of Calgary

3. Introduction • Video Media Spaces (VMS) • Multi-person audio/video networks that are usually on most of the time Office Home: Privacy more important

4. Perspectives on privacy • Privacy? • Opposite of public (being together) Brierley-Newell (1998) • being apart • Privacy != Being alone • Couple in a large group • Disclosure – boundary tension • Organization Perspective • Seen positively -> increases ‘togetherness experienced by group members’. Increased collaboration • Workers don’t want to be on camera all the time

5. Privacy Regulation • Privacy regulation • Dynamic process • Each person has his /her own privacy preferences • Complicated (cross-cultural contact, groups) • Privacy regulation is a situated action • Interactions are constrained by temporal and spatial contexts • Media Spaces • Interactions are much more de-contextualized

6. Privacy Violation • Privacy violation: • Deliberate • Unauthorized access • Unintentional • When user becomes cut off from the context of people viewing him, it leads to privacy violation • Self appropriation • A regulatory process where people modify their behavior and expectation according to social norms

7. Privacy Control In Media Spaces • Dilemma: Purpose of media space is to reveal • Privacy Vs Utility • For one person to have richer awareness, others must necessarily have less privacy (Hudson & Smith) • Safeguard against deliberate abuse • Access Control • Computer Security & Cryptographic measure • Hackers • VMS not equipped with adequate measures

8. Privacy Control In Media Spaces • Techniques for preserving privacy • Distortion Filters • Masks sensitive details • Work on visual information channel

9. Privacy Control In Media Spaces • Publication Filters • Background Subtraction – Removes unimportant information

10. Difficulties in Privacy Control In Media Spaces • In physical environment • Controls are: • Fine-grained: can be adjusted person-by-person, instance-by-instance basis • Light-weight: needs little physical or cognitive effort • In VMS • Not so • Eg. Plugging the camera: light-weight but not fine-grained (video is blocked for all recipients)

11. Privacy Feedback in Media Spaces • Feedbacks need to be conspicuous as well as not distracting • In physical environment feedback cues about privacy are socially natural, light-weight yet conspicuous and not distracting

12. Privacy Feedback in Media Spaces • In VMS such subtle feedback is not fully supported • Disembodiment and Disassociation confound the problem • Technical limitation (speed, bandwidth) • Example ( so far): • Person in office can hear footsteps of a colleague approaching him to strike conversation • This audible cue signals onset of interactivity

13. Privacy as Control Modalities • Modes based on elements of privacy outlined by Gavison (1980) to control self-environment boundary • Solitude: • Control over one’s interpersonal interaction • Confidentiality: • Control over other’s access to information of self • Autonomy: • control over the observable manifestations of the self such as action, appearance, impression and identity

14. Solitude • helps to ‘be apart’ from others • Being apart != Being alone • Crowding • Others are granted too much access to the self • Isolation • One cannot interact with others to the degree one wishes • Westin (1967) introduces four states: • Total isolation • Intimacy • Anonymity • Reserve

15. Solitude in VMS • Most VMS require users to make extra effort • Camera shyness • Heightened self awareness that people are monitoring self causes discomfort • Verbal and Para-Verbal Solitude controls • Verbal • Telling others verbally or leave a sign outside the door

16. Solitude • Para-Verbal means • Posture or facial expression • Gestures to dismiss • In Physical Environment • These mechanisms are light-weight • In VMS • Low Resolution, Low speed videos make it more heavy-weight and explicit • These changes may alter social interpretation of expressed desires

17. Affordance of Space for Solitude • To regulate solitude one can go somewhere to be alone(get away) or even with few people • VMS is expensive so it is hard to regulate solitude (expensive) • VMS design complicates refuge-seeking • Pulling the plug: • May not be suitable • Reconnection is sometimes complicated -> people refuse to pull the plug

18. Affordances of Space for Solitude • Places partially determine accessibility i.e. effort people must extend for interaction • People control affordance of space for interaction • People capitalize on ambiguity to regulate solitude • Closed door can symbolize either no one inside the room or someone wishing to be left alone • Nardi et. al. (2000) report that people use inaccuracies of IM presence indicators as a form of plausible deniability – making it ambiguous of there presence by being non-responsive

19. Personal Space • Invisible space or boundary around self • Distance is a strong cue for need of personal space as well as interaction • Example • Person sitting directly across • Person sitting out of direct eye sight • In VMS • The distance is not really a cue for social distance or personal space

20. Personal Space • Space and social behavior interpolate with respect to solitude • Personal space refers to invisible boundary in space around a person separating him from others • Boundaries are undefined but people show definite behavioral and psychological responses when others enter their physical space • Territory is similar but usually specifies a fixed spatial or psychological location

21. Confidentiality • Control of access to information about oneself • Informal awareness cues, intentions, vital statistics, thoughts and feelings, medical history • It is about controlling information in forms of • Aural • Visual • Numeric • Textual • Secrecy • It is similar but narrower • emphasizes what information is concealed from certain people • aspect of confidentiality as it modulates communication of information to others

22. Confidentiality vs. Solitude • Regulated one’s attention • Affects inward flow of information from others • Affects others’ attention • Directly regulates outward flow of information

23. Confidentiality continued … • A fundamental difference lies between confidentiality and informal awareness cues in VMS • Sensitivity: property of a piece of information that can be defined as a perception of how important it is to maintain control over it • Others’ impressions of a person are predicted upon their knowledge of the person, making confidentiality a part of impression management

24. Confidentiality continued … • Harms arising due to breach of confidentiality: • Embarrassment • Damage to ego, identity • Loss of other’s esteem • Impairment of livelihood • VMS can reveal sensitive when unintentionally capture and transmit a person’s image which might be socially unacceptable

25. Computers and Confidentiality • Authorization and data integrity are a part of confidentiality • Process integrity, availability, responsiveness and reliability: • ensure that computers perform their intended functions completely and correctly in expected amount of time with no undesired side-effects. • Cryptography methods provide access control, verifying identity and checking the integrity.

26. Computers and Confidentiality • Authorization and data integrity are a part of confidentiality • Process integrity(important component of confidentiality), availability, responsiveness and reliability concern: • ensuring that computers perform their intended functions completely and correctly in expected amount of time with no undesired side-effects. • Cryptography methods provide access control, verifying identity and checking the integrity.

27. Fidelity • A perception of how faithfully a piece of information represents some truth. • Includes precision: detail of perception • Includes accuracy: confidence in the information • Influence by the trust placed in the sender and also on the number of recipients • As persistency and transitivity are relevant to confidentiality • Regulation of fidelity of information third parties transmit about us is relevant to confidentiality

28. Fidelity • A perception of how faithfully a piece of information represents some truth. • Includes precision: detail of perception • Includes accuracy: confidence in the information • Influence by the trust placed in the sender and also on the number of recipients • As persistency and transitivity are relevant to confidentiality • Regulation of fidelity of information third parties transmit about us is relevant to confidentiality

29. Fidelity within VMS design • Within VMS design, confidentiality includes control over fidelity. • Different dimensions: • Field view • Resolution • Frame rate • Codec quality • Latency jitter • Technology puts upper bound on these parameters, much lower than face-to-face interactions

30. Fidelity within VMS design continued… • Despite these upper bounds, video is high fidelity medium for informal awareness and casual interactions. • Video offers more fidelity than what is needed in many scenarios, hence many video media spaces try to preserve confidentiality by discarding fidelity. • Eg. Using a blur filter for distortion in the video • Studies show that effectiveness of such techniques is limited.

31. Direct Controls • Principle means of confidentiality: keeping our bodies, possessions and thoughts accessible to some and not to others. • Possessions: • Diaries, driver’s license, automobiles • Territorial and personal space help restrict others’ access to our bodies and things. • Similar control is available over speech: • Directing his voice, modulating speech for whispering

32. Direct Controls continued… • Architecture plays vital role in preservation of confidentiality: • Walls reduce visual and auditory channels • Walls fortification can be done using sound-proofing materials • Window blinds, doors

33. Direct Controls continued… • In VMS this can be achieved by: • Turning down microphone volume • Encoding information with cryptographic methods so others cannot eavesdrop • Filtration technique

34. Indirect controls • People tell others their confidentiality desires verbally or para-verbally. • Does not prevent them from revealing the secrets. • People can choose to and sometimes keep secrets • confidentiality preferences are revealed over time as relationships are built • Notion of genres of disclosure: • Institutional and situational expectations regarding confidentiality • Patterns of disclosure evolving over time • As they are loosely defined – • it possible to feel violation of privacy by misuse and misappropriation of confidential information • And not just inappropriate disclosure

35. Indirect Controls continued… • VMS changes rules of engagement • Eg. Archiving of audio/video exchanges for replay • Verbal telling people to keep matters confidential does not prevent others from listening in later • People willingly and unwittingly spread information, disinformation or inaccurate information intentionally or unintentionally • VMS should incorporate : • Awareness and interaction channels • Diagnose, police, reprimand damaging violations • Accountable by letting users know how sensitive information is handled within the system

36. Autonomy • Freedom to choose how to act and interact in the world. (syn. personal liberty) • Self-appropriation and autonomy point to control over one’s behavior. • Privacy preserving in VMS requires: • Managing behavior, identity and impressions • Understanding of autonomy to regulate these

37. Preserving and Constraining Autonomy • Author compares autonomy with ‘muscle’ • Routinely exercise it or it will atrophy • Trying to do as one wishes is important • Communication the same is important as well • explicit: content of speech • implicit : speech, posture, face • Informal awareness cues for availability simultaneously reveal one’s desires.

38. Preserving and Constraining Autonomy contd… • Autonomy is impaired when: • Technology imposes constraint on time and place for participation • Eg. Work from home situation • VMS connecting home and office puts social pressure to schedule one’s activities at home • Difficulties in deciding when to work

39. Preserving and Constraining Autonomy contd… • Exercising autonomy does not imply that one “always gets one’s way” • Each may do as one wishes as long as their choices conform to group expectations • Autonomy is generally constrained by group norms • Autonomy can be compromised: • if the group norms change faster than people can adapt • Insufficient feedback is offered about activities for self-appropriation

40. Preserving and Constraining Autonomy contd… • Autonomy may be constrained by others as well • Institutionalized people • Parents restricting children to keep them safe • Primary motive is punishing bad behavior • Incarceration of criminals • Grounding of children

41. Preserving and Constraining Autonomy contd… • Autonomy may be constrained by others as well • Institutionalized people • Parents restricting children to keep them safe • Primary motive is punishing bad behavior • Incarceration of criminals • Grounding of children • Observations have implications for VMS design • Single UI for such a social technology eliminates social governance of its use.

42. Symbiosis • Symbiosis between: Autonomy-Confidentiality-Solitude • Autonomy gives people their privacy choices • Autonomy depends on solitude &confidentiality • Solitude &confidentiality also depends on autonomy • If VMS design impairs regulation of one of these controls, then others may be negatively affected • Ubiquitously embedded cameras in a room limit autonomy

43. Symbiosis • People are actors who have fronts (conduits for social expression of self and team) • Front manifestation in signifiers like: • Actions, utterances, interactions, verbal and non-verbal signifiers • Social settings like location, scenery, props, appearance, costumes, posture, expressions, gestures, manners. • Fronts are carefully constructed and maintained to ensure homogeneity between performances.

44. Identity • Autonomy includes control over identity and its expression: • Physical appearance, mannerisms and voice • Passports, driver’s license, credit cards etc. are considered valid artifacts to reveal identity • Electronic equivalents: email ID, webpage, etc. • Civil penalties for libel or unauthorized use of one’s identity still lack in electronic media • Hence, privacy-enhancing techniques must be used

45. Identity continued… • Identity is highly relevant to VMS design. • Impersonation and identity theft are possible in the VMS designs • Confidentiality can guard against these crimes • However, certain privacy preserving techniques used can lead to confusion of identity: • like distortion filters that blur an image • Substitute actors in video

46. Pseudonymity • A person may be involved in disjoint social worlds with a different identity in each (Pseudonymity). • Transportation and telecommunication technologies facilitate pseudonymity by allowing social circles to extend geographical ranges and population bases.

47. Pseudonymity • VMS are at odds with pseudonymity as identity information is conveyed through video of one’s face and body • Implementing video manipulation techniques to replace one’s image for multiple identities are tricky and could reduce value of video channel

48. Role Conflict • People assume different roles in different social worlds. • A single person can play different roles: • As a leader with underlings • As a suppliant with boss • As a parent with children • As a lover with her mate

49. Role Conflict • This creates a status divisions, role obligations • Overlapping social worlds can result in social conflicts. • Parents visiting their children in their dorm

50. Role Conflict in VMS • Role conflict can be a major problem in VMS. • VMS connects physically distributed people • Each likely inhabiting different physical contexts • Each may have different set of privacy norms • Problems with self-appropriation • These are evident when VMS connect both homes and offices • Could result into privacy violation leading participants to apprehend media space.