Amigo Approach Towards Perceived Privacy

Size: px

Start display at page:

Download "Amigo Approach Towards Perceived Privacy"

Archibald Banks
6 years ago
Views:

1 Amigo Approach Towards Perceived Privacy Maddy Janse, Peter Vink, Yeo LeeChin, and Abdullah Al Mahmud Philips Research, High Tech Campus 5, 5656 AE Eindhoven, The Netherlands Abstract. Perceived privacy, i.e., how end-users perceive that the system affects their privacy, is one of the key aspects for the acceptance by users of ambient intelligent systems and one of the most complex to handle. Exploratory, field and conceptual design studies were conducted to generate user requirements as input and constraints for the development of mechanisms for the enforcement of privacy preferences. Based on these field studies, a model was created and a prototype was implemented in which the context, the content, and the presence of people was discovered, and shared under various privacysensitive conditions. Keywords: perceived privacy, ambient intelligent system, networked home environment, extended home environment, context-aware applications. 1 Introduction Applications in extended networked home environments are intended to facilitate the communication between users of different households and to provide them with a feeling of a shared ambiance. Connecting people in this way influences their social relationships. Home, as we know it, is a place where people can retreat from society and its social rules. Extended home applications induce intrusions in this familiar and trusted environment. Since ambient intelligent systems are by definition unobtrusive and embedded in the user s environment, users might easily forget their existence and unwillingly have their privacy violated. Perceived privacy or how end-users perceive that the system affects their privacy is one of the key aspects for the acceptance of ambient intelligent systems by users. It is also one of the most complex problems to handle. It is about how, when, and to what extent data about people are revealed to other people within a dynamic social context. The Amigo research into perceived privacy started with user studies [1, 2]. These studies explored daily communications and their related privacy issues in the field by means of a system for presence detection and sharing that information across homes. Conceptual design studies investigated the sensitivity of masking or hiding information that is being shared between different parties in relation to the type of application. These studies provided, in addition to a set of design guidelines the following major observations on user behavior with regard to handling perceived privacy: People use many diverse mechanisms to preserve their social privacy, People share their personal information only within a small community of relatives and friends, M. Mühlhäuser et al. (Eds.): AmI 2007 Workshops, CCIS 11, pp , Springer-Verlag Berlin Heidelberg 2008

2 404 M. Janse et al. People need to perceive a clear benefit for information sharing, People control the level of detail of the information that is being shared, and they are consciously maintaining this control. These observations resulted in a change of approach with regard to the Amigo architecture; handling privacy at the middleware service level by means of a rule-based filter that incorporated user preferences and that would use these preferences to either pass on the data or not. Such a mechanism is not sufficient for handling the user s perceived privacy because it does not offer direct user control. In particular, the type of information that is shared, the level of detail in which the information is shared, with whom that information is shared, and whether it is shared by single individuals or groups of people are crucial variables to take into account. To further investigate these implications an application implementation was developed. 2 Design Concept The major aim is to design a privacy-aware application that is embedded in an ambient in-home network as envisioned by the Amigo project s extended home environment scenario. A content-sharing application was selected as most suitable for this purpose. In this application, context and content data are shared from various sources between different users and locations, context input is used for privacy-based decisions and context-aware feedback is given to users. A subset of the overall Amigo extended home environment scenario was selected (Table 1). Table 1. Application Scenario Maria and Jerry have one child, Roberto. Jerry travels a lot for his work. They use an Amigo system to stay in touch. The system can be used from any display device that is connected to the Internet. By using the system, Maria and Jerry can be together, while they are at different locations. They can exchange information, share pictures, play games, chat, share activities, feel each other s presence and share their social context. Jerry is in the US on a long business trip. Maria likes to show some pictures while they are being together with the family in the week-end. She has three different sets of pictures on the system. The first set of pictures is from her first marriage. She does not want anyone to see these pictures. The second set of pictures, taken at the Zoo, is recent. She wants to look at these pictures with Jerry and Roberto. The third set of pictures show the cocktails that she prepared a few days ago for their friends. She wants to look at these pictures with Jerry and not with Roberto. This sharing application is context dependent and reacts based on the user privacy setting. Two people at different locations can share photos, location and presence. For the technical realization, existing Amigo prototypes were used and where needed extended. To maintain the home ambiance a TV was used as a display medium. Users could set their privacy preferences and navigate by means of a few buttons on a TV remote control. The user interface is built with CE-HTML (a CEA/DLNA standard).

3 Amigo Approach Towards Perceived Privacy Conceptual Model The following design constraints were assumed: Context information is retrieved from the environment. Different control points are used to allow users to control which information they are sharing with their contacts and how that information is shared. The application should allow users to share information and activities with their contacts at other locations. This information includes content, for example the user s photos, context information, for example, the user s exact or approximate location, and the user s social situation. The application will use context information as data to be shared and as data to control the privacy settings, i.e., sharing depend on context. Feedback to the user regarding content and context changes should be represented in different ways, for example, by different icons and/or light colors. The crucial components for handling perceived privacy in the Amigo extended home environment are: the services, the applications, the control, the user and the user s contacts (Figure 1). The information flow between these components results in a context dependent setting, i.e., how the application reacts is context dependent. The service component collects and provides contextual information about the environment and its users, for example, about the house and its inhabitants, such as, recognizing the persons and knowing their activities. The impact of the service component is mostly determined by the sensitivity of the data that it provides. The control component allows users to control the flow of data between components. It provides an interface for setting privacy preferences. Default values can be used when a user has not specified any privacy preferences or when the absence of data is privacy sensitive. The application component provides access to contextual information. Privacy settings will differ per application and per application usage. Contacts communicate with the user; they constitute, for example, the user s family, friends, or any other contact defined by the user. Contacts also have a context dependent factor. The user is also a component in this model, as preference settings differ per person and their context is a dependent factor. Different value combinations of these components create different settings. Applications Services User Control Contacts Fig. 1. Context Dependent Setting - Components context-aware sharing application

4 406 M. Janse et al. The following example illustrates the role of these components for part of the application scenario: if Maria [users] is in her room [services (context)] and is using a sharing application [applications], and her husband Jerry is alone [services (context)] at another location [contacts] and is also logged in to an application [applications], then use setting A- share photos [setting (context dependent)]. In this example, two different services and applications are running at the same time at two different locations. Setting A is a decision made at Maria s location to determine the dissemination of the information (in this case, to share photos). 2.2 Sharing Information Information about presence, location, and content of a user is shared. Presence refers to the status of a user. This status can have different values, e.g., is online, is away, is busy or is offline. Location refers to where a person is located at a specified point in time. Different sources of location information can have different levels of detail, e.g., room, building, and city, for the physical location. Furthermore, they can have the value known location, and do not share. These values can be based on agreements between users. In this way, users have control over the precision by which their location context will be disclosed to other people. The value known location, which is comparable to Lederer et al. s (2003) [3] vague location ordinal precision level, can be used as a custom location setting to simplify the preferences setting for the user and different levels of detail can be shared depending on the character of relationships between persons. This implies that users maintain control by configuring their preference settings with regard to who will see what and when. The application will react according to these preferences setting. Eindhoven WDC AmbiLab Known Location Fig. 2. Example of different levels of precision for location. AmbiLab is the room, WDC is the building, and Eindhoven is the city. Each of these levels can have a within value that is known location and that may be shared or not shared. Content refers to information of interest to persons. Content can have different values for sharing. For example for photos, these values can be: private, public, or conditionally specified like sharing with X when X is alone.

5 Amigo Approach Towards Perceived Privacy Presenting Context Information The information that is being shared about presence, location and content is presented in relation to the context. From the many available choices for the presentation of this information, the use of icons, colored text and colored light was selected, mainly for feasibility reasons. The presence status of an individual person is presented by means of colored text on the TV display. The joined presence status and activities is presented by means of colored lights, i.e., presentation without explicit interruption and integration of prior defined agreements and social conventions. Different colors represent different contexts; for example, being logged on or not in the sharing application, or whether someone else is in the same room as the user or not. In this way, the user in location B gets information about location A. These presence settings represent a compound context; they combine different information sources: activity, availability and location of more than one person. The photo-sharing application is presented by means of photo icons. 3 Implementation Different services and applications are installed in two different Amigo homes (Figure 3). Each home has three main components, the Amigo server, the Amigo client and the Internet. In the prototype, information is shared between the Amigo server which is running various Amigo Intelligent User Services, the Amigo client, which is running the privacy aware applications, and between the two homes, A and B. Fig. 3. Information sharing between two Amigo homes The Amigo server consists of different services running in the home. It functions as a centralized database that stores contextual information about the home and its inhabitants and provides different types of information to the client, e.g., the location of the user. The Intelligent User Services [4, 5] from the Amigo middleware are used to

6 408 M. Janse et al. retrieve contextual information and user profiles. The Context Management Service (CMS) is used to track the location of a user and store this location information on the server. The User Modeling and Profiling Service (UMPS) is used to reason on user context and feedback and to store user profiles and privacy preference settings. The Amigo Client consists of different applications that are running in the home. These applications are, for example, a content sharing application, a lighting application (LivingColor light), and a game application. Users can set their application and location privacy preferences using the interfaces from the application. Users receive feedback from the application interface. Different user states are presented by different colors of light, e.g., online/offline/sharing photos. The Amigo client can be any display device that is connected to the Amigo server and the Internet; in this case a CE-HTML enabled television. Context information is shared between two homes through an application and the Internet. The Internet is used to connect the homes. The Jabber server is used to store the user s contacts information. The Flickr Server [6] is used to upload and store the content; in this case, the user s photos, which have privacy-level tags. The application communicates via a Jabber server (Jabber Software Foundation, 2006 [7]). It exchanges messages on user location information, user availability and application activity between the homes. The user s availability is shown as the user s current status, e.g., is online, is away, is busy or is offline. The Jabber Server is also used for initialization of a photo sharing request and establishing the connection between the two homes. Users are given control over which information is to be shared. Before information is passed from one component to another, it will first go through privacy decision points (PDP). PDPs consist of rule-based software that checks against the user privacy preferences that are stored in the UMPS. They control the information that is being shared between different applications across different homes. Users can modify their privacy settings from the privacy preferences interface. The PDP is enforced to make sure that the application will react according to these privacy settings and the presence and location of the user (user context). The set of photos adapts when the context of the user changes. In sum, this implementation provides a real networked environment in which we can explore the consequences of system variables on user s perceived privacy. 4 Discussion The prototype implementation was demonstrated as a walkthrough based on the initial usage scenario to expert users to generate feedback with regard to the initial user requirements and design guidelines. Such a running prototype system provides a much better carrier for eliciting user feedback with regard to privacy considerations than design concepts and visualizations. It has the advantages of demonstrating the consequences of changes in context and can support the exploration of different situations. The experts that participated in the walkthrough had very different backgrounds, among others, user system interaction; security and encryption; software engineering; system architecture; and CE applications. They trusted the system. They trusted it even more than they trusted other users. One of their quotes: If I know the capability

7 Amigo Approach Towards Perceived Privacy 409 of the system I will trust it; I will have less trust in the people who will be using it. It was also stated that the system will be trustworthy if it takes a conservative decision. This implies that the default value for the privacy setting should be very rigid. It is not desirable that other people know what these settings are. They also wanted a central control or setting to control the application themselves. Another issue regarding trust was expressed as: Can you trust the system that it is sufficiently aware of the context to adapt automatically to the right setting? Being sufficiently aware is the crux that needs more exploration and research work. The relation between system autonomy and privacy is another critical factor. Being able to cheat was one of the requirements revealed by the user studies. Setting different privacy preferences and changing them during a session elicited discussions on how this might affect people s social relationships. With regard to the level of detail for the preference settings it was clear that different levels have different meanings for different people. The following verbalizations illustrate these points: People don t need to know that you have set some kind of privacy setting for them ; If I change my privacy setting for a particular friend, people will infer something, as if I wish to hide something ; If I really wanted to show my privacy settings, I should be able to override them, by having a kind of don t embarrass-me button. Presenting the context information by means of colored light provides opportunities for personal and intimate ambiance sharing. For this the system should be flexible. The prototype only used one light per room, but participants actually desired to have a light presentation for each individual person. The different levels of precision that were maintained in the application for the disclosure of personal information need further exploration. It is quite clear that people require control over their personal information and that they like to vary this level of detail depending on the context at hand. These levels are different for each individual. It appears that people require about 3 levels of detail, but that these levels are at different depth for each individual. These settings might potentially cause social embarrassments and conflicts. In sum, the application implementation made it possible to explore and experiment with privacy settings in a context-aware environment enabled by the Amigo middleware. The results highlight the need for more exploration in different settings and conditions. But it also identified that some privacy controls should be handled in a generic fashion, such as employing privacy rules and that next steps in this research need to focus on constructing more generic models. Acknowledgement The Amigo project is funded by the European Commission as an integrated project (IP) in the Sixth Framework Programme under the contract number IST The Amigo partners are: Philips, Fagor Electrodomesticos, France Telecom, Fraunhofer IMS, Fraunhofer SIT, Ikerlan, INRIA, Italdesign-Giugiaro, SingularLogic, Europaeisches Microsoft Innovation Center, Telematica Instituut, ICCS-NTUA, Telefonica, Univ. Paderborn, VTT.

8 410 M. Janse et al. References [1] Amigo Deliverable D4.7. In: Janse, M., et al. (eds.) Intelligent User Services Privacy and personal security, IST Amigo (2007) [2] Janse, M.D., Vink, P., Soute, I., Boland, H.: Perceived Privacy in Ambient Intelligent Environments. In: Proceedings of the Context Awareness and Trust 2007 Workshop, CAT 2007, Moncton, New Brunswick, Canada, July 20, (2007) (On-line CEUR-WS proceedings ISSN ) [3] Lederer, S., Hong, J.I., Jiang, X., Dey, A.K., Landay, J.A., Mankoff, J.: Towards Privacy for Ubiquitous Computing, Technical Report UCB-CSD , Computer Science Division, University of California, Berkeley (2003) [4] Amigo Deliverable D4.7. In: Vink, P., et al. (eds.) Intelligent User Services Context Management Service, IST Amigo (2007) [5] Amigo Deliverable D4.7: Intelligent User Services User Modeling and Profiling Service. Otilia Kocsis & Elena Vidjiounaite. IST Amigo (2007) [6] [7] Jaber software foundation,

Privacy as Impression Management

Institute for Software Research Privacy as Impression Management Sameer Patil patil@uci.edu Alfred Kobsa kobsa@ics.uci.edu ISR Technical Report # UCI-ISR-03-13 Institute for Software Research ICS2 210