privacy factors in video-based media spaces

Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science

Click to edit Master title style

Privacy Factors in Video-based Media Spaces

Presented by:Anurodh Joshi & Nikhil Komawar



2Fall, 2011 - Privacy&Security - Virginia Tech – Computer Science

Michael Boyle SMART Technologies, ULC

Carman Neustaedter Kodak Research Labs

Saul Greenberg University of Calgary

Authors




Video Media Spaces (VMS) Multi-person audio/video networks that are

usually on most of the time

Introduction

Office

Home: Privacy more important




Perspectives on privacy

Privacy? Opposite of public (being together) Brierley-Newell (1998) being apart Privacy != Being alone Couple in a large group

Disclosure – boundary tension Organization Perspective

Seen positively -> increases ‘togetherness experienced by group members’. Increased collaboration

Workers don’t want to be on camera all the time




Privacy Regulation

Privacy regulation Dynamic process Each person has his /her own privacy preferences Complicated (cross-cultural contact, groups) Privacy regulation is a situated action• Interactions are constrained by temporal and spatial

contexts Media Spaces• Interactions are much more de-contextualized




Privacy violation: Deliberate • Unauthorized access

Unintentional• When user becomes cut off from the

context of people viewing him, it leads to privacy violation

Self appropriation• A regulatory process where people

modify their behavior and expectation according to social norms

Privacy Violation




Dilemma: Purpose of media space is to reveal Privacy Vs Utility

For one person to have richer awareness, others must necessarily have less privacy (Hudson & Smith)

Safeguard against deliberate abuse Access Control• Computer Security & Cryptographic measure • Hackers • VMS not equipped with adequate measures

Privacy Control In Media Spaces




Techniques for preserving privacy Distortion Filters

• Masks sensitive details• Work on visual information channel





Publication Filters Background

Subtraction – Removes unimportant information





In physical environment Controls are:• Fine-grained: can be adjusted person-by-

person, instance-by-instance basis• Light-weight: needs little physical or

cognitive effort In VMS

Not so Eg. Plugging the camera: light-weight

but not fine-grained (video is blocked for all recipients)

Difficulties in Privacy Control In Media Spaces




Feedbacks need to be conspicuous as well as not distracting

In physical environment feedback cues about privacy are socially natural, light-weight yet conspicuous and not distracting

Privacy Feedback in Media Spaces




In VMS such subtle feedback is not fully supported Disembodiment and Disassociation

confound the problem Technical limitation (speed,

bandwidth) Example ( so far):

Person in office can hear footsteps of a colleague approaching him to strike conversation

This audible cue signals onset of interactivity

Privacy Feedback in Media Spaces




Modes based on elements of privacy outlined by Gavison (1980) to control self-environment boundary

Solitude: Control over one’s interpersonal interaction

Confidentiality: Control over other’s access to information of self

Autonomy: control over the observable manifestations of the self

such as action, appearance, impression and identity

Privacy as Control Modalities




helps to ‘be apart’ from others Being apart != Being alone Crowding

Others are granted too much access to the self Isolation

One cannot interact with others to the degree one wishesWestin (1967) introduces four states:

Total isolation Intimacy Anonymity Reserve

Solitude




Most VMS require users to make extra effort

Camera shyness Heightened self awareness that people are

monitoring self causes discomfort Verbal and Para-Verbal Solitude controls Verbal

Telling others verbally or leave a sign outside the door

Solitude in VMS




Solitude

Para-Verbal means Posture or facial expression Gestures to dismiss

In Physical Environment These mechanisms are light-weight

In VMS Low Resolution, Low speed videos make it more

heavy-weight and explicit These changes may alter social interpretation of

expressed desires




Affordance of Space for Solitude

To regulate solitude one can go somewhere to be alone(get away) or even with few people

VMS is expensive so it is hard to regulate solitude (expensive)

VMS design complicates refuge-seeking Pulling the plug:

May not be suitable Reconnection is sometimes complicated -> people

refuse to pull the plug




Places partially determine accessibility i.e. effort people must extend for interaction

People control affordance of space for interactionPeople capitalize on ambiguity to regulate solitude

Closed door can symbolize either no one inside the room or someone wishing to be left alone

Nardi et. al. (2000) report that people use inaccuracies of IM presence indicators as a form of plausible deniability – making it ambiguous of there presence by being non-responsive

Affordances of Space for Solitude




Invisible space or boundary around self Distance is a strong cue for need of personal

space as well as interaction Example

Person sitting directly across Person sitting out of direct eye sight

In VMS The distance is not really a cue for social distance

or personal space

Personal Space




Space and social behavior interpolate with respect to solitude Personal space refers to invisible boundary in

space around a person separating him from others Boundaries are undefined but people show

definite behavioral and psychological responses when others enter their physical space

Territory is similar but usually specifies a fixed spatial or psychological location

Personal Space




Control of access to information about oneself Informal awareness cues, intentions, vital statistics, thoughts and feelings, medical

history It is about controlling information in forms of

Aural Visual Numeric Textual

Secrecy• It is similar but narrower • emphasizes what information is concealed from certain people• aspect of confidentiality as it modulates communication of information to

others

Confidentiality




Affects others’ attention

Directly regulates outward flow of information

Confidentiality vs. Solitude

Regulated one’s attention

Affects inward flow of information from others




A fundamental difference lies between confidentiality and informal awareness cues in VMS

Sensitivity: property of a piece of information that can be defined as a perception of how important it is to maintain control over it

Others’ impressions of a person are predicted upon their knowledge of the person, making confidentiality a part of impression management

Confidentiality continued …




Harms arising due to breach of confidentiality: Embarrassment Damage to ego, identity Loss of other’s esteem Impairment of livelihood

VMS can reveal sensitive when unintentionally capture and transmit a person’s image which might be socially unacceptable

Confidentiality continued …




Authorization and data integrity are a part of confidentiality

Process integrity, availability, responsiveness and reliability: ensure that computers perform their intended

functions completely and correctly in expected amount of time with no undesired side-effects.

Cryptography methods provide access control, verifying identity and checking the integrity.

Computers and Confidentiality




Authorization and data integrity are a part of confidentiality

Process integrity(important component of confidentiality), availability, responsiveness and reliability concern: ensuring that computers perform their intended

functions completely and correctly in expected amount of time with no undesired side-effects.

Cryptography methods provide access control, verifying identity and checking the integrity.

Computers and Confidentiality




A perception of how faithfully a piece of information represents some truth. Includes precision: detail of perception Includes accuracy: confidence in the information

Influence by the trust placed in the sender and also on the number of recipients

As persistency and transitivity are relevant to confidentiality Regulation of fidelity of information third parties

transmit about us is relevant to confidentiality

Fidelity




Within VMS design, confidentiality includes control over fidelity.

Different dimensions: Field view Resolution Frame rate Codec quality Latency jitter

Technology puts upper bound on these parameters, much lower than face-to-face interactions

Fidelity within VMS design




Despite these upper bounds, video is high fidelity medium for informal awareness and casual interactions.

Video offers more fidelity than what is needed in many scenarios, hence many video media spaces try to preserve confidentiality by discarding fidelity. Eg. Using a blur filter for distortion in the video

Studies show that effectiveness of such techniques is limited.

Fidelity within VMS design continued…




Principle means of confidentiality: keeping our bodies, possessions and thoughts accessible to some and not to others.

Possessions: Diaries, driver’s license, automobiles

Territorial and personal space help restrict others’ access to our bodies and things.

Similar control is available over speech: Directing his voice, modulating speech for whispering

Direct Controls




Architecture plays vital role in preservation of confidentiality: Walls reduce visual and auditory channels Walls fortification can be done using sound-

proofing materials Window blinds, doors

Direct Controls continued…




In VMS this can be achieved by: Turning down microphone volume Encoding information with cryptographic methods

so others cannot eavesdrop Filtration technique

Direct Controls continued…




People tell others their confidentiality desires verbally or para-verbally. Does not prevent them from revealing the secrets. People can choose to and sometimes keep secrets

confidentiality preferences are revealed over time as relationships are built

Notion of genres of disclosure: Institutional and situational expectations regarding confidentiality Patterns of disclosure evolving over time As they are loosely defined –

• it possible to feel violation of privacy by misuse and misappropriation of confidential information

• And not just inappropriate disclosure

Indirect controls




VMS changes rules of engagement Eg. Archiving of audio/video exchanges for replay Verbal telling people to keep matters confidential does not

prevent others from listening in laterPeople willingly and unwittingly spread information,

disinformation or inaccurate information intentionally or unintentionally

VMS should incorporate : Awareness and interaction channels

• Diagnose, police, reprimand damaging violations Accountable by letting users know how sensitive information is

handled within the system

Indirect Controls continued…




Freedom to choose how to act and interact in the world. (syn. personal liberty)

Self-appropriation and autonomy point to control over one’s behavior.

Privacy preserving in VMS requires: Managing behavior, identity and impressions Understanding of autonomy to regulate these

Autonomy




Author compares autonomy with ‘muscle’ Routinely exercise it or it will atrophy

Trying to do as one wishes is importantCommunication the same is important as well

explicit: content of speech implicit : speech, posture, face

Informal awareness cues for availability simultaneously reveal one’s desires.

Preserving and Constraining Autonomy




Autonomy is impaired when: Technology imposes constraint on time and place

for participationEg. Work from home situation

VMS connecting home and office puts social pressure to schedule one’s activities at home

Difficulties in deciding when to work

Preserving and Constraining Autonomy contd…




Exercising autonomy does not imply that one “always gets one’s way”

Each may do as one wishes as long as their choices conform to group expectations

Autonomy is generally constrained by group normsAutonomy can be compromised:

if the group norms change faster than people can adapt

Insufficient feedback is offered about activities for self-appropriation





Autonomy may be constrained by others as well Institutionalized people

Parents restricting children to keep them safePrimary motive is punishing bad behavior

Incarceration of criminals Grounding of children





Autonomy may be constrained by others as well Institutionalized people Parents restricting children to keep them safe

Primary motive is punishing bad behavior Incarceration of criminals Grounding of children

Observations have implications for VMS design Single UI for such a social technology eliminates

social governance of its use.





Symbiosis between: Autonomy-Confidentiality-Solitude

Autonomy gives people their privacy choices Autonomy depends on solitude &confidentiality Solitude &confidentiality also depends on autonomy

If VMS design impairs regulation of one of these controls, then others may be negatively affected Ubiquitously embedded cameras in a room limit autonomy

Symbiosis




People are actors who have fronts (conduits for social expression of self and team)

Front manifestation in signifiers like: Actions, utterances, interactions, verbal and non-

verbal signifiers Social settings like location, scenery, props,

appearance, costumes, posture, expressions, gestures, manners.

Fronts are carefully constructed and maintained to ensure homogeneity between performances.

Symbiosis




Autonomy includes control over identity and its expression: Physical appearance, mannerisms and voice

Passports, driver’s license, credit cards etc. are considered valid artifacts to reveal identity

Electronic equivalents: email ID, webpage, etc.Civil penalties for libel or unauthorized use of one’s

identity still lack in electronic mediaHence, privacy-enhancing techniques must be used

Identity




Identity is highly relevant to VMS design.Impersonation and identity theft are possible in

the VMS designsConfidentiality can guard against these crimesHowever, certain privacy preserving techniques

used can lead to confusion of identity: like distortion filters that blur an image Substitute actors in video

Identity continued…




A person may be involved in disjoint social worlds with a different identity in each (Pseudonymity).

Transportation and telecommunication technologies facilitate pseudonymity by allowing social circles to extend geographical ranges and population bases.

Pseudonymity




VMS are at odds with pseudonymity as identity information is conveyed through video of one’s face and body

Implementing video manipulation techniques to replace one’s image for multiple identities are tricky and could reduce value

of video channel

Pseudonymity




People assume different roles in different social worlds.

A single person can play different roles: As a leader with underlings As a suppliant with boss As a parent with children As a lover with her mate

Role Conflict




This creates a status divisions, role obligations

Overlapping social worlds can result in social conflicts. Parents visiting their children in their dorm

Role Conflict




Role conflict can be a major problem in VMS.VMS connects physically distributed people

Each likely inhabiting different physical contexts Each may have different set of privacy norms Problems with self-appropriation

These are evident when VMS connect both homes and offices

Could result into privacy violation leading participants to apprehend media space.

Role Conflict in VMS




A comprehensive vocabulary of privacy.Unambiguous description of privacy related

phenomenon and issues connected with design of VMS.

Three control modalities for privacy: Solitude Confidentiality autonomy

Conclusion




It does not specify the application of the vocabulary.Limit to the work:

Does not give design ideas, implementation or evaluation It’s a descriptive theory

• analysis of video media space systems within their real world context• Can reveal assumptions hidden within design, implementation or

evaluationThe further work needs to evolve these single words

describing privacy into axioms explaining ‘privacy-preserving’ Which will enable designing and evaluating privacy supporting

social technologies. Each term could generate investigation in its own.

Conclusion




Do not adequately elucidate their definition in the paper with example of VMS.

In their conclusion they focus on some discussion of another work which analyzes design of a VMS based on their work.

Critique




Video

http://research.microsoft.com/apps/video/default.aspx?id=135950

http://research.microsoft.com/apps/video/default.aspx?id=135950




Questions?

Thank You

privacy factors in video-based media spaces

Documents