This is the virtual presentation of “Informing the Design of a Personalized Privacy Assistant
for the Internet of Things” narrated by Jessica Colnago.
Okay, so let’s talk about the Internet of Things, or IoT, what is this?
The Internet of Thing is the name given to the phenomenon where everyday devices are
imbued with computational technology and are able to sense their environment, and respond
as needed.
Common personal IoT devices are smart speakers, smart watches and fitness trackers, but we
are now seeing devices such as smart fridges and connected cars.
These are devices that usually the user will purchase themselves, set it up themselves,
and use it for their own personal use.
Another type of IoT devices are those that belong to third-parties.
This could be a friend’s smart speakers in their living room that you are exposed
to when you visit, or smart TV in a conference room in a company you are interviewing.
Another possibility is that this third-party is actually the government.
If you think about the concept of Smart Cities, you are then faced with devices smart traffic
lights that take into consideration traffic and pedestrian flow to balance how long a
light should be green, connected buses that provide its riders internet and updated information
on their location.
Even if it is strange to read the privacy policy for your fridge, in the context of
personal devices the current privacy paradigm of notice and consent is feasible to be enacted.
However, properly notifying people and obtaining their consent when you take into consideration
third-party devices becomes more complicated.
In this context the concept of a Personalized Privacy Assistant, from here on referred to
as PPA, is envisioned.
This assistant would be, for example, an app on your phone that is aware of devices around
you that are collecting data related to you. So when you are walking down the street it
would let you know about the city new smart sensors and help you make decisions on how
to control your data.
It would also be able to let these sensors know what your data preferences are.
In this paper we do not focus on how to build this device, instead we focus on a preliminary
step of what are people’s perceptions of such a device and what functionalities they
would like.
If you are interested in implementation details, you can check privacyassistant.org/iot for
more research in this area.
To investigate the question “What are people’s opinions of a Personalized Privacy Assistant”
we conducted 17 semi structured interviews with residents of Pittsburgh, PA where we
focused on investigating people’s perceptions of different levels of automation of such
an assistant.
We obtained a varied sample of participants through recruitment posters placed at Carnegie
Library branches, as well as bus stops and light poles in those neighborhoods, flyers
at cafes, and through advertisements on Craigslist.
This led to a diverse set of participants.
We had 8 participants that self-identified as male, 8 female, and 1 non-binary.
Our participants came from several walks of life with the mean age of 39 years (with the
youngest being 22, and oldest 68).
Also, the majority of our participants self-identified as technologically savvy or average users.
For more details and an individualized view, please refer to table 1 in the supplemental
materials. Participants were compensated with a 20 dollar
Amazon gift card for participant in an one hour long interview, and we conducted these
interviews with two researchers in the room, one main interviewer and one secondary interviewer
and note taker.
The interview audio recorded and then later transcribed.
The interview was divided in three parts, and at the end of each part the note taker
would be given the opportunity to ask questions. Otherwise, we followed the script that you
can find in the supplemental materials.
In Part 1 we focused on understanding what people knew about IoT, what they thought of
it, and what were the benefits and concerns that they had. We only asked participants
about privacy concerns if they raised them themselves, or at the very end of this section.
The goal of this part was to get a sense of people’s own thoughts about IoT without
being biased in one way or another.
Part II was essentially an equalizer. In it we presented participants with a neutral (and
simplified) definition of IoT based on the IEEE definition. We asked participants their
thoughts, and clarified questions that they might have.
For the second batch of participants, we also asked about specific concerns that had been
previously raised by previous participants, in case these questions had not been discussed
so far.
Finally in Part III we presented the participants with increasingly more automated versions
of a PPA.
Starting from one that could provide its user with notifications of the devices around them
to a PPA that could make recommendations on how to set up their privacy preferences for
those devices and finally to a PPA that would be able to make data sharing decisions for
its users.
So, what did we find?
Based on our analyses we identified that our participants had a good understanding of IoT,
with a few knowledge gaps related to data storage, data collection, and device communication.
We also noticed that participants had mostly positive opinions of IoT, with some describing
it as positive and negative but not neutral, and one stating that it was negative under
current trends.
Our participants had a wide range of concerns. As found in the previous literature they had
concerns about privacy, data security and data misuse, and their physical safety.
However, our participants also listed a number of societal concerns, such as machines becoming
too smart and taking jobs from humans; job or service discrimination based on data collected
via IoT devices; people relying too heavily on these smart devices and becoming lazy;
as well as the impact that this technology and data collection opportunity could have
on institutions and government, from fueling corruption, allowing for its constituents’
manipulation, and the perpetuation of tailored echo chambers.
Interestingly enough, our participants also had a number of justifications as to why they
were not concerned.
In particular they mentioned the ability to protect themselves, their trust in the manufacturers,
which was at times expressed as an expectation, and at times as a hope, and general resignation
with the state of affairs.
We noticed different ways that this resignation was expressed, from feeling powerless as described
by participant 2: Quote: "Whether they do or don't, or whether
I try to stop it or not, that doesn't really bother me, really... They're gonna do it anyway.
It doesn't matter"
To normalizing this type of technology and data collection as described by participant
8: Quote: "You can't have a private conversation
without the Internet listening. So, it's just more of that."
These previously described insights helped us get a better understanding of our participants’
thought processes and motivations.
Related to a PPA that would give awareness, most participants liked this idea, but they
also wanted and expected to have a say in the data collection, as opposed to be given
pure awareness. Participant 17, imagining how this app would work, described his thoughts:
"Here they are, here is what they do, you can delete just one if you want, you can limit
it, if you want."
A few participants expressed concerns about this type of assistant and did not react positively
to it.
These concerns were related to becoming overwhelmed as described by participant 6:
Quote: "If I was always aware of all of the devices, I would be even more uncomfortable
than I already am. It's like, I don't know where the line between knowing and just slowly
spiraling into total paranoia is."
And how aa PPA could get in the way of the societal benefits that could be derived from
a wide use of IoT devices: Quote: "I feel like that would really ruin
a lot of smart city sensors."
As to a PPA that could provide recommendations, even though we had envisioned it as basing
these recommendations on its users past behaviors, participants liked the idea of having external
sources that could serve as an educational tool. As participant 4 stated:
Quote: "When it comes to new technology, you can't expect that people are going to be perfectly
literate or just be able to imagine all the ways in which information like that could
be used. Now, for example, I guess you have a tool and it will tell you, 'This is the
nature of this particular tracker. Here's what it's doing.'"
However, they also noticed the potential for biases as participant 16 noted:
Quote: "That'd be cool, but any sort of recommendation is biased. I would just wonder, how is that
recommendation being made? Why is one thing more important than another?"
Those that disliked this version of PPA preferred to maintain control, thought that the recommendations
would be paternalistic and unnecessary, or thought it was simpler to just ask as having
to read and process a recommendation would be an extra step that would like not change
their mind.
When it came to a version of PPA that could make decisions for them, participants were
split. about a third disliked the idea not wanting to be controlled by a device or being
concerned about the device making poor decisions for them.
A third accepted the idea if it was automated, or as participant 13 put it:
Quote: "I think if they want to tell me 'you've done this in the past, would you like to keep
doing this?' Yeah, that's okay."
Finally a third liked the idea of it being autonomous as it would reduce their cognitive
effort, but still had caveats such as participant 5 put it:
"If my email auto-complete capability is any indication, it can be pretty smart. But it
would need to come from a company that I trust."
or as participant 15 stated: "That would be fine if there were a justification
recorded somewhere where they would say ''on such date you made this decision'... I want
to see the reasoning."
Based on these interviews and our participants' feedback we provide the following suggestions
when designing a personalized privacy assistant:
1) It should let its users define how much automation they would want. As the different
levels we discussed in this paper would be part of the system anyway, making those steps
visible to the user and allowing them to decide how to interact with their assistant is advised.
2) Recommendations should come from multiple sources, and you should let users decide the
types and combinations of sources that they would like.
3) The assistant should take great steps to not overwhelm its user, this could come in
the form of learning when to best interrupt, identifying when its user might want to know
about a particular device, and avoiding repeated notifications.
4) The PPA should be transparent in all of its actions, explaining why it is behaving
as it is, and provide ways for people to audit past decisions.
5) Finally, this assistant should empower people. There was already a sense of powerlessness
and resignation within our participant sample, and having a device that would educate and
allow them to take control of their lives could be beneficial to them.
Lastly, it is important that we address the limitations of this research.
Interviews are limited in terms of validity and reliability of the results. We attempted
to mitigate these issues by having one interviewer conduct all interviews to limit sources of
inconsistencies, by having a dedicated notetaker who could serve as a separate check on the
interviewer’s understanding, by taking time to correct misunderstandings when the interviewer
did not make themselves clear enough, and by avoiding leading questions.
To avoid biasing participants, we did not mention privacy or security in the first half
of the interview or in any communication prior to the interview, and we held these interviews
in a building that is not associated with privacy or security research.
We attempted to mitigate positivity bias by stating that the PPA was something we were
thinking about doing and wanted feedback before building it. When asked if we would build
it ourselves, we stated that we would not.
Finally, the exploratory nature of the study and its small sample size are inherent limitations
for generalization of the results and the depth of the recommendations provided.
We also identified a series of open issues for research in this area.
Related to public data collection we have identified that there is a tension between
people wanting to be able to live their lives free of surveillance and the desire to extract
the benefits that would come from smart cities and devices.
We also note that there is a more philosophical and legal question as to whether automated
consent is valid. From a technological perspective we could attempt to turn giving consent to
an asynchronous process when possible, allowing people to verify and confirm automated decisions,
bypassing the need for automated consent.
Given that one of our participants was so resigned to the idea that they could not exert
control over their data collection anymore that they rejected the notion of a PPA as
a pointless exercise all together, it is important that we better understand what’s driving
this phenomenon and how we can intervene. It is also important that we guarantee a base
level of protections for those people that are strongly resigned and, as such, won’t
engage in privacy protective behaviors.
Lastly, our participants mentioned that this sort of an assistant could, in itself, be
a danger to at-risk communities. We need to ensure that the data this device collects
and communicates won’t be able to be used against its user.
With this we reach the end of our virtual presentation and would like to leave you with
these three takeaways:
1) We found that participants weighed the desire for control against the fear of cognitive
overload. 2) We recommend solutions that address users’
differing automation preferences and reduce notification overload.
3) There is a series of open issues that need to be addressed before this technology can
be properly deployed.