Hi, I’m William Seymour, and today I’m going to be presenting our paper Informing
the Design of Privacy Empowering Tools for the connected home.
When we think of conceptualisations of the home, we often see it as a refuge that we
can retreat to and be ourselves - a personal castle. Amongst other things, the home serves
as an important space in which to decompress, somewhere where no one is watching or judging
you. Indeed, when you invite someone into your home, there is still usually demarcation
between public and private - guests do not have the run of the house after being invited
through the front door. However, slowly but surely that's beginning to change. And I don’t
mean that people are going to start wandering into your house. Well, at least not natural
persons. Increasingly popular, smart devices are brilliant in that they allow us to automate
tasks around the house, access information with little effort, and can entertain us.
Some of Alexa’s jokes are even funny.
But in order to get access to this, you need to accept devices - and their terms - into
your home. This often involves capturing interactions, analysing what you say at home, mapping your
house, or having access to your smartphone.
Part of the issue is that people aren’t aware of what’s going on. And to this end
there’s a lot of media coverage about devices that capture, and sometimes also leak, private
and intimate information.
Studies that observe and show people disclosures from their apps usually find that the initial
response is feeling creeped out, or outright shock, even though there’s a background
awareness of privacy and security problems. Seeing what’s happening to you in your home
is powerful. But quickly, this shock turns into dejected acceptance. It’s the same
for everyone. I have nothing to hide. It’s too late to do anything about it. I can’t
do anything about it.
When we consider the reasons why this is a hard problem to navigate and reason about,
there are three main issues that need to be addressed. Firstly, you need to have detailed,
specific knowledge about what the devices in your home are doing, and the companies
that they are talking with. You can’t do much about what you don’t know.
Secondly, you need an understanding of the bigger picture. Why do companies make devices
that do this? Are all disclosures equally bad? What about data that goes to different
jurisdictions? This kind of education is something that doesn’t come up very often, although
here in the UK at least, we’re beginning to see educational resources in schools that
talk about the architectures and infrastructures that enable connected devices.
Ok, so you know what you devices are doing. You have a pretty good understanding of why
things are happening, and you find something that you don’t like. If you want to be able
to do something about your privacy then you need to have effective levers you can pull,
either to tell devices to stop collecting and sharing, or to make them. And you need
all three of these together - it’s not enough to only give people powerful tools, or to
educate them without tools to make changes. In fact, this is exactly what leads to the
dejected and downtrodden mindset that we saw earlier. I bet what’s happening is bad,
and even if I knew I wouldn’t be able to change it.
With this in mind, we set out to explore potential solutions using what we call privacy empowering
technologies through the use of a technology probe. Technology probes are artefacts that
are sent out into the unknown in order to see how people engage with a topic during
everyday life. Our probe was created to answer social science questions about how people
think about their connected privacy and what concerns they have, engineering questions
regarding the data you need to do this, and the feasibility of doing so with today’s
devices, and design questions about what features and representations work in this context.
The probe, called Aretha - like, r.e.s.p.e.c.t? Never mind - the aretha probe combines each
of these three pillars to see how they might impact the ways that families engage with
privacy in connected homes. The aretha software is run on a mini pc attached to a keyboard
and mouse. This is then situated somewhere prominent in the home and connected to the
internet. Devices can be connected to Aretha’s WiFi hotspot, and traffic to and from those
devices is analysed before being forwarded to the internet. The Aretha software is open
source and you can find it on github.
With this in mind, our first design goal was to make Aretha’s visualisations of home
network traffic clear and easy to interpret. We wanted to give users facts about how their
devices were communicating over time, as seen here in terms of traffic volume per device
and per external company, but also in aggregate, a view which was intended to present a sort
of privacy risk profile for the household. This view also shows the geographic location
of data destinations.
To back up this specific knowledge about what devices are doing, Aretha also needed to help
give context about how and why their devices operate as they do. We combined existing resources
from organisations such as the BBC with our own content to create a curriculum that participants
completed during the study, and these were illustrated with examples dynamically taken
from each participant’s network traffic.
Finally, the probe needed to give people accessible and effective controls to manage their information
flows. We elected to include a firewall style rules system, whereby Aretha would translate
high level directives, such as “block all traffic from my iPhone to Facebook” into
lower level directives that the system could enforce on traffic passing through it.
To test the probe hardware and software, we conducted a pilot deployment at the UK’s
building research establishment in a fully equipped smart home. 14 members of the public
were invited to try Aretha and give feedback which informed the final version of the software.
After a period of recruitment, we selected three participant households with a variety
of inhabitants, devices, and technical knowledge.
We deployed the probe in participant’s households for six weeks. Initial visits included an
entry interview to establish what participants currently thought about online privacy, what
devices they had, as well as a discussion about what data the probe would be collecting.
We then installed the equipment and helped participants to connect their devices. For
the first two weeks, the probe operated passively, only showing visualisations of network traffic.
After two weeks we enabled the education curriculum and asked participants to complete a short
session every other day. We also conducted a brief check in interview to capture responses
that might otherwise be forgotten by the end of the study. After another two weeks the
firewall control was enabled, along with another check in.
Finally, at the end of the study we visited the households again to conduct an exit interview.
Here we asked about participants’ experiences during the study, how they thought their perceptions
and practices had changed, and what their responses were to their initial statements
about privacy and smart devices. We also asked them what additional features they wanted
to see on subsequent iterations of the probe.
Two researchers independently performed thematic analysis on the interview transcripts, meeting
to review and merge themes to arrive at the final analysis. When analysing the data we
also triangulated events from the interviews with network traces collected by the probe.
All of the materials from the study can be found on the open science framework.
All three households participated in the entirety of the study, during which the probe collected
network traces each time devices contacted the internet. Four main themes arose during
the analysis, shown on the left here, which I’ll now go over in depth.
Over the six weeks of the study, we saw how our participants and their families developed
their conceptions of what privacy was. Beginning with vague references to abstract threats,
by the time of the exit interview they had begun to use concepts and vocabulary learned
from the curriculum to describe the concrete risks that their household might face online.
The increased awareness of data flows given by the probe, combined with underlying knowledge
from the curriculum highlighted decisions that would previously have been ignored. This
in turn changed the way that the probe visualisations were interpreted, such as how P2 came to realise
that over half of the data from his devices was sent outside of the EU, raising questions
about how this might affect legal protections given under the GDPR.
We also saw how the concerns of participants became much more personalised during the study.
P1 used knowledge and information from the probe to devise an in-depth strategy for investigating
the companies appearing on the display, including corporate structure and connections, that
helped him to align his device usage with his values. The curriculum content, as well
as the background theme of data disclosures generated by the visualisations, prompted
P3 to review other aspects of her online privacy. Measures such as preventing account details
being shared outside of the family turned out to be easy steps they could take as a
household that would have otherwise gone unnoticed.
Indeed, as the study progressed, other members of our participant’s households began to
express an interest in the probe, and we found that it became a common frame of reference
for discussions about privacy and security. Sometimes this involved building mental models
through the immediate feedback offered by the probe, using the visualisations to associate
online activities with data disclosures. At other times, members of the household would
use the probe to hold each other to account over what was happening on the home network.
Finally, conducting a home deployment foregrounded a number of issues around the use of privacy
empowering tools in a busy home environment. Participants were extremely hesitant to use
the firewall controls offered by the probe, worried that it might break things in ways
that weren’t understandable, or that wouldn’t become apparent until hours or days after
entering a new rule, when they might not have time to fix it amongst the hectic reality
of family life. This was made worse by the perceived interconnectedness of many services
- it was not clear if disabling traffic to one company would break online experiences
with others that used their services.
Revisiting the design goals of the study, there was good evidence to suggest that our
participant households gained significant awareness of data disclosures by their devices.
In fact, they began to request additional features that would allow them to learn more,
such as indications about the content of disclosures. Despite the fact that 74% of the traffic from
our participant’s households was concentrated in the top three companies, there was a clear
bias towards concerns about breadth of disclosure over depth. This highlights familiarity as
an important factor in our participant’s threat analysis, with the top traffic destinations
largely considered known quantities. The curriculum content did help to make this data more intelligible
for our participants, but other factors prevented success in some of the households, such as
P3’s decision to delegate part of the learning process to their partner, who was usually
responsible for managing technology in the house. Finally it was clear that the firewall
controls offered by Aretha failed to help participants action their newly formed privacy
preferences. But participants did take this opportunity to develop their own means of
control, such as P1’s research strategy or how P3 started conversations about family
accounts and who they should be shared with.
In terms of limitations, the exploratory nature of the probe made us opt for a smaller number
of in-depth case studies, in order to give a more holistic understanding of how similar
privacy empowering technologies might be used in the wild. But being self selecting early
adopters, they were clearly not representative. I want to point out that this configuration
of the probe is not the only one, and given the responses to the firewall, it clearly
wasn’t the best. In the spirit of the technology probe methodology, I’d suggest that it serve
instead as inspiration for future privacy empowering tools.
To sum up, Aretha was successful in helping us understand how people can understand and
interact with their connected devices in the context of privacy-empowering technologies.
Even though it didn’t meet all of the design goals, the shortcomings of the firewall were
instructive in their own way. Aretha also serves as a reminder that there are other
ways to engineer the connected home - and that even if devices do behave themselves,
users might want their own way of verifying this. The results of the probe study are also
cause for encouragement, showing that provided with the right tools and scaffolding people
can engage and formulate their own privacy preferences and strategies.
Thank you for listening. If you have any questions, I’ll be happy to answer them via email.