Current Status

I designed and led a research study consisting of primary and secondary research to investigate the current landscape of home IoT regarding privacy and security. I interviewed and conducted activities with Smart device owners who were concerned about data collection. Research aimed to answer questions about the challenges of protection, current habits, privacy limitations, and knowledge. I generated insights and design principles that will guide the project through the next portion of the project, which will include 3 stages of prototyping and usability testing culminating in a full UI spec document and presentations. 

• 12 participant sessions
• 8 expert interviews
• 30+ literature review papers
• 628 responses to attitudinal survey

Secondary Research

To see what is already known regarding home IoT. Included large-scale attitudinal surveys and publications as professional assessments of the situation. We conducted an ongoing literature review as well as expert interviews.

CONSENT

The current model for consent in IoT is insufficient. We used Batya Friedman's model as a benchmark, and the 6 critical components: Disclosure, Comprehension, Voluntariness, Competence, Agreement, Minimal Distraction (“Informed Consent by Design,” 2005). These components create a foundation for ethical design and are often violated in home IoT situations, for example, the “problem of other peoples things.” This left us wondering what would a truly consensual Internet of Things home environment look like?

VALUE

IoT’s primary value is not in solving a technical challenge, but of improving experiences through convenience, control, customization, and automation. Cisco interviewed 3,000 US and Canadian consumers and found “consumers believe these products and services deliver ‘significant value,” but they don’t understand or trust how the data they share with providers is managed or used.”

PRIVACY AND SECURITY

The largest technical challenge with implementing IoT systems is security. Unfortunately, the “Smart” devices present in homes are particularly susceptible to hacking (Arabo et. al, 2012). Security is further weakened without maintenance such as updating, making systems susceptible to malicious attacks.

DATA COLLECTION

Concerns about the collection of personal data are backed up by quantitative data such as surveys. One survey found that 68% of people were concerned about the exposure of personal data in a connected home environment (Fortinet, 2014). Another found that 85% of Internet users would want to know and control more of the data collected from their devices (TRUSTe, 2014).

We conducted interviews on academics and advocates Batya Friedman (Professor at the University of Washington and author of Informed Consent by Design), Gilad Rosner (founder of the Internet of Things Privacy Forum), Michelle Chang (UX Designer at Electronic Frontier Foundation), and Peter Bihr (Co-founder of ThingsCon and Mozilla Trustmark Fellow) (top row), and technical expertise (bottom).

Advocates spoke of the need for transparency, both at the interface level and with data collection. I also gained insight into the players, like government, companies, and individuals, and that the onus of responsibility should not fall on the individual. We also learned about a trustmark currently being developed for IoT products.

WHY I CARE

IoT technology is frontier. The Internet of Things: Interaction Challenges to Meaningful Consent at Scale argues that the emerging field of IoT needs to be embraced by HCI designers who are versed in both technology and human-centered design. It is by this qualification and the responsibility of HCI to “help surface the implications of data sharing in order to develop models of understanding, social expectations for understanding trade-offs, and means for developers to know their designs comply with these expectations and for citizens and policymakers to be able to trust that they do.”

WHO

We conducted sessions with 12 subjects (S1-S12; mean=40.5, s=13.57, 4 male, 1 MtF). Targeted participants to get a range of age and gender, as well as the following:

• Potential home-buyers and minimum age of 27 years.
• Own at least one Smart device (baby monitor, thermostat, light bulb, security camera, wireless caregiver, voice assistant, refrigerator, toy, television, plug).
• Self-reported as concerned about privacy and security, but not to the point of paranoid (2, 3, or 4 on the scale of 1 to 5).

WHERE

Participant homes (2; Skype (also from home) (4); Participant workplace (1); MHCI+D studio (5). Interviewing in home when possible preserved some fidelity of self-report.

WHAT

Study activities (conducted on Subject#, changed as saturation was reached)

01. Spectrum card sort (S1-S9)

• Think aloud; sort devices on two spectrums: Value and Risk.

02. Matrix card sort (All)

• Consider Value and Risk concurrently

03. Semi-structured interview (All)

• Measure understanding of connections between devices and security features, privacy protection habits, living situations, and concerns. Questions ordered from low-level to high-level.

04. Privacy policy think aloud (S1-S4)

• Provided voice assistant privacy policy and instructed participants to check if personal recordings are being sent to North Korea.

05. Design activity (S9-S12)

• Draw an ideal device or product to manage these issues. Instructions were left vague, and creativity encouraged.

I used each card sort artifact to sort devices by participant as Low, Medium, and High in Excel. I aggregated the ratings and created the following charts which highlighted interesting differences between value and risk judgements.

Participants assigned their own definitions of value, which differed both according to person, and even across devices within the same participant: convenience, financial savings, environmental monitoring, home automation, entertainment, comfort, home modification, health monitoring, connection management, and accessibility.

Routers ranked highly because of their essential nature: they make the functionality of every other connected device possible. However, they are seen as mandatory infrastructure. 

Wireless caregivers ranked highly because of the freedom and accessibility. Human-centered questions were raised when one participant described how much everyone in her family loved her mother’s wireless caregiver, except for her mother, who would often show her disdain by removing the battery. 

Voice assistants were valued for entertainment and convenience. 

Smart thermostats, like Nest, were “loved” by participants that owned them, and desired by most who did not. Comfort, environmental and financial economy, and interface design were cited as advantages. 

Smart refrigerator and baby monitor ranked lowly because of gratuitous “smartness” and potential spying.

Participants assigned their own definitions of risk. Definitions differed both according to person, and even across devices within the same participant: spying potential, reliance, reliability, multiple entities having access, device always on and the brands security reputation.

The lowest ranked risks are simple devices like Smart plugs, Smart light bulbs, remote control, and connected speakers. These devices are seen as less systemic and therefore hacks would sacrifice less personal information. 

The diversity of risk assessment is highlighted in voice assistants and security cameras, which are tied for highest risk. Voice assistants have high potential for spying, whereas the fears about security cameras are societal (they perpetuate paranoia and inequalities). 

Instead, I combed through the data and sorted responses into broad fitting categories. 
Users had the chance to explain their answers. In this population that is heavily biased towards home connected devices, the majority still expressed concerns about privacy and data collection.

The survey was meant to play a supplemental role to attitudes we explored with participant sessions. Most responses were after posting to reddit.com/r/homeautomation and reddit.com/r/googlehome. I used Google Forms to collect responses, and exported to CSV for analysis. I outsourced the data for statistical analysis, but ultimately decided that the questions were not controlled enough to draw convincing conclusions to explain significance. 

I sorted each subject into two spectrums based on themes that arose during the interview phase: amount of technical command, and amount of concern. The hashed area contains our users we will design for. Some users were omitted because their concern was so high that they avoided connected devices, or because their technical expertise made them self-sufficient at protecting their privacy.

I identified themes from user interviews and abstracted to craft 4 personas: 2 target users and their anti-personas. I designed anti-personas because knowing why people are untroubled also informs our design, but convincing users to be concerned is outside the scope of our design solution. 

And starting to think more:

Another participant mentioned that our line of questioning and made her reflect on some of her privacy practices and alter her behavior. Through these interviews it became clear to us that users want to discuss and reflect on their privacy maintenance behaviors. Many wondered ‘should I do more’? A small amount of conversation can motivate people to be more aware of their data and lead them to practices that more directly meet their goals.

We will begin the design phase by ideating 70 concepts . We will down-select based on feasibility, desirability, and viability, using our previous research to determine each. The final 3 concepts will be prototyped and usability tested on potential end users.

Stay tuned!