Ethics Emerging: the Story of Privacy and Security Perceptions in Virtual Reality

Virtual reality (VR) technology aims to transport the user to a virtual world, fully immersing them in an experience entirely separate from the real world. VR devices can use sensor data to draw deeply personal inferences (e.g., medical conditions, emotions) and can enable virtual crimes (e.g., theft, assault on virtual representations of the user) from which users have been shown to experience real, significant emotional pain. As such, VR may involve especially sensitive user data and interactions. To effectively mitigate such risks and design for safer experiences, we aim to understand end-user perceptions of VR risks and how, if at all, developers are considering and addressing those risks. In this paper, we present the first work on VR security and privacy perceptions: a mixed-methods study involving semi-structured interviews with 20 VR users and developers, a survey of VR privacy policies, and an ethics co-design study with VR developers. We establish a foundational understanding of perceived risks in VR; raise concerns about the state of VR privacy policies; and contribute a concrete VR developer "code of ethics", created by developers, for developers.

[1]  M. Lombard,et al.  Content Analysis in Mass Communication: Assessment and Reporting of Intercoder Reliability , 2002 .

[2]  Noel E. O'Connor,et al.  The Convergence of Virtual Reality and Social Networks: Threats to Privacy and Autonomy , 2015, Science and Engineering Ethics.

[3]  Suzanne Willis,et al.  Beyond the ‘digital divide’ , 2006 .

[4]  Tadayoshi Kohno,et al.  In situ with bystanders of augmented reality glasses: perspectives on recording and privacy-mediating technologies , 2014, CHI.

[5]  J. Grimshaw,et al.  What is an adequate sample size? Operationalising data saturation for theory-based interview studies , 2010, Psychology & health.

[6]  John R. Wilson,et al.  Virtual Reality-Induced Symptoms and Effects (VRISE) , 1999, Presence: Teleoperators & Virtual Environments.

[7]  Dominique A. Greer,et al.  Risk Perception and the Public Acceptance of Drones , 2015, Risk analysis : an official publication of the Society for Risk Analysis.

[8]  Abdulmotaleb El-Saddik,et al.  A Novel 3D Graphical Password Schema , 2006, 2006 IEEE Symposium on Virtual Environments, Human-Computer Interfaces and Measurement Systems.

[9]  Emilee J. Rader,et al.  The importance of visibility for folk theories of sensor data , 2017, SOUPS.

[10]  Irene Pollach,et al.  What's wrong with online privacy policies? , 2007, CACM.

[11]  E. Rogers,et al.  Diffusion of innovations , 1964, Encyclopedia of Sport Management.

[12]  Marshini Chetty,et al.  Spiders in the Sky: User Perceptions of Drones, Privacy, and Security , 2017, CHI.

[13]  Florian Alt,et al.  Seamless and Secure VR: Adapting and Evaluating Established Authentication Systems for Virtual Reality , 2017 .

[14]  Lorrie Faith Cranor,et al.  Necessary But Not Sufficient: Standardized Mechanisms for Privacy Notice and Choice , 2012, J. Telecommun. High Technol. Law.

[15]  Mayank Agarwal,et al.  Secure authentication using dynamic virtual keyboard layout , 2011, ICWET.

[16]  Jennifer Preece,et al.  Lurker demographics: counting the silent , 2000, CHI.

[17]  E. Hargittai.  The Digital Divide and What to Do About It , 2003 .

[18]  Predrag V. Klasnja,et al.  Exploring Privacy Concerns about Personal Sensing , 2009, Pervasive.

[19]  Michelle L. Mazurek,et al.  You are Not Your Developer, Either: A Research Agenda for Usable Security and Privacy Research Beyond End Users , 2016, 2016 IEEE Cybersecurity Development (SecDev).

[20]  Mani B. Srivastava,et al.  Privacy risks emerging from the adoption of innocuous wearable sensors in the mobile environment , 2011, CHI.

[21]  Katie Shilton,et al.  Values Levers , 2013 .

[22]  Albert A. Rizzo,et al.  Development of a VR therapy application for Iraq war military personnel with PTSD. , 2005, Studies in health technology and informatics.

[23]  Tadayoshi Kohno,et al.  How to Safely Augment Reality: Challenges and Directions , 2016, HotMobile.

[24]  R WilsonJohn,et al.  Virtual Reality-Induced Symptoms and Effects (VRISE) , 1999 .

[25]  Ian Warren,et al.  Crime risks of three-dimensional virtual environments , 2010 .

[26]  Tawanna Dillahunt,et al.  Support for Social and Cultural Capital Development in Real-time Ridesharing Services , 2018, CHI.

[27]  Narseo Vallina-Rodriguez,et al.  "Is Our Children's Apps Learning?" Automatically Detecting COPPA Violations , 2017 .

[28]  Aleecia M. McDonald,et al.  The Cost of Reading Privacy Policies , 2009 .

[29]  Vivian Genaro Motti,et al.  Users' Privacy Concerns About Wearables - Impact of Form Factor, Sensors and Type of Data Collected , 2015, Financial Cryptography Workshops.

[30]  David A. Wagner,et al.  Risk Perceptions for Wearable Devices , 2015, ArXiv.

[31]  Dong Wen,et al.  Consumers' perceived attitudes to wearable devices in health monitoring in China: A survey study , 2017, Comput. Methods Programs Biomed..

[32]  R. Stuart Geiger,et al.  Trace Ethnography: Following Coordination through Documentary Practices , 2011, 2011 44th Hawaii International Conference on System Sciences.

[33]  Tadayoshi Kohno,et al.  Security and privacy for augmented reality systems , 2014, Commun. ACM.

[34]  J. Reeve,et al.  Solutions to problematic polypharmacy: learning from the expertise of patients. , 2015, The British journal of general practice : the journal of the Royal College of General Practitioners.

[35]  Yang Wang,et al.  Flying Eyes and Hidden Controllers: A Qualitative Study of People’s Privacy Perceptions of Civilian Drones in The US , 2016, Proc. Priv. Enhancing Technol..

[36]  Katie Shilton,et al.  Four billion little brothers? , 2009, Commun. ACM.

[37]  Antonio Mongelli,et al.  Augmented and Virtual Reality , 2014, Lecture Notes in Computer Science.

[38]  Eran Toch,et al.  Privacy by designers: software developers’ privacy mindset , 2017, Empirical Software Engineering.

[40]  John William Nelson,et al.  A Virtual Property Solution: How Privacy Law Can Protect the Citizens of Virtual Worlds , 2010 .

[41]  Helen J. Wang,et al.  Enabling Fine-Grained Permissions for Augmented Reality Applications with Recognizers , 2013, USENIX Security Symposium.

[42]  Krishna P. Gummadi,et al.  Human Perceptions of Fairness in Algorithmic Decision Making: A Case Study of Criminal Risk Prediction , 2018, WWW.

[43]  Peter M. Chisnall,et al.  Questionnaire Design, Interviewing and Attitude Measurement , 1993 .

[44]  Wayne G. Lutters,et al.  The Work of Cybersecurity Advocates , 2017, CHI Extended Abstracts.

[45]  Hai-Ning Liang,et al.  An exploration of usable authentication mechanisms for virtual reality systems , 2016, 2016 IEEE Asia Pacific Conference on Circuits and Systems (APCCAS).

[46]  Laura A. Dabbish,et al.  The Role of Social Influence in Security Feature Adoption , 2015, CSCW.

[47]  Orin S. Kerr,et al.  Criminal Law in Virtual Worlds , 2008 .