Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1346 Thanks!
[Music]
something really really cool I think and
I'm really looking forward to it and to
get a glimpse to what it's all about so
the talk is about a research project
which let the users see and control
what's done with their personal data at
least that's what I read in the
description of the talk and I'm really
really looking forward to hear some more
details about this from Mort who is
presenting this talk and he's gonna be
talking about the platform design about
the implementation and the current
status of this data box thing and please
give a really warm round of applause to
Mort
thank you and thank you for having me
I'm gonna before I start I shall begin
by apologizing I have small kids so it's
permanently flu season in my house and
if I start coughing uncontrollably I
just bear with me what I'm gonna do is
talk a bit about the data box project
this is a project that was funded by the
UK Research Council EPSRC it's a
collaboration between University of
Cambridge Imperial College London and
the University Nottingham with a number
of industrial partners one of whom I'll
mention the talk the BBC so to set the
scene a little bit I probably don't need
to say this very much at this particular
venue I'm so you made this wish to go to
those tumblr sites which I thought were
quite funny
big data pics tumblr comment we put a
chip in it tumblr calm but we're now in
a big data world so data is collected
all around us in the environment from
what we do retail habits sensing IOT
things in our homes and all around us
data is being collected there's a lot of
opportunities and challenges that are
presented by this and you can imagine a
great deal of sort of personalization
personal optimization things you can do
to make your house more energy efficient
for example and there's lots of things
you can do that are beneficial from this
sort of data but there's also a lot of
challenges that are presented
particularly around Krita see around the
rights of the individual and to control
and see what's happening about
I did warn you sorry the the nature of
this sort of collection is that it's
building up large collections of very
rich often quite intimate data in large
silos some of the sensors that you can
see in the top left there you've got
sort of things you might expect retro
social networks nest thermostats but
nowadays more intrusive things medical
devices things that are monitoring
insulin levels heart rate so forth
it's very rich it's very intimate data
that's now possible to be collected so
the challenge that we pose ourselves in
this research project was really what
can we do to allow our data subjects to
control the collection and exploitation
of data particularly data that is what
you might think of is their data so data
that's yours that use somehow own and
also data that's collected about you but
you might not have such direct control
over so that's the context how to enable
data subjects to control collection
exploitation of their data and data
about them this is taking place in an
existing ecosystem which is very much
focused around the idea that we want to
move data around typically we want to
move data into the cloud data tends to
get get pushed out there even when it
starts out there's some data where you
might expect it starts in the cloud so
you post something to Facebook it's on
Facebook's computers that's not a
surprise on the other hand there's a lot
of sort of IOT devices that you might
think could very well keep the data more
local to where they're deployed you
might think that data about your house
could stay in your house if you want if
that's what you wanted to happen and yet
by default a lot of them will push that
data out to the cloud even if they
subsequently give you back in some way
it will end up out there on somebody
else's computer and this seems to be to
my mind anyway it's a structural problem
about the way that we build systems
nowadays and the Internet has become
very fragmented it's difficult to build
effective robust efficient distributed
systems across the modern Internet and
it's much easier just to centralize
things and the cloud allows us to
centralize things we can have stick it
all out there in some some system that
somebody else runs as it says the
sticker says on somebody else's computer
so we're defaulting to moving data into
the cloud in order to process it
it makes the processing much easier
well that data is centralized the
starting point for thinking about this
was when I rejoined academia in about
2009 and joined a Research Institute at
Nottingham called horizon horizon
digital economy research that was
focused very much around this notion of
digital footprint and what could we do
with these digital footprints that we're
creating or we're starting to create at
that point and it was quite into this
interdisciplinary center so there were
people there from sociology mathematics
engineering computer science from all
over the piece and a lot of my
colleagues essentially said if you could
build as a magic context service we
could do great things with it we just
know the context of the user then we'll
be able to do all sorts of fun and
interesting interactions and we had a
number of discussions about this where
my response would often be well yes but
what is that I don't know what a context
I don't really know what the context of
the user is what do you mean when you
say you want to know the context of the
user and it eventually became clear that
it wasn't quite well-defined what that
was but it definitely involved using
personal data
it was definitely going to be possible
to construct this from the personal data
that could now be collected from sensors
from social networks from interactions
so the endpoint I came to with that was
really being a lazy computer scientist
pumped on the hard problems so I wasn't
going to try to define what the context
was because that seemed difficult but
what I did say was well if you give me
some piece of code that encodes what you
think the context is then I'll try and
create a platform that will execute that
for you and so return to you what you've
defined the context to be so I've punted
on the problem and that gave rise to a
thing that we call data ware which was
essentially a service-oriented
architecture for trying to do personal
data processing so the idea was that the
data processor would write some piece of
code that would process the later
subjects data the subject would provide
the platform on which they could execute
that code and the processor would
receive the result and the point here
was that we were now moving the code to
where the data was rather than moving
the data to where the code wished to
execute on it so we're not pushing the
data into the cloud anymore trying to
take the code and push that to where the
data starts this was the sort of picture
we had at a time of data where so you've
got a sort of well overly complex
certainly fairly complex request and
finishing process here so the data
processor requests
through some mechanism gets granted
permission to do some piece of
processing and is that then able to push
the piece of code they want to execute
onto some platform where the data is
made available and then the results go
back to the data processor as that was
sort of data where excuse me data
wherever you want mm-hmm however when we
started to try and build this and try
and think about how it might be used it
became clear that there was lots of
complexity in terms of the interactions
you might wish to support on such a
system so there's lots of ways you can
construct interaction around this one
obvious way that's received some
interest is the idea that people might
pay you to use your data but those lots
of other things that might you might
wish to happen there there may be many
situations where you want data to be
processed but it's not appropriate for
something to pay you a lot of it's
another member of your family it may not
be may not seem sensible for them to pay
you to use your data and there was
little in the way that data was
constructed that actually said anything
about how this was going to happen so in
the case of being paid to use data
exactly what were you being paid for
what sort of use was going to be made of
your data what was going to happen then
so data where was a proposal that would
support some forms of interaction it
basically gave you a kind of
transactional nature where you had a
transaction between parties in terms of
this request granted permission and then
possibly some ability to see what
happened afterwards but there are a lot
more things that we could consider and
so we sort of abstracted and stepped up
from the problem a little bit stepped
away from data where and started to
think more generally about what is it
that's going on in this sort of system
and we coin this idea of human data
interaction with by analogy with
human-computer interaction so I think
and I'm not an either historian or a
proper HCI person but my understanding
is that HCI is essentially moved
human-computer interaction has moved as
a field of study away from where it
started which was the idea of a single
individual using a single computer and
it's kind of moved towards a
collaboration between individuals using
computers and it's now in the sort of
world where you're thinking about
ubiquitous computing where it's not
necessarily obvious which the computer
is you're using and so human data
interaction tries to take that a step
further and say well in fact it's now
about the data it's not really about the
interaction with a computer anymore it's
about how you're represented in the data
and what the data is used to do to you
and for you and so
the very high-level model that we have
here is that you have some personal data
that is collected analytics that perform
on that data they process it in some way
that allows you to draw some inferences
to work out something about the way what
that data says and as a result of that
inference process some actions are taken
actions might be to feedback into
further analytics feedback the
inferences you've made or actions might
be nudges of things that might change
your behavior and thus change the date
that generates in the future so there's
even in this very simple model there's a
couple of feedback loops that can take
place and it's in this kind of space
where data processing systems and data
processing computations are taking place
and we felt that the systems that we're
seeing in the systems that that put we
were trying to build were lacking in
kind of three key aspects which underpin
this idea of human data interaction or
HDI the first was legibility so it's
clear that most people I think most the
time are generally unaware of what the
sources of data that might be collected
about them are for where can the data
come from generally unaware of the
analyses that might be performed on
those data and generally unaware of what
the implications of those analyses are
so understanding what's going to happen
to you in the future on the basis of
actions you've taken that you've taken
now or in the past that are now
represented in some data set somewhere
possibly with some degree of inaccuracy
and is not necessarily clear it's not
legible it's not easy to see and
understand what's happening in these
systems the second thing that seemed
missing was agency so agency is the
capacity to act in a system so we are
often unaware of certainly I think I am
on the way speak for anybody else of the
means that I have to affect the data
that's being collected about me there
are some things I think I can do to try
and control what data is collected I can
you know block cookies in my browser I
can use brave I can turn on all the all
the other privacy things but that only
does that only controls the data that
collected about me to some extent it
might be much less clear for me to know
how I can affect this as I move around a
smart city environment or a smart
environment for example it's not obvious
to me always what I can do to affect the
analyses that are being performed on
those data that have been collected
about me and in both of these cases
that's even if I know that these means
to effect these things exist at all and
I can be bothered to employ them because
it may well be complex or difficult to
employ these things effectively so we
lack agency we lack the capacity to act
and then the third thing seem to be what
a rather ugly word a negotiability so
this is essentially trying to capture
the notion of supporting the dynamics of
interaction the idea that when you make
a decision it doesn't necessarily remain
your decision in this system until you
know forevermore you might have to
change your view on things you might
wish to change the way that you interact
with the system either as you learn more
about it or as your behavior changes or
as your environment changes for whatever
reason so current systems still tend to
trapples in its kind of binary terms of
service you click the box to say yes and
then you're done and you don't really
get a chance to go back and revisit that
maybe nowadays we're starting to see
more and more the idea that you can at
least completely withdraw from a system
so you can be in the system or out of
the system but it's often not really
possible to control what's going on in
terms of your interaction with the
system over time so that gave rise to
this idea of data box which is you can
think of in some ways as data we're
version two so this is still taking the
idea that you want to move the code to
the data this allows you to minimize
data release it allows you to retain
more control over what's done with the
data because it's running on a device
that is under your control so at the end
of the day you really want to just turn
it off
but then you know that the data is not
being processed anymore we tried to pay
a bit more attention to how
access to data local or remote data was
going to be mediated we went to some
effort to try and make sure that we
could control all the internal and
external communication and that we could
log all the i/o that takes place on the
ID on the sort of following the idea
that I don't really care what
computation you do on data about me as
long as you never see any result from it
there's a computation just runs on a
device somewhere and then gets thrown
away has anything really happened you
know the competition
I don't know runs in the wood and a tree
falls on the computer and did anything
to take place so if I can log everything
that goes off in terms of what's
communicated from that device to the
outside world then I can in some sense
even if things go wrong I might be able
to go back
the fact and figure out what happened
figure out what leaks and why leaked and
when it leaked with ace box is this kind
of applications this is a sort of fraud
detection application so some person
called Henry downloads a banks app onto
his data box later on large transaction
made in some foreign country against his
credit card the banking application is
able to check Henry's location by saying
are you located in that country where
this transaction took place the data box
is able to say no and then the bank can
deny the transaction and so the fraud is
prevented this hasn't revealed to the
bank where this individual called Henry
is there's been no release of that
information it's simply been able to say
no not where that transaction claims
that he is so this is trying to minimize
the day to release the takes place so
how is data box implemented so the model
here is that we're essentially we're
installing apps the process data locally
so we're following the app metaphor from
smart phones apps process data we also
have a notion of a driver which is
something with it which either ingests
or releases data and there are manifests
associated with each app and they
describe the data that's going to be
accessed by that app and that will be
turned into a concrete what we've called
SLA some of the technologies a bit
horrible I apologize for that too a
concrete SLA when you install an app so
the sort of thing that might happen
there is you have an app that was to
have access to your smart lightbulb data
so that's in the manifest access to
smart lightbulb data when you install it
you're able to control which lightbulbs
it gets access to you can have all the
downstairs light bulbs but not the
upstairs light bulbs in my house okay so
that's the that's the kind of the
ability for the user to exercise some
some control over what's actually being
revealed there about them and what
they're happy to share in that moment
for that application all the components
in data box we were using
containerization as a lightweight sort
of virtualization technique so this gave
us a degree of platform independence
degree of isolation between running
components and the ability to sort of
make the management of this kind of
system easier because there's quite a
lots of moving parts here and so being
able to manage things in a fairly
modernist manner seemed useful when I
say platform independence there that
kind of bitters slightly for a couple of
weeks because it turned out we were
getting bug reports from a user where
they were finding that things weren't
working and it took us some time to
figure out that the reason things
weren't working is because they were
running it on Windows using the docker
for Windows tool that had come out
recently and we didn't realize therefore
that's why the shell scripts weren't
working because they were they were not
in a UNIX environment the containers
were running and they could get the
containers running when they did it by
hand but all the startup scripts did not
work there are four core components to
the platform there's a thing called the
container manager thing called the
arbiter thing called the core network
and then many things called data stores
the container manager is the thing that
manages the containers unsurprisingly so
it manages contain a life cycle in
particular it's one of the things that
starts at first and then after that it
controls which apps are running which
drivers are running how things are
connected and basically kicks everything
off the arbiter is that is the container
that produces the tokens that we use for
access control and the format of those
tokens is a thing called a macaron who's
heard of macaroons not the biscuits ala
T and so macaroons are to reuse the pun
that the authors used macaroons are
better cookies they're essentially
access control tokens that you can
delegate so you can attach constraints
to them when you delegate them to other
parties the data stores provide a
persistent storage facility so we can
monitor everything that's being recorded
and used by each application they also
provide a middleware layer so
communication happens via these data
stores and that's zero MQ based
middleware layer and each store that's
created gets registered in a hyper cat
catalog that exists on the data box and
then the idea is that that provides a
degree of discoverability so so an
application is able to find out what it
is that this data box has and therefore
whether it's going to be able to support
what that application needs and then
finally right at the center a thing
called core network essentially tries to
manage network connectivity for each
application and we sort of pack that
together in
Dokka world by providing a unique
virtual network interface for each
application which is connected only to
that application container and the data
store of that application and to the
core network so we can intercept all of
the communication that takes place for
any application so we can make sure that
we log everything we can make sure we
prevent anything happening that we don't
want to happen as I mentioned apps and
drivers in fact come with a manifest
this basically describes origination
metadata it says what application what
the application is going to need in
terms of data access and what its
storage requirements are and whether
it's going to need to do any remote
accesses so it's going to need to talk
to anything else on the box or anything
off the box the distinction between apps
and drivers is essentially that drivers
can talk to things that are not only on
on the data box they can talk to things
off the data box so that's how you get
data in and out of the system and this
installation process as I've hinted you
essentially you start out the user tries
to install the application they say yes
you can have access to these data
sources and that causes particular
tokens to be generated given to that
application and then that application
and that application is then connected
up to the right network devices and the
container is the containers are all then
started those tokens that the
application has been given allows it
then to present those tokens to the
different data stores in the system and
the data source can then verify that
this application has indeed been
permitted by the user to access that
data so that's that that's the sort of
mechanism for access control
I'll move fairly quickly through this in
interest of time but this is a
description of the middleware layer that
we have which is based on some
standardized protocols and correct Co ap
running on top of zero and Q we have a
get like back-end to this so it records
everything and supports JSON text and
binary data there's a degree of security
that we attempt to provide with the
intent that at some point in the future
we might like to distribute this across
multiple devices so you'll want to be
able to secure the communication between
data stores and the kind of main reason
for doing this is that the first
inversion of this we started out with
was hacked together very quickly and
using a straightforward sort of HTTP
rest style API with no J
and that was not suitable in terms of
supporting relatively high frequency
sensor data or the limited memory
footprint that we had on things like
raspberry PI's this is much more
effective in that sense could you do
among the interactions that we can
support that we think we should be able
to support better you can do things with
a physical device that you can't do so
easily with things that are in the cloud
physical devices are often easier to
reason about so you can see them and so
you can do things that you can simply
glance at it and see what the
configuration is you can imagine
situations here where for example we
might set this up so that access to
smart metering data is only going to be
permitted if the green tag has been
inserted into my data box and my
partner's blue tag has been inserted
into my data box
so we've both agreed that that data can
be shared or whether the green tag is
and the data box and we're both located
in the house so both proximate to it so
you can set up much richer sorts of ways
to control access to data and this Maps
quite nicely to notions of physical
access control which most people have a
pretty reasonable understanding of
because we're used to doing things like
locking windows and locking doors and so
forth one of the most of the team built
a thing using what was essentially a
hacked up version of IBM's node-red
so this allowed you to assemble data box
applications by dragging and dropping
data sources and computational units
linking them together and then you could
essentially click the button somewhere
somewhere off the bottom of the screen
and that would take what you've produced
and build that into a container and
publish that to the App Store and so
building applications was fairly it's
fairly straightforward with this sort of
environment we also did some work on
looking richer visualizations of data so
you can take an SVG image for example
and break it up into its component parts
and then describe transformations so
that as the data comes in it animates
the svt according to what those
transformations are that you've
described I think one of the earlier
demos of this had an SVG with a cartoon
picture of a particular American
president and then when tweets came in
that would cause parts of the face to
animate accordant
some simple sentiment analysis for
tweets so you can perhaps make data more
legible by doing richer visualizations
making it more obvious what's more
explicit what's happening what's
represented in the data this is a piece
of work which unfortunately stalled but
with the PhD student I was looking at
what you could do in terms of generic
measures of risk so the idea that a lot
of the data sources you might see in
such a device are going to be time
series time series of non floating-point
numbers essentially temperature readings
humidity readings air quality readings
whatever they might be is it possible
then the question we're exporting
exploring was is it possible to take a
time series like that
and treating it simply as a time series
about any semantic information about
what those numbers represent just look
at various measures of entropy as
statistical measures also correlations
and so forth to see whether or not
there's in some sense risk associated
with giving access to that data so how
much information is contained in that
time series in a statistical sense is it
possible to say for this application
it's asking for access to that data at
two higher frequency it's going to be
able to find out too much where is this
other application only wants to see an
average over every three months and
therefore that's fine and I really care
what that says and then if that could be
you could consider things like that the
initial results was somewhat promising
in this sense and perhaps you could then
start to try and put those results
together and say well this application
is okay application a is okay an
application B is okay but they come from
the same publisher so if you install
both of those applications together you
may be revealing a lot to that
particular data processor another thing
which sort of pops straight out of this
idea that we want to kind of atomized
data and push it out to all these
different data boxes it's the idea that
it's difficult now to do big data
analytics in the traditional way you
might do you might expect where you want
to put all the data into the cloud so we
were starting to think about we have
been looking a little bit at how to do
small data analytics so idea that you
might do some of the conversations first
when the data is still private and only
subsequently try and aggregate the data
so you don't need to build up these vast
data lakes of data about everything and
a date about everyone instead you try
and again minimized
release do as much the processing is he
can while the data's kept private and
only later on and start to aggregate
resource together we had a couple of
goes of this one of which was
essentially looking at pre training
models using a small sample hopefully
statistically representative sample of
users data and then taking those pre
train models and pushing them out to
lots of different locations and then in
those individual data boxes you can
refine those models and specialize the
training of them onto those particular
individuals whose data is now being used
this gets you essentially further faster
in terms of the accuracy of those models
the long-term goal was to try and think
about how would you actually do sort of
try and do machine learning for example
other forms of statistical analysis of
data at scale so you've got a data box
for every house in the country in the UK
I think it's about 30 million households
how are you going to run a conversation
across such a large scale set up as an
out perhaps the most complete set of
applications that got built was actually
built in collaboration with the BBC and
so this was a collaboration that was
talked about there's a I think there's a
blog post on their website from a few
months ago that describes this but the
idea of a I think they called the BBC
box the idea here was to take data from
data sources that they would not wish to
have direct access to themself so in
this case I think it was your iPlayer
viewing habits iPlayer is the BBC's
content delivery system of one of them
at the time but also from your Spotify
account and your Instagram account so to
try to take data from those three
sources they obviously don't want to
have the data from your Spotify account
they don't want the data from your
Instagram account there's no reason they
would want to hold that it would only be
a risk for them take the data from those
systems that goes into your data box and
then they have a BBC application running
on your data box which is able to
process that to produce a profile which
can then be sent to their content
recommendation system and so appropriate
content can be recommended to you based
on quite rich data about your activities
online but without them having to have
direct access to that data
there were a couple of other
applications we ran a hack day a couple
of years ago using a version of this
there are a couple of other applications
I thought were pretty cool one of which
was the idea actually exploring the idea
that you could do actuation through this
as well so you can imagine having in
fact a couple of people who were
involved in producing this demonstration
did actually produce this you have a
video editing suite where you assembled
let's say a horror film from snippets of
footage you could events in that horror
film and then playback is controlled by
an application sitting on your data box
and when the appropriate points in the
horror film come up the playback
application flickers the lights in your
living room where you're sitting
watching the film for example so you can
have that without again without the
publisher of the data without the BBC or
whoever it might be this broadcast in
this film without there needing to have
direct access to control the lights in
your living room which obviously they
wouldn't want to have and you probably
wouldn't want them to have so this idea
of devolving the control to the devices
under your control
I'm sorry then interact with your
environment monitor your environment
control your environment but under your
control so that's data vaults which I
sort of mentioned you could think of was
data we're version two so where's the
interaction that's going on here how is
this better supporting some of these
this I in HDI this interaction in human
data interaction it does better perhaps
in data where did but it became clearer
as we were going through this project
that it's still not enough so it's still
the case that the requests in processing
tend to occur in a black box an app is
kind of a controller is a contained
environment you can't see where it's got
up to you can't see what it's doing it's
not clear what what the status of each
of these applications is as they're
executing this system we have got this
audit logging support in there it's
possible that using that you could come
up with some kind of notion of where
that where the processing has got to
like what what the status of the
application is and but what we can do at
the moment just with i/o is probably not
rich enough we have a number of
mechanisms such as audit logging
permissions requests that allow us to
coordinate to some extent within the
data box what's going on but they don't
what
what the HCI folks say articulates the
field of work which I'll talk about on
the next slide and then the third thing
is that real-world data sharing tends to
be recipient designed so I will share
data out there information rather with
people based on the context that we're
in and I might talk about something in
the pub with a colleague that I wouldn't
talk about with my wife I might talk
about something with my wife at home
that I wouldn't talk about with a
colleague in the office and so forth
right depending on where I am controls
to some extent on who I'm speaking with
controls to some extent what I'm willing
to reveal to them and the the ways that
we support this in data box are a little
bit too slow-moving
so you tend to make the decisions at the
point of installation of an application
it's not necessarily straightforward to
go back and change those later it's not
perhaps easy to be dynamic sufficiently
dynamic and how those permissions are
being granted and how those permissions
are being controlled I mentioned
articulation work so there are some
quotes from a paper on by Schmitt off
that defines this but the way it was
explained to me as somebody who is not
subtle enough to really understand some
of this kind of these kind of concepts
was the example given to me was walking
down a busy street so if you're walking
down a busy street you're probably
walking to get somewhere so that's the
work you are doing is walking to get to
your destination
but in the course of doing that you have
to do a lot of articulation work you've
got to make sure you don't bump into
other people on the street
it'll make sure you don't bump into
signage on the street you've got to make
sure you don't walk into the road and
get hit by bus and all of this kind of
coordination word that you and everybody
else on that busy street are carrying
out this is articulation work it's the
work that needs to be done in order that
the work you want to do gets done a
subject in a data box a data subject is
engaged in this kind of cooperative work
the subject data subject the data
processor there may be multiple data
subjects involved we don't really do
enough in the architecture that we have
to support this kind of articulation
work what everybody tries to work out
what's going on with everybody else so
that we can all come to the right
conclusion and get the right things done
the other thing about this kind of
recipient design is was observed by a
sociology colleague that data is
essentially acting as a boundary object
is a thing that is used in a relational
fashion you use data in multiple ways
and it it describes a relationship you
have with something else so an example
of a boundary object was a credit card
receipt in the sense that this is
something which is used in multiple ways
simultaneously so it's the proof of
payment that the customer might have
it's the bank's proof that a valid
transaction took place it may be a
supermarket's proof that the bank is
supposed to pay them some money for the
goods that you've taken away all of
these things are inherently relational
it's about the relationship between
these parties and it became clear when
we started looking at these sorts of
data that almost all personal data is in
fact relational there's very different
personal data which is so private nobody
else is included in it or affected by it
this is particularly true when you look
at sensing data most households either
have multiple parties living in the
house or at least they occasionally have
visitors coming to the house and so the
sensing data that you might start to see
being collected commonly there is going
to implicate multiple people it's not
just the homeowner it's not just one
party in a house that that should have
control of that or that is represented
in that data and even if you take
something that most people think of who
thinks of their email is private okay
but presumably it came from or went to
somebody else
in most cases and so you even there this
is data which involves other people so
the in some ways what we try to do with
a t-box in many ways is flawed from the
start because we focused on the idea of
an individual having control of data and
actually data is inherently social in
some sense and so it needs to be
controlled in a more social way so
moving towards sort of wrapping up the
presentation part of this and there are
a number of challenges that are posed
interactional challenge to the post
rates the item which data box doesn't
fully resolve it hopefully takes steps
towards trying to surface some of them
and perhaps resolve some of them it
doesn't fix them one is really around or
a set of challenges around user driven
discovery so how do you discover as a
data processor who out there has the
data you might want to use it's easy
when you're collecting it and you
in a cloud somewhere because you've got
it you know what you've got but how can
you find out which of the households
which of the individuals in the
population has got a dice box and has
the data that you wish to process that
would be useful to you how do users
discover what applications they might
wish to install the applications that
might do things for them how could they
be empowered to make sure that they
install the right applications that
they're happy with the applications that
they've installed and how do we control
those discoverability Pro this that
discover discovery process there are a
number of sort of more standard
mechanisms I guess that can be tried out
here so along with permissions you can
imagine social rating systems you know
14 of your friends have installed this
app and they're all very happy with it
everybody's giving this five stars and
these sorts of ways of communicating to
other users that these are good
applications and to help them discover
the right things legibility there are
mechanisms here that can support
legibility but legibility remains a
problem you should be able to visualize
your own data you - will now have it in
your data books and it might be much
more difficult to visualize the impact
that other people's data has on your
data although other people's data might
have on the processing of your data what
is going to be revealed as your data is
processed given what has already been
revealed revealed by other people this
is true both for data that exists now
but also data that might become
available in the future there's a
question here again comes back to
discoverability as well there's what can
process to discover about what you have
in the same way what can you could you
discover about what processes want and
that may also be the need to edit data
so if you just text some data has been
recorded which is wrong you want to be
able to go in and change it this is
another in some sense floor in the way
that we frame this is again we were very
much on floor it was deliberate but it's
not complete so we focus very much on
the data subject on the land that they
are subject to have control over data
and data processing but of course there
are more stakeholders than just the data
subject in this the data processor might
legitimately want to know that you've
not tampered with the data that you're
revealing to them that you haven't fate
your propensity to risk for example so
they give you lower insurance premiums I
understand some people when insurance
company started saying well if you wear
a Fitbit and we can see how active you
are will give you reductions on your
health insurance and I believe there
were people who were putting that
fitbit's on their dogs or on a metronome
other mechanisms to try and fake out
what the data that was being recorded in
all they could boost their insurance
premiums there's clearly a need here to
try and support some degree of sort of
legitimate interests of both sides I
guess in this as I've hinted that data
is a social thing most data is a social
thing so you want to be able to delegate
control delegate access to data but you
also want to be able to revoke it you
want to be able to see what's been
happening with your data whether it's
being edited who's been viewing it with
whom it's being shared you want to be
able to revoke those permissions you
also need to be able to negotiate so if
you have multiple data boxes in a
household for example it might be
legitimate for my data box to have
access to some of the IOT sensing data
and for the other adults in the house to
have access to the same IOT sensing data
in my home right the energy consumption
smart metering and so forth but any one
of us can then reveal that data to a
data processor and that might not be
what we wish to happen it might be the
case that it would be better if there
was some way of negotiating that we all
agree that we are happy for this data to
be revealed to this particular data
processor we have no mechanisms to
support that kind of sort of social
action at present
there's a need to think about who data
is getting passed to what can you do to
try and work out when you revealed some
data to somebody else what they're going
to do with it and what what's happening
after you've made that revelation and I
think from a technology perspective the
two of these that I find most
interesting come down to the sharing of
data and what to do about shared data so
sharing data we want to be able to
support offline data collection we want
to build a support data collection from
devices that not necessarily co-located
with the data box so this means we want
some kind of rendezvous and identity
service and this needs to be you know
reliable and not infringe on the privacy
of the people participating in it shared
data is another interesting things so
there was a long-running argument for
about 18 months in this project between
myself and one of the collaborators
around how to support this idea of
shared data what could we do given the
data is inherently shared as inherently
social their stance was very much that
what we needed to do was introduce the
idea of a user account on Facebook's so
we'd be able to manage access to the
data by having user accounts on the data
box so that we could say well you can
say this and then this other account is
allowed to see that data and so and so
on it turned out well it turned out it
was certainly my opinion that that was
going to be inordinately complicated to
implement because of what it boiled down
to the problem of who gets to manage the
user accounts who gets to create
accounts and who gets to control the
accounts and with current systems
consuming systems that I'm aware of
there's no real way to have this kind of
essentially is no real way to do away
with the idea of a root user somebody
you can see everything and it's
definitely the case that in other
projects that we were doing that when
you're looking at personal data it's
often the case that people are actually
less concerned about complete strangers
seeing their personal data than they are
about other people in the house seeing
personal data you know the idea that
your parents might be able to see what
your or your internet viewing habits are
is something that many people find quite
upsetting but the idea that the ISP can
see what you're seeing on the internet
they're not really too bothered about
and so there was a difficulty there
about how if you introduce accounts how
are you going to manage the fact that
there's going to be one account that's
going to have access to everything you
can see absolutely everything that's
going on so we I fought quite hard to
try and keep things so that we have one
data box for one person
unfortunately that really doesn't solve
this problem of social data and the
closest we get to that is we start
thinking about with the idea that we
could replicate data within a household
across a set of data boxes perhaps and
then you have to I do well what I did
again was pumped on the hard problem so
you end up in a world where you're
devolve engaging access to social data
to a social matter so you say that well
you'll discuss it with other people in
the house before you start revealing
this data because you know it's
sensitive because you're aware of other
people's views it's not like you're
sitting in your living in your house in
your social situation and not being
aware of anybody else in the house and
what they think about this so I think
those are two interesting challenges
from a technical perspective how to
support these kinds of interactions and
these kinds of these needs in this
system and with that I'll finish
[Applause]
any questions
so thank you very much for the talk if
you have questions please line up at the
microphones I think microphone - thank
you thanks for that I wonder how you see
this moving beyond academia into a sort
of broad adoption and if you have any
thoughts on something like the Estonian
ISA Tizen ship model for how this could
potentially scale and then and I guess
also your thoughts on just what do you
think needs to happen for this to be a
doctor that scale so I'm not familiar
enough with the Estonian II citizen
model to comment on that frankly I think
that for this to be adopted at scale we
probably need to reimplemented so it's a
little bit less the research prototype
that would be a good start I think that
one of the big challenges in terms of
adoption is actually around what these
applications might be there was a strong
interest from other parties in this
project around IOT data particularly and
one of the things it seems to me to be
the case around IOT data is that we've
got all these opportunities to collect
lots of it but nobody's quite sure what
to do with it in terms of really
compelling applications that make a
great deal of sense so in that sense it
may be that it's all a dead duck and
there's no there's no need for anything
like this because in fact none of that's
ever going to take off because it's
never going to be compelling enough to
be really really useful and so I think
having some killer applications or some
real use cases that that are valuable
here will be would be good some of the
ones that I mentioned a couple ones I
mentioned from the BBC and from other
collaborators - I think with the
University of York that cuz all we ran
they started to become more interesting
I think so you can start to see some use
cases arriving there but that that core
it's quite slow to find them and quite
slow to build them the other thing that
we would definitely need for broader
adoption of this sort of platform that
we really need to fix as part of that
rewrite is to make the development
process much much easier and it turns
out that it was socially they were
professional developers that were hired
to build that BBC demo and they did it
and they did a great job
at work but I think everybody involved
found the development process much
harder than they expected the idea that
you can't simply access a cloud service
when you want to in your code that you
have to request permission for that and
actually think about all that processes
it's quite alien to modern development
practices I think so I think I think the
development process is something we
really need to work on to actually give
us a hope of being adopted so yeah
there's two or three things much more
questions yeah go ahead yeah thanks a
lot for the great talk would you say
that for so basically what you had in
mind when you developed us for IOT
applications well so it sort of changed
over time when we first started with
data where we were thinking about social
media social networks email IRC logs
chat logs and so forth as personal data
we constantly wanted to do things like
get in banking data our financial data
was an obvious sort of thing that people
find sensitive but would like to do
interesting things with as the sort of
time passed IOT became more of a thing
one of my collaborators in this project
is essentially was funded to look at IOT
data specifically so that was where the
interest in that came from I think that
given the domestic context that we were
targeting IOT data is a sort of obvious
thing to look at then other sorts of
household later finance data is another
one that still still be kind of obvious
personal health data now with sort of
wearables things monitoring you can do
all of these things oh I sort of there
but in some sense I'm not I don't think
it matters too much in in terms of the
the challenges that we were coming
across as we're doing this I mean
they're they're fairly endemic across
the space whether or not it's IOT data
or all other forms of data you start to
realise quite soon when you try and
actually build these things that you've
got these problems the data is
inherently social multiple people are
implicated and so on and so forth
great any more questions
oh yeah microphone one I think I would
like you to elaborate if you could on
the different levels thus this level of
the household containing a family or
someone and there's list this level of
their community I think if you have some
thing to control the temperature in the
living room you could have this box tell
you that to other people not named in
your household would like it to be
somewhat warmer but you're paying the
bills so you say this could not be the
case and the whole neighborhood Street
or block or something that's a different
level where you have different questions
that you could elaborate and where you
could have good use of this box yes so
that's an interesting challenge that
that's part of the reason we were
thinking about its kind of very
widespread sort of federated data
processing essentially on the the idea
being that as I understand it one of the
ways that you can nudge people to reduce
energy consumption for example is to
tell them what the average is for people
in their demographic and that's higher
than that's lower than what their
consumption is that acts as a prompt for
them to think about bringing their
consumption down whereas if you do it
across to larger scale everybody in the
country is doing this and it's becomes
less meaningful but if you know that
households are the more less the same
configuration as yours are on average
using a lot less energy you might start
to think about it so that was kind of
drive drive those sorts of applications
where you want to look at base or across
multiple data boxes simultaneously where
those data boxes may be spread across
the wide area so we started to
investigate some technical means to do
that there's a system that a postdoc of
mine built called owl which is a data
processing system for your camel
programming language which was trying to
embed embody some of those ideas if you
go to a camel dot X Y Zed the web that's
the website for that particular thing
he was I think 18 months and he wrote
180,000 lines of our camel code to him
than that it was fairly impressive
we haven't got to the point where we can
deploy any of those yet or actually test
any of the amount and certainly not of
that sort of scale that's something that
I'm hoping to do in the next year or two
with some other developments that we've
got in Cambridge around the digital
built environment where it might be able
to start to deploy some of these ideas
and see how they work in terms of data
which is being collected and managed at
a scale which is larger than a single
household so you don't have the same
kind of domestic framing for it okay you
do have any more questions microphone
two could you elaborate a little bit
further on the trust of applications and
especially if they start doing
unintentional things such as
requesting data that well given or being
based on other data reveals information
without yourself intending to so I think
I think that that's essentially that's
one of the challenges that we haven't
really addressed so if an application
that you install ax asks for access to
data that you have not given it
permission to it can't have that those
requests will simply be denied but if an
application that you've installed has
been given access to some data and it
managed to do some processing of that
data and you're happy with that and that
results of that processing go back to
the data processors home base and
they're then they're able to join that
with some other source of data you have
no idea of that that we don't we can't
do anything out about at this point and
that's one of the challenges here is
what to do when the data that you
thought was okay turns out not to be
okay to reveal because somebody's found
something else that lets them attack it
in some way I don't know what to do
better thank you Thanks so we have one
more question yes so when multiple apps
are trying to access the same data how
do you is there a standard that you
using like semantic web standards to
understand the meaning of what certain
rows of tables mean between applications
not really no we didn't go down the
route of trying to sort of taxonomy is
everything put everything into an
ontology so at the moment the
application writer just has to know
that's the data source that they're
accessing so they're accessing the
Philips he light all data they happen to
know what
so each application is talking to its
own data store within the club within
the data box
know the author of each application
needs know the format of the data that
that application is going to process so
somebody has to go and look at some
specs before they write their app and
how do you see this project like paddles
between let's say the solid project
that's being led by Tim berners-lee or
the own cloud project where again it's I
feel there's kind of some time I think
that so based on my understanding of
those projects I think that we are
focused on the platform and the control
in the platform and less about trying to
control what the application tries to
compute and we're not I think
solid I think maybe has moved on since I
last looked at it but I think initially
it was quite focused around the browser
for example and we're not we're not
trying to be in relationships of web at
all it's about having a device I think
that's the other thing that seems to be
again when we when I last looked still
seemed to be fairly fairly unique so
that seemed to be something we'll be
doing differently which was having a
physical device that users could control
directly and trying to trying to provide
the affordances that you get by having a
physical device rather having something
that's just abstract software in the
cloud somewhere that you can't really
control in the same way good for one Hey
I'm curious if you have any data among
the problem awareness and the okay like
sorry data robot of the problem
awareness among the population like
they're already aware the
implementations implications things off
the top of my head
I don't from a previous project we did
do a review of a lot of the privacy
literature some papers have been
published about people's attitudes
towards privacy an understanding of the
problems of privacy as represented in
data but I don't actually have any sort
of statistical base for about how the
population is generally aware of these
kinds of issues I think when we have
looked a little bit at that trying to do
that sort of thing we got when I was in
Nottingham for example we did some work
with one of the standard surveys that I
think was the
to counsel executed every year or
frequently anyway and if I recall
correctly there were some questions in
that the answers to which did not make
sense from a technical perspective so
one of the questions that was asked was
do you use the internet I think and a
lot of the respondents said no I don't
use the Internet why would I use the
Internet another question I was asked
was how do you arrange to meet up with
friends and a lot of those same
respondents who don't use the internet
use Facebook to meet up with friends so
I think it can be quite difficult from
survey data sometimes to actually work
out and tease apart really what is going
on in terms of people's understandings
and concerns about this because it's
some of these concepts are quite
abstract and they're also quite I said
it's a lot of it a lot of it is very
dynamic this is sort of recipient design
so I can give you one answer to the
question am i concerned about privacy of
my data and if you frame the question
slightly differently I will give you a
different answer because you've
triggered something else and so I think
it's quite difficult to gather really
robust data you can you can really be
satisfied with inferences you draw thank
you so there no more questions I think
another round of applause please
[Applause]
[Music]