Q12 Do you agree with the Government’s position that a standalone display should be provided with a smart meter?

Free-standing displays (presumably wirelessly connected to the meter itself, as proposed in [7, p.16]) could be an effective way of bringing the meter ‘out of the cupboard‘, making an information flow visible which was previously hidden. As Donella Meadows put it when comparing electricity meter placements [1, pp. 14-15] this provides a new feedback loop, “delivering information to a place where it wasn’t going before” and thus allowing consumers to modify their behaviour in response.

“An accessible display device connected to the meter” [2, p.8] or “series of modules connected to a meter” [3, p. 28] would be preferable to something where an extra step has to be taken for a consumer to access the data, such as only having a TV or internet interface for the information, but as noted [3, p.31] “flexibility for information to be provided through other formats (for example through the internet, TV) in addition to the provision of a display” via an open API, publicly documented, would be the ideal situation. Interesting ‘energy dashboard’ TV interfaces have been trialled in projects such as live|work‘s Low Carb Lane [6], and offer the potential for interactivity and extra information display supported by the digital television platform, but it would be a mistake to rely on this solely (even if simply because it will necessarily interfere with the primary reason that people have a television).

The question suggests that a single display unit would be provided with each meter, presumably with the householder free to position it wherever he or she likes (perhaps a unit with interchangeable provision for a support stand, a magnet to allow positioning on a refrigerator, a sucker for use on a window and hook to allow hanging up on the wall would be ideal – the location of the display could be important, as noted [4, p. 49]) but the ability to connect multiple display units would certainly afford more possibilities for consumer engagement with the information displayed as well as reducing the likelihood of a display unit being mislaid. For example, in shared accommodation where there are multiple residents all of whom are expected to contribute to a communal electricity bill, each person being aware of others’ energy use (as in, for example, the Watt Watchers project [5]) could have an important social proof effect among peers.

Open APIs and data standards would permit ranges of aftermarket energy displays to be produced, ranging from simple readouts (or even pager-style alerters) to devices and kits which could allow consumers to perform more complex analysis of their data (along the lines of the user-led innovative uses of the Current Cost, for example [8]) – another route to having multiple displays per household.

Q13 Do you have any comments on what sort of data should be provided to consumers as a minimum to help them best act to save energy (e.g. information on energy use, money, CO2 etc)?

Low targets?
This really is the central question of the whole project, since the fundamental assumption throughout is that provision of this information will “empower consumers” and thereby “change our energy habits” [3, p.13]. It is assumed that feedback, including real-time feedback, on electricity usage will lead to behaviour change: “Smart metering will provide consumers with tools with which to manage their energy consumption, enabling them to take greater personal responsibility for the environmental impacts of their own behaviour” [4, p.46]; “Access to the consumption data in real time provided by smart meters will provide consumers with the information they need to take informed action to save energy and carbon” [3, p.31].

Nevertheless, with “the predicted energy saving to consumers… as low as 2.8%” [4, p.18], the actual effects of the information on consumer behaviour are clearly not considered likely to be especially significant (this figure is more conservative than the 5-15% range identified by Sarah Darby [9]). It would, of course, be interesting to know whether certain types of data or feedback, if provided in the context of a well-designed interface could improve on this rather low figure: given the scale of the proposed roll-out of these meters (every household in the country) and the cost commitment involved, it would seem incredibly short-sighted not to take this opportunity to design and test better feedback displays which can, perhaps, improve significantly on the 2.8% figure.

(Part of the problem with a suggested figure as low as 2.8% is that it makes it much more difficult to defend the claim that the meters will offer consumers “important benefits” [3, p.27]. The benefits to electricity suppliers are clearer, but ‘selling’ the idea of smart meters to the public is, I would suggest, going to be difficult when the supposed benefits are so meagre.)

If we consider the use context of the smart meter from a consumer’s point of view, it should allow us to identify better which aspects are most important. What is a consumer going to do with the information received? How does the feedback loop actually occur in practice? How would this differ with different kinds of information?

Levels of display
Even aside from the actual ‘units’ debate (money / energy / CO2), there are many possible types and combinations of information that the display could show consumers, but for the purposes of this discussion, I’ll divide them into three levels:

(1) Simple feedback on current (& cumulative) energy use / cost (self-monitoring)
(2) Social / normative feedback on others’ energy use and costs (social proof + self-monitoring)
(3) Feedforward, giving information about the future impacts of behavioural decisions (simulation & feedforward + kairos + self-monitoring)

These are by no means mutually exclusive and I’d assume that any system providing (3) would also include (1), for example.

Nevertheless, it is likely that (1) would be the cheapest, lowest-common-denominator system to roll out to millions of homes, without (2) or (3) included – so if thought isn’t given to these other levels, it may be that (1) is all consumers get.

I’ve done mock-ups of the sort of thing each level might display (of course these are just ideas, and I’m aware that a) I’m not especially skilled in interface design, despite being very interested in it; and b) there’s no real research behind these) in order to have something to visualise / refer to when discussing them.

(1) Simple feedback on current (& cumulative) energy use and cost

I’ve tried to express some of the concerns I have over a very simple, cheap implementation of (1) in a scenario, which I’m not claiming to be representative of what will actually happen – but the narrative is intended to address some of the ways this kind of display might be useful (or not) in practice:

Jenny has just had a ‘smart meter’ installed by someone working on behalf of her electricity supplier. It comes with a little display unit that looks a bit like a digital alarm clock. There’s a button to change the display mode to ‘cumulative’ or ‘historic’ but at present it’s set on ‘realtime’: that’s the default setting.

Jenny attaches it to her kitchen fridge with the magnet on the back. It’s 4pm and it’s showing a fairly steady value of 0.5 kW, 6 pence per hour. She opens the fridge to check how much milk is left, and when she closes the door again Jenny notices the figure’s gone up to 0.7 kW but drops again soon after the door’s closed, first to 0.6 kW but then back down to 0.5 kW again after a few minutes. Then her two teenage children, Kim and Laurie arrive home from school – they switch on the TV in the living room and the meter reading shoots up to 0.8 kW, then 1.1 kW suddenly. What’s happened? Jenny’s not sure why it’s changed so much. She walks into the living room and Kim tells her that Laurie’s gone upstairs to play on his computer. So it must be the computer, monitor, etc.

Two hours later, while the family’s sitting down eating dinner (with the TV on in the background), Jenny glances across at the display and sees that it’s still reading 1.1 kW, 13 pence per hour.

“Is your PC still switched on, Laurie?” she asks.
“Yeah, Mum,” he replies
“You should switch it off when you’re not using it; it’s costing us money.”
“But it needs to be on, it’s downloading stuff.”

Jenny’s not quite sure how to respond. She can’t argue with Laurie: he knows a lot more than her about computers. The phone rings and Kim puts the TV on standby to reduce the noise while talking. Jenny notices the display reading has gone down slightly to 1.0 kW, 12 pence per hour. She walks over and switches the TV off fully, and sees the reading go down to 0.8 kW.

Later, as it gets dark and lights are switched on all over the house, along with the TV being switched on again, and Kim using a hairdryer after washing her hair, with her stereo on in the background and Laurie back at his computer, Jenny notices (as she loads the tumble dryer) that the display has shot up to 6.5 kW, 78 pence per hour. When the tumble dryer’s switched on, that goes up even further to 8.5 kW, £1.02 per hour. The sight of the £ sign shocks her slightly – can they really be using that much electricity? It seems like the kids are costing her even more than she thought!

But what can she really do about it? She switches off the TV and sees the display go down to 8.2 kW, 98 pence per hour, but the difference seems so slight that she switches it on again – it seems worth 4 pence per hour. She decides to have a cup of tea and boils the kettle that she filled earlier in the day. The display shoots up to 10.5 kW, £1.26 pence per hour. Jenny glances at the display with a pained expression, and settles down to watch TV with her tea. She needs a rest: paying attention to the display has stressed her out quite a lot, and she doesn’t seem to have been able to do anything obvious to save money.

Six months later, although Jenny’s replaced some light bulbs with compact fluorescents that were being given away at the supermarket, and Laurie’s new laptop has replaced the desktop PC, a new plasma TV has more than cancelled out the reductions. The display is still there on the fridge door, but when the batteries powering the display run out, and it goes blank, no-one notices.

The main point I’m trying to get across there is that with a very simple display, the possible feedback loop is very weak. It relies on the consumer experimenting with switching items on and off and seeing the effect it has on the readings, which – while it will initially have a certain degree of investigatory, exploratory interest – may well quickly pall when everyday life gets in the way. Now, without the kind of evidence that’s likely to come out of research programmes such as the CHARM project [10], it’s not possible to say whether levels (2) or (3) would fare any better, but giving a display the ability to provide more detailed levels of information – particularly if it can be updated remotely – massively increases the potential for effective use of the display to help consumers decide what to do, or even to think about what they’re doing in the first place, over the longer term.

(2) Social / normative feedback on others’ energy use and costs

A level (2) display would (in a much less cluttered form than what I’ve drawn above!) combine information about ‘what we’re doing’ (self-monitoring) with a reference, a norm – what other people are doing (social proof), either people in the same neighbourhood (to facilitate community discussion), or a more representative comparison such as ‘other families like us’, e.g. people with the same number of children of roughly the same age, living in similar size houses. There are studies going back to the 1970s (e.g. [11, 12]) showing dramatic (2 × or 3 ×) differences in the amount of energy used by similar families living in identical homes, suggesting that the behavioural component of energy use can be significant. A display allowing this kind of comparison could help make consumers aware of their own standing in this context.

However, as Wesley Schultz et al [13] showed in California, this kind of feedback can lead to a ‘boomerang effect’, where people who are told they’re doing better than average then start to care less about their energy use, leading to it increasing back up to the norm. It’s important, then, that any display using this kind of feedback treats a norm as a goal to achieve only on the way down. Schultz et al went on to show that by using a smiley face to demonstrate social approval of what people had done – affective engagement – the boomerang effect can be mitigated.

(3) Feedforward, giving information about the future impacts of behavioural decisions

A level (3) display would give consumers feedforward [14] – effectively, simulation of what the impact of their behaviour would be (switching on this device now rather than at a time when there’s a lower tariff – Economy 7 or a successor), and tips about how to use things more efficiently at the right moment (kairos), and in the right kind of environment, for them to be useful. Whereas ‘Tips of the Day’ in software frequently annoy users [15] because they get in the way of a user’s immediate task, with something relatively passive such as a smart meter display, this could be a more useful application for them. The networked capability of the smart meter means that the display could be updated frequently with new sets of tips, perhaps based on seasonal or weather conditions (“It’s going to be especially cold tonight – make sure you close all the curtains before you go to bed, and save 20p on heating”) or even special tariff changes for particular periods of high demand (“Everyone’s going to be putting the kettle on during the next ad break in [major event on TV]. If you’re making tea, do it now instead of in 10 minutes; time, and get a 50p discount on your next bill”).

Disaggregated data: identifying devices
This level (3) display doesn’t require any ability to know what devices a consumer has, or to be able to disaggregate electricity use by device. It can make general suggestions that, if not relevant, a consumer can ignore.

But what about actually disaggregating the data for particular devices? Surely this must be an aim for a really ‘smart’ meter display. Since [4, p.52] notes – in the context of discussing privacy – that “information from smart meters could… make it possible…to determine…to a degree, the types of technology that were being used in a property,” this information should clearly be offered to consumers themselves, if the electricity suppliers are going to do the analysis (I’ve done a bit of a possible mockup, using a more analogue dashboard style).

Whether the data are processed in the meter itself, or upstream at the supplier and then sent back down to individual displays, and whether the devices are identified from some kind of signature in their energy use patterns, or individual tags or extra plugs of some kind, are interesting technology questions, but from a consumer’s point of view (so long as privacy is respected), the mechanism perhaps doesn’t matter so much. Having the ability to see what device is using what amount of electricity, from a single display, would be very useful indeed. It removes the guesswork element.

Now, Sentec’s Coracle technology [16] is presumably ready for mainstream use, with an agreement signed with Onzo [17], and ISE’s signal-processing algorithms can identify devices down to the level of makes and models [18], so it’s quite likely that this kind of technology will be available for smart meters for consumers fairly soon. But the question is whether it will be something that all customers get – i.e. as a recommendation of the outcome of the DECC consultation – or an expensive ‘upgrade’. The fact that the consultation doesn’t mention disaggregation very much worries me slightly.

If disaggregated data by device were to be available for the mass-distributed displays, clearly this would significantly affect the interface design used: combining this with, say a level (2) type social proof display could – even if via a website rather than on the display itself – let a consumer compare how efficient particular models of electrical goods are in use, by using the information from other customers of the supplier.

In summary, for Q13 – and I’m aware I haven’t addressed the “energy use, money, CO2 etc” aspect directly – there are people much better qualified to do that – I feel that the more ability any display has to provide information of different kinds to consumers, the more opportunities there will be to do interesting and useful things with that information (and the data format and API must be open enough to allow this). In the absence of more definitive information about what kind of feedback has the most behaviour-influencing effect on what kind of consumer, in what context, and so on, it’s important that the display be as adaptable as possible.

Q14 Do you have comments regarding the accessibility of meters/display units for particular consumers (e.g. vulnerable consumers such as the disabled, partially sighted/blind)?

The inclusive design aspects of the meters and displays could be addressed through an exclusion audit, applying something such as the University of Cambridge’s Exclusion Calculator [19] to any proposed designs. Many solutions which would benefit particular consumers with special needs would also potentially be useful for the population as a whole – e.g. a buzzer or alarm signalling that a device has been left on overnight which isn’t normally, or (with disaggregation capability) notifying the consumer that, say, the fridge has been left open, would be pretty useful for everyone, not just the visually impaired or people with poor memory.

It seems clear that having open data formats and interfaces for any device will allow a wider range of things to be done with the data, many of which could be very useful for vulnerable users. Still, fundamental physical design questions about the device – how long the batteries last for, how easy they are to replace for someone with poor eyesight or arthritis, how heavy the unit is, whether it will break if dropped from hand height – will all have an impact on its overall accessibility (and usefulness).

Thinking of ‘particular consumers’ more generally, as the question asks, suggests a few other issues which need to be addressed:

- A website-only version of the display data (as suggested at points in the consultation document) would exclude a lot of consumers who are without internet access, without computer understanding, with only dial-up (metered) internet, or simply not motivated or interested enough to check – i.e., it would be significantly exclusionary.

- Time-of-Use (ToU) pricing will rely heavily on consumers actually understanding it, and what the implications are, and changing their behaviour in accordance. Simply charging consumers more automatically, without them having good enough feedback to understand what’s going on, only benefits electricity suppliers. If demand- or ToU-related pricing is introduced – “the potential for customer confusion… as a result of the greater range of energy tariffs and energy related information” [4, p. 49] is going to be significant. The design of the interface, and how the pricing structure works, is going to be extremely important here, and even so may still exclude a great many consumers who do not or cannot understand the structure.

- The ability to disable supply remotely [4, p. 12, p.20] will no doubt provoke significant reaction from consumers, quite apart from the terrible impact it will have on the most vulnerable consumers (the elderly, the very poor, and people for whom a reliable electricity supply is essential for medical reasons), regardless of whether they are at fault (i.e. non-payment) or not. There WILL inevitably be errors: there is no reason to suppose that they will not occur. Imagine the newspaper headlines when an elderly person dies from hypothermia. Disconnection may only occur in “certain well-defined circumstances” [3, p. 28] but these will need to be made very explicit.

- “Smart metering potentially offers scope for remote intervention… [which] could involve direct supplier or distribution company interface with equipment, such as refrigerators, within a property, overriding the control of the householder” [4, p. 52] – this simply offers further fuel for consumer distrust of the meter programme (rightly so, to be honest). As Darby [9] notes, “the prospect of ceding control over consumption does not appeal to all customers”. Again, this remote intervention, however well-regulated it might be supposed to be if actually implemented, will not be free from error. “Creating consumer confidence and awareness will be a key element of successfully delivering smart meters” [4, p.50] does not sit well with the realities of installing this kind of channel for remote disconnection or manipulation in consumers’ homes, and attempting to bury these issues by presenting the whole thing as entirely beneficial for consumers will be seen through by intelligent people very quickly indeed.

- Many consumers will simply not trust such new meters with any extra remote disconnection ability – it completely removes the human, the compassion, the potential to reason with a real person. Especially if the predicted energy saving to consumers is as low as 2.8% [4, p.18], many consumers will (perhaps rightly) conclude that the smart meter is being installed primarily for the benefit of the electricity company, and simply refuse to allow the contractors into their homes. Whether this will lead to a niche for a supplier which does not mandate installation of a meter – and whether this would be legal – are interesting questions.

Dan Lockton, Researcher, Design for Sustainable Behaviour
Cleaner Electronics Research Group, Brunel Design, Brunel University, London, June 2009

[1] Meadows, D. Leverage Points: Places to Intervene in a System. Sustainability Institute, 1999.

[2] DECC. Impact Assessment of smart / advanced meters roll out to small and medium businesses, May 2009.

[3] DECC. A Consultation on Smart Metering for Electricity and Gas, May 2009.

[4] DECC. Impact Assessment of a GB-wide smart meter roll out for the domestic sector, May 2009.

[5] Fischer, J. and Kestner, J. ‘Watt Watchers’, 2008.

[6] DOTT / live|work studio. ‘Low Carb Lane’, 2007.

[7] BERR. Impact Assessment of Smart Metering Roll Out for Domestic Consumers and for Small Businesses, April 2008.

[8] O’Leary, N. and Reynolds, R. ‘Current Cost: Observations and Thoughts from Interested Hackers’. Presentation at OpenTech 2008, London. July 2008.

[9] Darby S. The effectiveness of feedback on energy consumption. A review for DEFRA of the literature on metering, billing and direct displays. Environmental Change Institute, University of Oxford. April 2006.

[10] Kingston University, CHARM Project. 2009

[11] Socolow, R.H. Saving Energy in the Home: Princeton’s Experiments at Twin Rivers. Ballinger Publishing, Cambridge MA, 1978

[12] Winett, R.A., Neale, M.S., Williams, K.R., Yokley, J. and Kauder, H., 1979 ‘The effects of individual and group feedback on residential electricity consumption: three replications’. Journal of Environmental Systems, 8, p. 217-233.

[13] Schultz, P.W., Nolan, J.M., Cialdini, R.B., Goldstein, N.J. and Griskevicius, V., 2007.
‘The Constructive, Destructive and Reconstructive Power of Social Norms’. Psychological Science, 18 (5), p. 429-434.

[14] Djajadiningrat, T., Overbeeke, K. and Wensveen, S., 2002. ‘But how, Donald, tell us how?: on the creation of meaning in interaction design through feedforward and inherent feedback’. Proceedings of the 4th conference on Designing interactive systems: processes, practices, methods, and techniques. ACM Press, New York, p. 285-291.

[15] Business of Software discussion community (part of ‘Joel on Software’), ‘”Tip of the Day” on startup, value to the customer’, August 2006

[16] Sentec. ‘Coracle: a new level of information on energy consumption’, undated.

[17] Sentec. ‘Sentec and Onzo agree UK deal for home energy displays’, 28th April 2008

[18] ISE Intelligent Sustainable Energy, ‘Technology’, undated

[19] Engineering Design Centre, University of Cambridge. Inclusive Design Toolkit: Exclusion Calculator, 2007-8

Last month, an Apple patent application was published describing a method of “Protecting electronic devices from extended unauthorized use” – effectively a ‘charging rights management’ system.

New Scientist and OhGizmo have stories explaining the system; while the stated intention is to make stolen devices less useful/valuable (by preventing a thief charging them with unauthorised chargers), readers’ comments on both stories are as cynical as one would expect: depending on how the system is implemented, it could also prevent the owner of a device from buying a non-Apple-authorised replacement (or spare) charger, or from borrowing a friend’s charger, and in this sense it could simply be another way of creating a proprietary lock-in, another way to ‘charge’ the customer, as it were.

It also looks as though it would play havoc with clever homebrew charging systems such as Limor Fried‘s Minty Boost (incidentally the subject of a recent airline security débâcle) and similar commercial alternatives such as Mayhem‘s Anycharge, although these are already defeated by a few devices which require special drivers to allow charging.

Reading Apple’s patent application, what is claimed is fairly broad with regard to the criteria for deciding whether or not re-charging should be allowed – in addition to charger-identification-based methods (i.e. the device queries the charger for a unique ID, or the charger provides it, perhaps modulated with the charging waveform) there are methods involving authentication based on a code provided to the original purchaser (when you plug in a charger the device has never ‘seen’ before, it asks you for a security code to prove that you are a legitimate user), remote disabling via connection to a server, or even geographically-based disabling (using GPS: if the device goes outside of a certain area, the charging function will be disabled).

All in all, this seems an odd patent. Apple’s (patent attorneys’) rather hyperbolic statement (Description, 0018) that:

These devices (e.g., portable electronic devices, mechanical toys) are generally valuable and/or may contain valuable data. Unfortunately, theft of more popular electronic devices such as the Apple iPod music-player has become a serious problem. In a few reported cases, owners of the Apple iPod themselves have been seriously injured or even murdered.

…is no doubt true to some extent, but if the desire is really to make a stolen iPod worthless, then I would have expected Apple to lock each device in total to a single user – not even allowing it to be powered up without authentication. Just applying the authentication to the charging method seems rather arbitrary. (It’s also interesting to see the description of “valuable data”: surely in the case that Apple is aware that a device has been stolen, it could provide the legitimate owner of the device with all his or her iTunes music again, since the marginal copying cost is zero. And if the stolen device no longer functions, the RIAA need not panic about ‘unauthorised’ copies existing! But I doubt that’s even entered into any of the thinking around this.)

Whether or not the motives of discouraging theft are honourable or worthwhile, there is the potential for this sort of measure to cause signficant inconvenience and frustration for users (and second-hand buyers, for example – if the device doesn’t come with the original charger or the authentication code) along with incurring extra costs, for little real ‘theft deterrent’ benefit. How long before the ‘security’ system is cracked? A couple of months after the device is released? At that point it will be worth stealing new iPods again.

(Many thanks to Michael O’Donnell of PDD for letting me know about this!)

Previously on the blog: Friend or foe? Battery authentication ICs

UPDATE: Freedom to Tinker has now picked up this story too, with some interesting commentary.

Well, this is totally impossible to confirm, but we just got a complaint from a reader saying that their DVR was recording Sylvester Stallone movies all on its own. They think this might be some sort of sly promotion tied into the new Rocky movie. Is this happening to anyone else, or do these people have a possessed DVR?

And from the comments:

I have Time Warner in NYC as well, and a month ago Bond movies started automatically queuing up. I thought it was a fluke, but that was right when Casino Royale was hitting wasn’t it? I’m the only person who touches my DVR, so it wasn’t a prank.

Also, in a similar vein to my earlier post on the price structures of ticketing systems, Consumerist reports on US Postal Service stamp vending machines, which require a minimum purchase of $1 (it’s suggested that this is in violation of Visa’s merchant agreements).

While minimum purchase amounts for credit card use are fairly common, (especially with smaller businesses, due to the transaction fees charged by the card company) when a minimum price is imposed on a system such as this stamp vending machine – and only made clear to the user after he or she has already selected the desired item – the practice seems somewhat sneaky. Many people who use a stamp vending machine will do so since they are in a rush, need to send that item of mail, and haven’t got time to wait in a queue. If you only wanted a 39 cent stamp, you’re forced to pay an additional 61 cents (more, in fact, since the stamp face values don’t add up to exactly $1) just to accomplish what you set out to do.

Still, you do get the extra stamp(s) you were ‘forced’ to buy, and at least they don’t go out of date or expire like a bus ticket or a parking ticket.

Stick

If we define ‘stick’ as ‘punishing the user for attempted deviation from prescribed behaviour’, then many of the architectures of control we’ve examined on this site demonstrate the stick approach. They’re not explicitly ‘technologies of punishment’ in Foucault‘s phrase, but rather a form of structural punishment. The thinking seems to be (for example):

…and so on. There are numerous other examples from software and urban planning, especially.

The thing is, though, for each of those ‘sticks’, a large percentage of people will not be obedient in the face of the ‘punishment’. They’ll try to find a way round it: a way of achieving their original objective but avoiding the punishment. They’ll search for what others in similar situations have done (e.g. DeCSS in the DVD example) or ask among friends until they find someone with the required expertise or who knows about an alternative. They may even actively destroy the ‘stick’ that punishes them. In some cases they might not even understand that they’re being punished, simply seeing ‘the system’ as beyond their comprehension or stacked against them.

Equally, there isn’t always a rational strategy behind the ‘stick’ in the first place. The anti-homeless bench doesn’t ‘solve’ the ‘problem of homelessness’. It just punishes those who try to lie down on it without offering an alternative. It’s punishment with no attempt at resolving the problem.

If a stick does get people to change their behaviour in the intended way, it will be accompanied by resentment, anger and dissatisfaction. It may only be fear of the consequences which prevent actual rebellion. In short: using sticks to change people’s behaviour is not a good idea.

Image from image.frame

Carrot

A ‘carrot’ means offering users an incentive to change their behaviour. This moves away from actual control to something closer to some aspects of captology – making a persuasive case for behaviour change through demonstrating its benefits rather than punishing those who disobey.

To some extent, control and incentives may be incompatible. Taking away functionality from users then showing them how they can get it back (usually by paying something) might be a classic combined “carrot and stick” technique, but it’s also bordering on a protection racket, and it doesn’t fool many people.

However, can control be used in conjunction with genuine incentives to serve the agendas of both sides? Electric lights that turn off automatically if no-one’s in the room take some control away from the user, but also offer benefits to both the user (lower electricity bills) and society as a whole (less energy used). But if they turn off automatically, is there actually any incentive for the user to change his or her behaviour? If we’re always spoon-fed, will we ever learn?

Perhaps mistake-proofing measures or forcing functions which allow a user to increase his or her productivity or safety, in return for giving up some ‘control’ – which may not be highly valued anyway – fit the definition best. If I’m working in a factory painting coachlines on hand-built bicycles, a steady guide arm that damps my arm vibrations – but only if I also take care as well – takes some control away from me, but also prevents me making mistakes, allowing me to paint more coachlines per hour, more accurately. It also helps my employer.

But that’s a very weak degree of control. Unless anyone can come up with any counter-examples, I would suggest that providing real incentives for users to change their behaviour is fundamentally a very different approach to the ‘control mindset’ (unless you are trying to trick people by offering false incentives, or by understating what they could lose by changing their behaviour).

I’ll get round to speedometers in a future post, since this approach is worthy of a deeper treatment.

*The phrase “carrot and stick” seems now universally to imply “offering incentives with one hand and punishment with the other” (though not necessarily at the same time), rather than the “carrot dangling from a stick, just out of reach” meaning (i.e. “motivating people to perform with incentives which will never be fulfilled”) which I first assumed it to have when I heard the phrase as a kid (I’m not the only one with this issue). In this post, I’ll use “stick” to mean “punishment”.

News Sniffer‘s Revisionista monitors alterations to published news stories from a variety of sources by comparing RSS feeds, sometimes revealing subsequently redacted information or changes of opinion (e.g. note the removed phrase in the first paragraph of this story about Cuba). While many of the changes are simply re-wordings for clarity or to correct grammatical errors, there are certainly also some instances of more substantial revisions – see the ‘recommended’ list.

Perhaps more revealing is News Sniffer’s Watch Your Mouth, which shows the reactively moderated comments removed from the BBC’s ‘Have Your Say’ threads. I’ve been reading this for a while – in fact I think I might have been one of the first subscribers via Bloglines – and am still amazed by just how many comments are removed by the BBC’s moderators, often making points which, though maybe controversial, are very much the voice of the common man and woman. Some are offensive, yes; others are genuine expressions of frustration or even first-hand annotations to or clarifications of aspects of the story above. Many are critical of the BBC, including those criticising the moderators for censorship of the very comments under dicsussion.

For many people in the UK, the BBC’s ‘Have Your Say’ is a first exposure to the concept of social media: their first experience of having their views and opinions directly shown to other users and being able to repsond to others’ opinions. Having such censorship in place may ‘tidy up’ the appearance of the site from the BBC’s point of view, and prevent arguments developing in the comments, but I feel that laying itself open to such (accurate) accusations of censorship will not be in the BBC’s best interests in the longer term. The BBC’s reaction to News Sniffer largely glosses over the ‘Watch Your Mouth’ section, which is a shame.

(When I was a teenager, I used to spend a lot of time listening to Talk Radio, and its successor, talkSPORT, even if only in the background while working. I knew the callers’ and presenters’ views weren’t representative of the population as a whole, but there was something intensely interesting about really being in touch with what (some) people were saying around the kitchen table, or in the pub. The views weren’t always informed, but there was a lot of common sense and frank opinion which rarely came across in other media available at the time (pre-fast Internet access). To some extent I see Watch Your Mouth as a kind of successor to that: the opinions that slip down, or are forced down, the back of the sofa, brought out into the open once more, whether idiotic or incisive.)

Is this relevant to architectures of control? I think so, even if only tangentially. News Sniffer is a fightback device against a formalised system of censorship, using simple, open technology (RSS) to break the control imposed by censors.

Image based on Don Norman‘s famous teapot, and the Obey Giant face

Last month I asked, in response to some criticism, whether there was a better term than ‘architectures of control’ for the loose category of stuff discussed on this site. The response was great – thanks to all who got in touch or commented.

James Young, an artist & designer from Oregon, thoughtfully suggested obedience engineering (along with ‘restrictive’, ‘regulatory’ and ‘supervisory’ engineering – as extensions to the term ‘functional engineering’, which I understand but have always thought was something of a tautology!). Obedience engineering has a neat ring to it – implying external authority – and describes most of the examples on this site pretty well, both politically- and economically-motivated control.

In most cases the ‘obedience’ is to serve a higher power’s strategy in some way, whether that’s forcing customers to buy razor blades more often or stopping the homeless sleeping in a park. In some cases, though, the obedience serves the user him or herself (usually in addition to a higher power in one way or another), such as various forcing functions and mistake-proofing aimed at ensuring safe operation of products or machines – it’s a similar kind of obedience to obeying your parents’ instructions not to put those fireworks in your pocket: for your own safety as well as their peace of mind. I’m aware that most of the examples I use come across as rather negative (and usually paranoid), so it’s important to remember that a lot of ‘control’ can have beneficial intentions (at least) for the user or society as a whole.

Reversing the phrase, ‘engineering/ed obedience’ and ‘designing/ed obedience’ also have a lot of merit, either as titles themselves or as explanatory subtitles/taglines. Architectures of control: engineered obedience?

(I don’t necessarily want to get into the design-or-engineering debate here. Both terms mean many different things to different people, and the use of either could immediately put off or attract people who would find something of interest here. There are readers here from a fair variety of fields; I know people whose eyes go blank when engineering is mentioned, and others who would assume that a site about design must be dealing purely with aesthetics or artisan furniture. Personally I see all design and engineering (and art and programming – as Paul Graham recognised) as pretty much the same subject, and indeed, perhaps the intersection of the physical and cognitive sciences with the environment, history and culture, but that’s something for another day…)

Jim Lipsey, a project engineer from Chicago, suggests disaffordances as a synonym for architectures of control – again, a neat and clever suggestion which also has the benefit of immediately conveying some understanding of the concept to product design and usability professionals and academics.

Nevertheless, it’s worth running over briefly what ‘affordances’ are in the first place, to explain why ‘disaffordances’ might be a good term. In its original definition, an affordance is a possible function of, or interaction with, a device. A chair gives me the affordance of sitting on it, but also standing on it, or hitting someone with it. This is a simplification of psychologist James J. Gibson‘s definition of affordances. Donald Norman – author of the legendary The Design of Everyday Things – extended the concept to what he later called perceived affordances: while I might use a chair to hit someone, my cultural conditioning, together with the form of the chair, suggest that I should sit on it. Norman’s affordances are thus what people think they can do (or should) with objects, which may be different to what they actually can do with them:

From ‘Affordances‘ by Mads Soegaard: ‘Separating affordances from the perceptual information that specifies affordances. Adapted from Gaver (1991).’

This Interaction-Design.org encyclopaedia article (from which the above diagram comes) is a very clear treatment fo the subject, as are Don Norman’s own ‘Affordances and design‘, and indeed Wikipedia’s entry.

Disaffordances, then, would imply either products with functionality deliberately removed (which fits many architectures of control example well – most obviously ‘feature deletion‘) or with the functionality deliberately hidden or obscured to reduce users’ ability to use the product in certain ways, or a combination of the two. That does take care of most of the examples I’ve looked at on this site, though I worry a bit about having to concatenate the two definitions. I also feel that quite a lot of architectures of control are actively attempting to force users to change their behaviour, whilst disaffordance implies a more passive state of affairs.

I think it may be best to use the term ‘disaffordance’ specifically to describe the practice of ‘disenfranchising’ users from the functions their products, systems or environments might otherwise provide (or have previously provided). This covers a lot of the things we discuss here (though it’s important to remember that architectures of control are deliberate, intentional, often strategic disaffordances, rather than something that’s difficult to use or hides its features through incompetent design); the the term doesn’t have much currency (yet), but I’ve done as Jim suggests and registered disaffordances.com and disaffordances.co.uk.

This blog is still maturing, and evolving, as is the field of thinking and practice which it charts. I’m sure plenty of new terminology (and jargon) will become commonplace in the years ahead. And the site will continue, in the words of the fantastic Gossip, ‘standing in the way of control‘ [mp3 link].

“Merseyside Police’s new anti-social behaviour (ASB) task force is exploring a number of technology-driven ideas.

But while the use of surveillance drones is among them, they would be a “long way off”, police said.
…

“The idea of the drone is a long way off, but it is about exploring all technological possibilities to support our war on crime and anti-social behaviour.”

Note that “anti-social behaviour” is mentioned separately to “crime.” Why? Also, nice appropriation of the “war on xxx” phrasing.

“It plans to utilise the latest law enforcement technology, including automatic number plate recognition (ANPR), CCTV “head-cams” and metal-detecting gloves.”

This country’s had it.

We’ve got Avon & Somerset Police using helicopters with high-intensity floodlights to “blind groups of teenagers temporarily” and councils using tax-payers’ money to install devices to cause deliberate auditory pain to a percentage of the population, again, whether or not they have committed a crime. Anyone would think that those in power despised their public. Perhaps they do.

Has it ever occurred to the police that tackling the causes of the problem might be a better solution than attacking the symptoms with a ridiculous battery of ‘technology’?

In a recent post, I discussed a Spiked article by Josie Appleton which included the following quote:

“Police in Weston-super-Mare have been shining bright halogen lights from helicopters on to youths gathered in parks and other public places. The light temporarily blinds them, and is intended to ‘move them on’, in the words of one Weston police officer.”

A friend, reading this, simply uttered a single word: “Mirror”.

What’d happen then? Is the risk of a blinded pilot and a crashed helicopter really worth it?

Or perhaps it’s the state, and by extension Avon & Somerset Police (in this case), who are the real blind pilots, attempting to ‘guide’ society in this way? If not blind, they’re certainly short-sighted.

In my review of Adam Greenfield‘s Everyware a couple of months ago, I mentioned – briefly – the work of Hendricus Loos, whose series of patents cover subjects including “Manipulation of nervous systems by electric fields”, “Subliminal acoustic manipulation of nervous systems”, “Magnetic excitation of sensory resonances” and “Remote magnetic manipulation of nervous systems”. A theme emerges, of which this post by Tom Coates at Plasticbag.org reminded me:

“There was one speaker at FOO this year that would literally have blown my brain away if he’d happened to have had his equipment with him. Ed Boyden talked about transcranial magnetic stimulation – basically how to use focused magnetic fields to stimulate sections of the brain and hence change behaviour. He talked about how you could use this kind of stimulation to improve mood and fight depression, to induce visual phenomena or reduce schizophrenic symptoms, hallucinations and dreams, speed up language processing, improve attention, break habits and improve creativity.

…

He ended by telling the story of one prominent thinker in this field who developed a wand that she could touch against a part of your head and stop you being able to talk. Apparently she used to roam around the laboratories doing this to people. She also apparently had her head shaved and tattooed with all the various areas of the brain and what direct stimulation to them (with a wand) could do to her. She has, apparently, since grown her hair. I’d love to meet her.”

Now, the direct, therapeutic usage of small-range systems such as these is very different to the discipline-at-a-distance proposed in a number of Loos’s patents (where an ‘offender’ can be incapacitated, using, e.g. a magnetic field), but both are architectures of control: systems designed to modify, restrict and control people’s behaviour.

And, I would venture to suggest, a more widespread adoption of magnetic stimulation for therapeutic uses – perhaps, in time, designed into a safe, attractive consumer product for DIY relaxation/stimulation/hallucination – is likely to lead to further experimentation and exploration of ‘control’ applications for law enforcement, crowd ‘management’, and other disciplinary uses. I think we – designers, engineers, tech people, architects, social activists, anyone who values freedom – should be concerned, but the impressive initiative of the Open-rTMS Project will at least ensure that we’re able to understand the technology.

“This is the paradox of social media that has been bothering me lately: an ‘empowering’ media that provides increased opportunities for communication, education and online participation, but which at the same time further isolates individuals and aggregates them into masses —more prone to control, and by extension more prone to discipline.”

Slashdot on ‘A working economy without DRM?’ – same debate as ever, but some very insightful comments

Slashdot on ‘Explaining DRM to a less-experienced PC user’ – I particularly like SmallFurryCreature’s ‘Sugar cube’ analogy

‘The Promise of a Post-Copyright World’ by Karl Fogel – extremely clear analysis of the history of copyright and, especially, the way it has been presented to the public over the centuries

(Via BoingBoing) The Entertrainer – a heart monitor-linked TV controller: your TV stays on with the volume at a usable level only while you keep exercising at the required rate. Similar concept to Gillian Swan’s Square-Eyes

The news that tobacco companies have increased the levels of nicotine in their brands over the last few years – especially those popular with certain groups – made me think further about architectures of control:

“The amount of nicotine in most cigarettes rose an average of almost 10 percent from 1998 to 2004, with brands most popular with young people and minorities registering the biggest increases and highest nicotine content… the higher levels theoretically could make new smokers more easily addicted and make it harder for established smokers to quit.

…

Boxes of Doral lights, a low-tar brand made by R.J. Reynolds Tobacco Co., had the biggest increase in yield, 36 percent… The nicotine in Marlboro products, preferred by two-thirds of high school smokers, increased 12 percent. Kool lights increased 30 percent. Two-thirds of African American smokers use menthol brands.

…

“The reports are stunning,” said Matthew L. Myers, president of the Campaign for Tobacco-Free Kids. “What’s critical is the consistency of the increase, which leads to the conclusion that it has to have been conscious and deliberate.”"

The classification ‘architectures of control‘ ought rightly to include cigarettes alongside any other product designed to be addictive or to reinforce patterns of users’ behaviour. In this sense, any psychoactive drug intended to control/alter users’ behaviour must be considered part of the same phenomenon, certainly when it is created or administered with that specific intention. And of course, these are not just designed to be unpleasant, but designed to injure and endanger life (not until revenue’s been extracted, of course).

It may seem extreme or inappropriate to link, say, the razor-blade business model with drug addiction (just as it perhaps seemed extreme to put biscuit packaging alongside Henry Porter’s ‘Blair Laid Bare’), but there are definite parallels. A product is designed with a feature which intentionally locks customers into that product, through making it difficult to switch (for cost reasons, by ingraining habits, or by actual chemical or mental addiction). In the cases of, say, printer cartridges or razor blades, the original products (the printer or razor) require frequent refills/replacement parts. In the case of cigarette addiction, the initial use of the product (the cigarettes) modifies the behaviour of the host (the smoker) so that continued purchases of the products are required.

In fact, is this not a parasitic lock-in business model? How different is a product which deliberately causes addiction to, say, a piece of malware which takes over a user’s computer and installs unwanted software, or advertising pop-ups, or, say, phones home regularly and has the potential to hold the user’s data to ransom?

From the point of view of educating the wider public (including designers), the cigarette/drug addiction comparison is a good way of immediately highlighting the issue of ‘product rights management‘ as an architecture of control.*

(Washington Post link via A Blog Around the Clock and BoingBoing)

*Wish I’d thought of it at last Sunday’s Copyfighters’ event!

Josie Appleton, at the always-interesting Spiked, takes a look at the increasing systemic hostility towards ‘young people in public places’ in the UK: ‘When did ‘hanging around’ become a social problem?’

As well as the Mosquito, much covered on this site (all posts; try out high frequency sounds for yourself), the article mentions the use of certain music publicly broadcast for the same ‘dispersal’ purpose:

“The Local Government Association (LGA) has compiled a list of naff songs for councils to play in trouble spots in order to keep youths at bay – including Lionel Richie’s ‘Hello’ and St Winifred’s School Choir’s ‘There’s No One Quite Like Grandma’. Apparently the Home Office is monitoring the scheme carefully. This policy has been copied from Sydney, where it is known as the ‘Manilow Method’ (after the king of naff, Barry Manilow), and has precursors in what we might call the ‘Mozart Method’, which was first deployed in Canadian train stations and from 2004 onwards was adopted by British shops (such as Co-op) and train stations (such as Tyne and Wear Metro).”

(I do hope each public broadcast of the music is correctly licensed in accordance with PPL terms and conditions, if only because I don’t want my council tax going to fund a legal battle with PPL. Remember, playing music in public is exactly equivalent to nicking it from a shop, and, after all, that’s the sort of thing that those awful young people do, isn’t it?

I also wonder why there is a difference between a council playing loud music in public, and a member of the public choosing to do so. If kids took along a stereo and played loud music in a shopping centre or any other public place, they’d get arrested or at the very least get moved on.

What would the legal situation be if kids were playing exactly the same music as was also being pumped out of the council-approved/operated speakers, at the same time? It can hardly be described as a public nuisance if it’s no different to what’s happening anyway.

What if kids started playing the same music as was on the speakers, but out-of-synch so that it sounded awful to every passer-by? Maybe shift the pitch a little (couple of semitones down?) so the two tracks overlayed cause a nice ‘drive-away-all-the-customers’ effect? What would happen then? What if kids build a little RF device which pulses repeatedly with sufficient power to superimpose a nice buzz on the council’s speaker output?)

Anyway, Ms Appleton goes on to note a new tactic perhaps even more extreme than the Mosquito, and a sure candidate for my ‘designed to injure‘ category (perhaps not actually endangering life, but close):

“Police in Weston-super-Mare have been shining bright halogen lights from helicopters on to youths gathered in parks and other public places. The light temporarily blinds them, and is intended to ‘move them on’, in the words of one Weston police officer.”

Wow! Roll on the lawsuits. (Nice to know that the local air ambulance relies on charitable donations to stay in the air, while the police apparently have plenty of helicopters available)

The article quotes what increasingly appears to be the official attitude:

“…this isn’t just about teenagers committing crimes: it’s also about them just being there. Before he was diverted into dealing with terror alerts, home secretary John Reid was calling on councils to tackle the national problem of ‘teenagers hanging around street corners’. Apparently unsupervised young people are in themselves a social problem.”

As we know from examining the Mosquito, this same opinion isn’t restricted to Dr Reid. It was the Mosquito manufacturer Compound Security’s marketing director, Simon Morris, who apparently told the BBC that:

“People have a right to assemble with others in a peaceful way… We do not consider that this right includes the right of teenagers to congregate for no specific purpose.”

So there you have it. As Brendan O’Neill puts it in a New Statesman piece referenced in the Spiked article:

“…Fear and loathing… is driving policy on young people. We seem scared of our own youth, imagining that “hoodies” and “chavs” are dragging society down. We’re so scared, in fact, that we use impersonal methods to police them: we use scanners to monitor their behaviour, we blind them from a distance, and now employ machines to screech at them in the hope they will just go away. With no idea of what to say to them – how to inspire or socialise them – we seek to disperse, disperse, disperse. It will only heighten their sense of being outsiders.”

Scott Adams recounts an anecdote illustrating the ‘illusion of control’ and how important it is to many people – even to the extent that it is the single defining characteristic of mankind which one might use to explain human behaviour to aliens:

“The maintenance man is moving the thermostat in our office today. I started talking with him about the “Thermostat Wars” [from Dilbert comics]. He told me about one office with 30 women where they could never get the temperature to an agreeable level. At his suggestion they installed 20 dummy thermostats around the office. Everyone was told that each thermostat controlled the zone around itself.

Problem solved. Now that everyone has “control” of their own thermostat there is no problem.”

To what extent is the illusion of control, rather than real control, what most people really want in their products?

Do they care that their personal data may be encrypted and held to ransom by a software company, so long as they feel ‘in control’ in everyday use (e.g. the ability to change the colour scheme)?

And how should designers respond to this issue? Are there any examples of products (other than, say, children’s toys) deliberately designed with fake controls to make the user feel in charge even though he/she isn’t? (Fake solar cell calculators are interesting, but not quite the same issue)

P.S. On the other hand, it’s worth considering the opinion expressed by the Audi A2 owner, that she didn’t find it a disadvantage having to take her Audi to a ‘specialist’ in order to open the bonnet (hood). Is even that basic level of control (being able to see the engine) too much for some people? Is it because, say, a thermostat affects people personally (temperature) whereas a car engine is something dirty, difficult, complex, for someone else to worry about?

According to Reuters,

“The [US] government will not require recorders in autos but said on Monday that car makers must tell consumers when technology that tracks speed, braking and other measurements is in the new vehicles they buy.

The National Highway Traffic Safety Administration regulation standardizes recorder content and sets guidelines for how the information should be disclosed.

…

Safety experts, consumer groups and insurance companies have long pressed the agency to mandate recorders in cars, but industry has responded voluntarily in recent years. About two-thirds of the new vehicles now produced each year contain the device that is connected to air bag systems.

…

Under the new rules, auto recorders must track vehicle speed, acceleration, and deceleration, braking, steering and some air bag functions. In some cases data on vehicle roll angle, steering inputs, and passenger safety belt use will be recorded.

…

Rae Tyson, a NHTSA spokesman, said… that recorder information is private property that cannot be downloaded without permission of the vehicle owner.”

Let’s get this straight: these are black boxes intended to help compile safety data and undestand accidents, and the data will not be shared with insurance companies except with the car owner’s pemission, so drivers have nothing to worry about?

Or will it simply be the case that signing up for car insurance will require you “voluntarily” to allow the insurance company to access your data?

Are these actually that different to insurance black boxes??

Another point which stands out of the story, since reading Scott Craver‘s Privacy Ceiling outline, is that the black box is legally optional yet two-thirds of all new cars in the US have them.

In a liability culture, that violates Scott’s 3rd principle:

Do not bother to design a system or business model that balances user privacy with [potential external] demands. All this does is insert an architecture of monitoring or control, for later abuse. In other words, design an architecture for privacy alone. Anything you put in there… will one day be used to its full extent.

If the black boxes are in every car a company (such as GM) makes, that leaves the company open to certain, ah, liability issues. Say NHTSA analysis of accident data shows that a particular model has peculiarities related to, e.g. “vehicle roll angle and steering inputs” as tracked by the black box (or, even worse, inconsistencies related to this issue, with some cars having a problem and others not).

That car manufacturer is instantly plunged into the spotlight as a maker of dangerous products, even if the problem is not necessarily as simple as it seems (certain types of car attract better drivers than others, for example), and it will be very difficult to defend the issue and deal with lawsuits, since the information is now publicly available. (Conversely, having that amount of information should also make it easier for the company to analyse and respond to the problem).

Yet they could have “got away with it” by not fitting the black boxes in the first place. That may be a Ford Pinto-esque, bury-your-head-in-the-sand approach, but when company planners look at the potential upside and downside of any strategy decision, the decision to fit black boxes voluntarily may not seem such a sensible one in view of the liabilities to which it exposes the company.

(Reuters link via Open Rights Group discussion)

I was woken up (along with, I expect, lots of others) at about 5am today by a driver sounding his/her horn in the road outside – an arrogant two-second burst – then another replying (perhaps) with a slightly feeble one-second tone. I don’t know why; there are often a lot of horns during the day as there’s a level crossing which seems to generate a lot of frustration, but there are no trains passing through at 5am. Anyway, I went back to sleep and had various, fitful dreams, but not before thinking that’s where an architecture of control would be useful: a time-related horn interlock function, only allowing use of the horn during hours when it is legal. In the UK, that would be from 7am – 11.30 pm.

But then, waking up properly a couple of hours later, I remembered my earlier thought. And considered that this kind of control wouldn’t be necessary if people were more considerate towards others. If we could rely on people to care about the effects of their actions, there would be no need for quite a lot of the architectures of control discussed on this site, from speed humps to externally controlled speed limiters, and very little argument in favour of them.

As it is, my modified, awake, more alert opinion is that a society where people take responsibility for what they do is better than one where some external agency takes that responsibility away from them. Or, at least, I don’t want to live in that latter type of society, because I don’t want any control taken away from me, even if I have to put up with some idiots.

“This is an economic limit on privacy violation by companies, owing to the liability of having too much information about (or control over) users.”

It’s the “control over users” that immediately makes this something especially relevant for designers and technologists to consider: that control is designed, consciously, into products and systems, but how much thought is given to the extremes of how it might be exercised, especially in conjunction with the wealth of information that is gathered on users?

“Liability can come from various sources… [including]

Vicarious infringement liability.

Imagine: you write a music player (like iTunes) that can check the Internet when I place a CD in my computer. You decide to collect this data for market research. Now the RIAA discovers that this data can also identify unauthorized copies. Can they compel you to hand over data on user listening habits?

Your company is liable for vicarious infringement if (1) infringement happens, (2) you benefit from it, and (3) you had the power to do something about it—which I assume includes reporting the infringement. So now you are possibly liable because you have damning information about your users. This also applies to DRM technologies that let you restrict users.

Note that you can’t solve this problem simply by adopting a policy of only keeping the data for 1 month, or being gentle and consumer-friendly with your DRM. The fact is, you have the architecture for monitoring and/or control, and you may not get to choose how you use it.

Other sources of liability described include: being drawn into criminal investigations based on certain data which a company or other organisation may have – or be compelled to obtain – on its users; customers suing in relation to the leaking of supposedly private data (as in the AOL débâcle); and “random incompetence”, e.g. an employee accidentally releasing data or arbitrarily exercising some designed-in control with undesirable consequences.

Scott goes on:

“Okay, so there is a penalty to having too much knowledge or too much control over customers. What should companies do to stay beneath this ceiling?

1. Design an architecture for your business/software that naturally prevents this problem.

It is much easier for someone to compel you to violate users’ privacy if it’s just a matter of using capabilities you already have. Mind, you have to convince a judge, not a software engineer, that adding monitoring or control is difficult. But you have a better shot in court if you must drastically alter your product in order to give in to demands.

…

2. Assume you will monitor and control to the full extent of your architecture. In fact, don’t just assume this, but go to the trouble to monitor or control your users.

Why? Because in an infringement lawsuit you don’t want to appear to be acting in bad faith… if you have the ability to monitor users and refuse to use it, you’re giving ammunition to a copyright holder who accuses you of inducement and complicity.

…

But … the real message is that you should go back to design principle 1. If you want to protect users, think about the architecture; don’t just assume you can take a principled stand not to abuse your own power.

The third principle is really a restatement of the first two, but deserves restating:

3. Do not attempt to strike a balance.

Do not bother to design a system or business model that balances user privacy with copyright holder demands. All this does is insert an architecture of monitoring or control, for later abuse. In other words, design an architecture for privacy alone. Anything you put in there, under rule #2, will one day be used to its full extent.

I have seen many many papers over the years, in watermarking tracks, proposing an end-to-end media distribution system balancing DRM with privacy. Usually, the approach is that watermarks are embedded in music/movies/images by a trusted third party, the marks are kept secret from the copyright holder, and personal information is revealed only under specific circumstances in which infringement is clear. This idea is basically BS. Your trusted third party does not have the legal authority to decide when to reveal information. What will likely happen instead: if a copyright holder feels infringement is happening, the trusted third party will be liable for vicarious infringement.“

Summing it up: any capability you design into a product or system will be used at some point – even if you are forced to use it against the best interests of your business. So it is better to design deliberately to avoid being drawn into this: design systems not to have the ability to monitor or control users, and that will keep you much safer from liability issues.

The privacy ceiling concept – which Scott is going to present in a paper along with Lorrie Cranor and Janice Tsai at the ACM DRM 2006 workshop – really does seem to have a significant implications for many of the architectures of control examples I’ve looked at on this site.

For example, the Car Insurance Black Boxes mostly record mileage and time data to allow insurance to be charged according to risk factors that interest the insurance company; but the boxes clearly also record speed, and whether that information would be released to, say, law enforcement authorities, if requested, is an immediate issue of interest/concern.

Looking further, though, the patent covering the box used by a major insurer mentions an enormous number of possible types of data that could be monitored and reported by the device, including exact position, weights of occupants, driving styles, use of brakes, what radio station is tuned in, and so on. Whether any insurance company would ever implement them, of course, is another question, and it would require a lot tighter integration into a vehicle’s systems; nevertheless, as Scott makes clear, whatever possibilities are designed into the architecture, will be exploited at some point, whether through pressure (external or internal) or incompetence.

I look forward to reading the full paper when it is available.

At Freedom to Tinker, Ed Felten has posted a summary of a talk he gave at the Usenix Security Symposium, called “DRM Wars: The Next Generation”. The two installments so far (Part 1, Part 2) trace a possible trend in the (stated) intentions of DRM’s proponents, from it being largely promoted as a tool to help enforce copyright law (and defeat ‘illegal pirates’) to the current stirrings of DRM’s being explicitly acknowledged as a tool to facilitate discrimination and lock-in — and the apparent ‘benefits of this’:

“First, they argue that DRM enables price discrimination — business models that charge different customers different prices for a product — and that price discrimination benefits society, at least sometimes. Second, they argue that DRM helps platform developers lock in their customers, as Apple has done with its iPod/iTunes products, and that lock-in increases the incentive to develop platforms.

Interestingly, these new arguments have little or nothing to do with copyright. The maker of almost any product would like to price discriminate, or to lock customers in to its product. Accordingly, we can expect the debate over DRM policy to come unmoored from copyright, with people on both sides making arguments unrelated to copyright and its goals.”

As noted by some of the commenters, that unmooring also unmoors the DRM debate from being presented as an ‘honest content providers vs illegal pirating freeloaders’ one. Price-fixing, lock-ins and so on are difficult to defend, and I find it hard to think of convincing examples where “price discrimination benefits society” or “lock-in increases the incentive to develop platforms”. If customers are locked in to a platform, there is no incentive to innovate for the locker-in, and much higher barriers for competitors to draw them away. Path dependency is rarely good for companies, and rarely good for society, and lock-ins would seem to be a major contributor to path dependency. The argument that “Apple wouldn’t have developed the iPod (and the record companies wouldn’t have let Apple develop iTunes) if DRM didn’t exist to lock customers in” is specious: there were plenty of portable music players before they came on the scene, and surely most 40GB music iPods were always intended to be largely filled with music acquired from somewhere other than iTunes.

Ed goes on to talk about the trend “toward the use of DRM-like technologies on traditional physical products.” (Long-term followers – if any! – of my research might remember this is very similar to the phrase “Architectures of control: DRM in hardware” which Cory Doctorow used to link to my original web-page on the subject), and uses the example of printer cartridge lock-ins (see also here):

“A good example is the use of cryptographic lockout codes in computer printers and their toner cartridges. Printer manufacturers want to sell printers at a low price and compensate by charging more for toner cartridges. To do this, they want to stop consumers from buying cheap third-party toner cartridges. So some printer makers have their printers do a cryptographic handshake with a chip in their cartridges, and they lock out third-party cartridges by programming the printers not to operate with cartridges that can’t do the secret handshake.

Doing this requires having some minimal level of computing functionality in both devices (e.g., the printer and cartridge). Moore’s Law is driving the size and price of that functionality to zero, so it will become economical to put secret-handshake functions into more and more products. Just as traditional DRM operates by limiting and controlling interoperation (i.e., compatibility) between digital products, these technologies will limit and control interoperation between ordinary products. We can call this Property Rights Management, or PRM.”

Not too sure about that term myself, as I feel the affordances the technology is controlling are moving further and further away from actual ‘rights’. DRM is bad enough as a catch-all term for technology which in many cases is denying users rights they may legally hold in some countries (e.g. fair use or backup copies). I think “technology lock-ins” or “technology razor-blade models” might be a more descriptive label than ‘PRM’. (Or ‘architectures of control’, of course, but my definition of these is much broader than simply lock-ins).

Ed gives three examples of possible future extensions of technology lock-ins, none of which seem at all unlikely; in fact they’re all easily possible right now:

“(1) A pen may refuse to dispense ink unless it’s being used with licensed paper. The pen would handshake with the paper by short-range RFID or through physical contact.

(2) A shoe may refuse to provide some features, such as high-tech cushioning of the sole, unless used with licensed shoelaces. Again, this could be done by short-range RFID or physical contact.

(3) The scratchy side of a velcro connector may refuse to stick to the fuzzy size unless the fuzzy side is licensed. The scratchy side of velcro has little hooks to grab loops on the fuzzy side; the hooks may refuse to function unless the license is in order [hence my photo at the top of this post! - Dan] For example, Apple could put PRMed scratchy-velcro onto the iPod, in the hope of extracting license fees from companies that make fuzzy-velcro for the iPod to stick to.

Will these things actually happen? I can’t say for sure. I chose these examples to illustrate how far PRM might go. The examples will be feasible to implement, eventually. Whether PRM gets used in these particular markets depends on market conditions and business decisions by the vendors. What we can say, I think, is that as PRM becomes practical in more product areas, its use will widen and we’ll face policy decisions about how to treat it.”

The comments on both posts (Part 1 | Part 2) go into some extremely interesting discussion of the ideas and examples, with the ‘pen/licensed paper’ one being conclusively noted as ‘baked’ with Bill Higgins explaining the Anoto* technology.

(*And no, I don’t think the “www.anotofunctionality.com” of that link is deliberately in the same league as “www.powergenitalia.com,” “www.expertsexchange.com,” etc, but it’s still oddly apposite given the “no to functionality” with which so many lock-ins shed users when they’re fed up with paying over the odds for replacement parts.)

I look forward to the third part of Ed’s talk summary: this is a fascinating area of discussion which is central to much of the ‘architectures of control’ phenomenon.

Now, I know, I know, there may be an important backstory behind that person’s search. Some people apparently really do have problems with kids intimidating them (e.g. see these comments on the Mosquito) and believe that a technological solution is the only answer.

But take the concept in isolation: how will history judge the “device to stop young people congregating” concept? Will it be seen as a cruel, archaic display of embdedded prejudice, in the same way that we would be horrified to see “device to stop X race of people congregating” or “device to stop X colour people congregating”?

Or will it be seen as a mild, thin end of a much larger, more sinister wedge (“device to stop ALL people congregating”)?

This is the first book review I’ve done on this blog, though it won’t be the last. In a sense, this is less of a conventional review than an attempt to discuss some of the ideas in the book, and synthesise them with points that have been raised by the examination of architectures of control: what can we learn from the arguments outlined in the book?

Adam Greenfield‘s Everyware: The dawning age of ubiquitous computing looks at the possibilities, opportunities and issues posed by the embedding of networked computing power and information processing in the environment, from the clichéd ‘rooms that recognise you and adapt to your preferences’ to surveillance systems linking databases to track people’s behaviour with unprecedented precision. The book is presented as a series of 81 theses, each a chapter in itself and each addressing a specific proposition about ubiquitous computing and how it will be used.

There’s likely to be a substantial overlap between architectures of control and pervasive everyware (thanks, Andreas), and, as an expert in the field, it’s worth looking at how Greenfield sees the control aspects of everyware panning out.

Everyware as a discriminatory architecture enabler

“Everyware can be engaged inadvertently, unknowingly, or even unwillingly“

In Thesis 16, Greenfield introduces the possibilities of pervasive systems tracking and sensing our behaviour—and basing responses on that—without our being aware of it, or against our wishes. An example he gives is a toilet which tests its users’ “urine for the breakdown products of opiates and communicate[s] its findings to [their] doctor, insurers or law-enforcement personnel,” without the user’s express say-so.

It’s not hard to see that with this level of unknowingly/unwillingly active everyware in the environment, there could be a lot of ‘architectures of control’ consequences. For example, systems which constrain users’ behaviour based on some arbitrary profile: a vending machine may refuse to serve a high-fat snack to someone whose RFID pay-card identifies him/her as obese; or, more critically, only a censored version of the internet or a library catalogue may be available to someone whose profile identifies him/her as likely to be ‘unduly’ influenced by certain materials, according to some arbitrary definition. Yes, Richard Stallman’s Right To Read prophecy could well come to pass through individual profiling by networked ubiquitous computing power, in an even more sinister form than he anticipated.

Taking the ‘discriminatory architecture’ possibilities further, Thesis 30, concentrating on the post-9/11 ‘security’ culture, looks at how:

“Everyware redefines not merely computing but surveillance as well… beyond simple observation there is control… At the heart of all ambitions aimed at the curtailment of mobility is the demand that people be identifiable at all times—all else follows from that. In an everyware world, this process of identification is a much subtler and more powerful thing than we often consider it to be; when the rhythm of your footsteps or the characteristic pattern of your transactions can give you away, it’s clear that we’re talking about something deeper than ‘your papers, please.’

Once this piece of information is in hand, it’s possible to ask questions like Who is allowed here? and What is he or she allowed to do here?… consider the ease with which an individual’s networked currency cards, transit passes and keys can be traced or disabled, remotely—in fact, this already happens. But there’s a panoply of ubiquitous security measures both actual and potential that are subtler still: navigation systems that omit all paths through an area where a National Special Security Event is transpiring, for example… Elevators that won’t accept requests for floors you’re not accredited for; retail items, from liquor to ammunition to Sudafed, that won’t let you purchase them… Certain options simply do not appear as available to you, like greyed-out items on a desktop menu—in fact, you won’t even get that back-handed notification—you won’t even know the options ever existed.”

This kind of ‘creeping erosion of norms‘ is something that’s concerned me a lot on this blog, as it seems to be a feature of so many dystopian visions, both real and fictional. From the more trivial—Japanese kids growing up believing it’s perfectly normal to have to buy music again every time they change their phone—to society blindly walking into 1984 due to a “generational failure of memory about individual rights” (Simon Davies, LSE), it’s the “you won’t even know the [options|rights|abilities|technology|information|words to express dissent] ever existed” bit that scares me the most.

Going on, Greenfield quotes MIT’s Gary T Marx‘s definition of an “engineered society,” in which “the goal is to eliminate or limit violations by control of the physical and social environment.” I’d say that, broadening the scope to include product design, and the implication to include manipulation of people’s behaviour for commercial ends as well as political, that’s pretty much the architectures of control concept as I see it.

In Thesis 42, Greenfield looks at the chain of events that might lead to an apparently innocuous use of data in one situation (e.g. the recording of ethnicity on an ID card, purely for ‘statistical’ purposes) escalating into a major problem further down the line, when that same ID record has become the basis of an everyware system which controls, say, access to a building. Any criteria recorded can be used as a basis for access restriction, and if ‘enabled’ deliberately or accidentally, it would be quite possible for certain people to be denied services or access to a building, etc, purely on an arbitrary, discriminatory criterion.

“…the result is that now the world has been provisioned with a system capable of the worst sort of discriminatory exclusion, and doing it all cold-bloodedly, at the level of its architecture… the deep design of ubiquitous systems will shape the choices available to us in day-to-day life, in ways both subtle and less so… It’s easy to imagine being denied access to some accommodation, for example, because of some machine-rendered judgement as to our suitability, and… that judgement may well hinge on something we did far away in both space and time… All we’ll be able to guess is that we conformed to some profile, or violated the nominal contours of some other…

The downstream consequences of even the least significant-seeming architectural decision could turn out to be considerable—and unpleasant.”

Indeed.

Everyware as mass mind control enabler

In a—superficially—less contentious area, Thesis 34 includes the suggestion that everyware may allow more of us to relax: to enter the alpha-wave meditative state of “Tibetan monks in deep contemplation… it’s easy to imagine environmental interventions, from light to sound to airflow to scent, designed to evoke the state of mindfulness, coupled to a body-monitor setting that helps you recognise when you’ve entered it.” Creating this kind of device—whether biofeedback (closed loop) or open-loop—has interested designers for decades (indeed, my own rather primitive student project attempt a few years ago, MindCentre, featured light, sound and scent in an open-loop), but when coupled to the pervasive bio-monitoring of whole populations using everyware, some other possibilities surely present themselves.

Is it ridiculous to suggest that a population whose stress levels (and other biological indicators) are being constantly, automatically monitored, could equally well be calmed, ‘reassured’, subdued and controlled by everyware embedded in the environment designed for this purpose? One only has to look at the work of Hendricus Loos to see that the control technology exists, or is at least being developed (outside of the military); how long before it\’s networked to pervasive monitoring, even if, initially only of prisoners? See also this article by Francesca Cedor.\r\n\r\n\r\nEveryware as \’artefacts with politics\’\r\n\r\nOn a more general \’Do artefacts have politics?\’/\’Is design political?\’ point, Greenfield observes that certain technologies have “inherent potentials, gradients of connection” which predispose them to be deployed and used in particular ways (Thesis 27), i.e. technodeterminism. That sounds pretty vague, but it\’s — to some extent — applying Marshall McLuhan\’s “the medium is the message” concept to technology. Greenfield makes an interesting point:\r\n\r\n

“It wouldn\’t have taken a surplus of imagination, even ahead of the fact, to discern the original Napster in Paul Baran\’s first paper on packet-switched networks, the Manhattan skyline in the Otis safety elevator patent, or the suburb and the strip mall latent in the heart of the internal combustion engine.”

\r\n\r\nThat\’s an especially clear way of looking at \’intentions\’ in design: to what extent are the future uses of a piece of technology, and the way it will affect society, embedded in the design, capabilities and interaction architecture? And to what extent are the designers aware of the power they control? In Thesis 42, Greenfield says, “whether consciously or not, values are encoded into a technology, in preference to others that might have been, and then enacted whenever the technology is employed”.\r\n\r\nLawrence Lessig has made the point that the decentralised architecture of the internet — as originally, deliberately planned — is a major factor in its enormous diversity and rapid success; but what about in other fields? It\’s clear that Richard Stallman\’s development of the GPL (and Lessig\’s own Creative Commons licences) show a rigorous design intent to shape how they are applied and what can be done with the material they cover. But does it happen with other endeavours? Surely every RFID developer is aware of the possibilities of using the technology for tracking and control of people, even if he/she is \’only\’ working on tracking parcels? As Greenfield puts it, “RFID \’wants\’ to be everywhere and part of everything.” He goes on to note that the 128-bit nature of the forthcoming IPv6 addressing standard — giving 2^128 possible addresses — pretty clearly demonstrates an intention to “transform everything in the world, even every part of every thing, into a node.” \r\n\r\nNevertheless, in many cases, designed systems will be put to uses that the originators really did not intend. As Greenfield comments in Thesis 41:\r\n\r\n

“…connect… two discrete databases, design software that draws inferences fromt he appearance of certain patterns of fact—as our relational technology certainly allows us to do—and we have a situation where you can be identified by name and likely political sympathy as you walk through a space provisioned with the necessary sensors.\r\n\r\nDid anyone intend this? Of course not—at least, we can assume that the original designers of each separate system did not. But when… sensors and databases are networked and interoperable… it is a straightforward matter to combine them to produce effects unforeseen by their creators.”

\r\n\r\nIn Thesis 23, the related idea of \’embedded assumptions\’ in designed everyware products and systems is explored, with the example of a Japanese project to aid learning of the language, including alerting participants to “which of the many levels of politeness is appropriate in a given context,” based on the system knowing every participant\’s social status, and “assign[ing] a rank to every person in the room… this ordering is a function of a student\’s age, position, and affiliations.” Greenfield notes that, while this is entirely appropriate for the context in which the teaching system is used:\r\n\r\n

“It is nevertheless disconcerting to think how easily such discriminations can be hard-coded into something seemingly neutral and unimpeachable and to consider the force they have when uttered by such a source…\r\n\r\nEveryware [like almost all design, I would suggest (DL)]… will invariably reflect the assumptions its designers bring to it… those assumptions will result in orderings—and those orderings will be manifested pervasively, in everything from whose preferences take precedence while using a home-entertainment system to which of the injured supplicants clamouring for the attention of the ER staff gets cared for first.”

\r\n\r\nThesis 69 states that:\r\n\r\n

“It is ethically incumbent on the designers of ubiquitous systems and environments to afford the human user some protection”

\r\n\r\nand I think I very much agree with that. From my perspective as a designer I would want to see that ethos promoted in universities and design schools: that is real, active user-centred, thoughtful design rather than the vague, posturing rhetoric which so often surrounds and obscures the subject. Indeed, I would further broaden the edict to include affording the human user some control, as well as merely protection—in all design—but that\’s a subject for another day (I have quite a lot to say on this issue, as you might expect!). Greenfield touches on this in Thesis 76 where he states that “ubiquitous systems must not introduce undue complications into ordinary operations” but I feel the principle really needs to be stronger than that. Thesis 77 proposes that “ubiquitous systems must offer users the ability to opt out, always and at any point,” but I fear that will translate into reality as \’optional\’ in the same way that the UK\’s proposed ID cards will be optional: if you don\’t have one, you\’ll be denied access to pretty much everything. And you can bet you\’ll be watched like a hawk.\r\n\r\n\r\nEveryware: transparent or not?\r\n\r\nGreenfield returns a number of times to the question of whether everyware should be presented to us as \’seamless\’, with the relations between different systems not openly clear, or \’seamful\’, where we understand and are informed about how systems will interact and pass data before we become involved with them. From an \’architectures of control\’ point of view, the most relevant point here is mentioned in Theses 39 and 40:\r\n\r\n

“…the problem posed by the obscure interconnection of apparently discrete systems… the decision made to shield the user from the system\’s workings also conceals who is at risk and who stands to benefit in a given transaction…\r\n\r\n”MasterCard, for example, clearly hopes that people will lose track of what is signified by the tap of a PayPass card—that the action will become automatic and thus fade from perception.”

\r\n\r\nThis is a very important issue and also seems especially pertinent to much in \’trusted\’ computing where the user may well be entirely oblivious to what information is being collected about him or her, and to whom it is being transmitted, and, due to encryption, unable to access it even if the desire to investigate were there. Ross Anderson has explored this in great depth.\r\n\r\nThesis 74 proposes that “Ubiquitous systems must contain provisions for immediate and transparent querying of their ownership, use and capabilities,” which is a succinct principle I very much hope will be followed, though I have a lot of doubt.\r\n\r\n\r\nFightback devices\r\n\r\nIn Thesis 78, Greenfield mentions the Georgia Tech CCD-light-flooding system to prevent unauthorised photography as a fightback device challenging everyware, i.e. that it will allow people to stop themselves being photographed or filmed without their permission.\r\n\r\nI feel that interpretation is somewhat naïve. I very, very much doubt that offering the device as a privacy protector for the public is a) in any way a real intention from Georgia Tech\’s point of view, or b) that members of the public who did use such a device to evade being filmed and photographed would be tolerated for long. Already in the UK we have shopping centres where hooded tops are banned so that every shopper\’s face can clearly be recorded on CCTV; I hardly think I\’d be allowed to get away with shining a laser into the cameras! \r\n\r\nAlthough Greenfield notes that the Georgia Tech device does seem “to be oriented less toward the individual\’s right to privacy than towards the needs of institutions attempting to secure themselves against digital observation,” he uses examples of Honda testing a new car in secret (time for Hans Lehmann to dig out that old telephoto SLR!) and the Transportation Security Agency keeping details of airport security arrangements secret. The more recent press reports about the Georgia Tech device make pretty clear that the real intention (presumably the most lucrative) is to use it arbitrarily to stop members of the public photographing and filming things, rather than the other way round. If used at all, it\’ll be to stop people filming in cinemas, taking pictures of their kids with Santa at the mall (they\’ll have to buy an \’official\’ photo instead), taking photos at sports events (again, that official photo), taking photos of landmarks (you\’ll have to buy a postcard) and so on. \r\n\r\nIt\’s not a fightback device: it\’s a grotesque addition to the rent-seekers\’ armoury.\r\n\r\nRFID-destroyers (such as this highly impressive project), though, which Greenfield also mentions, certainly are fightback devices, and as he notes in Thesis 79, an arms race may well develop, which ultimately will only serve to enshrine the mindset of control further into the technology, with less chance for us to disentangle the ethics from the technical measures.\r\n\r\nConclusion\r\n\r\nOverall, this is a most impressive book which clearly leads the reader through the implications of ubiquitous computing, and the issues surrounding its development and deployment in a very logical style (the \’series of theses\’ method helps in this: each point is carefully developed from the last and there\’s very little need to flick between different sections to cross-reference ideas). The book\’s structure has been designed, which is pleasing. Everyware has provided a lot of food for thought from my point of view, and I\’d recommend it to anyone with an interest in technology and the future of our society. Everyware, in some form, is inevitable, and it\’s essential that designers, technologists and policy-makers educate themselves right now about the issues. Greenfield\’s book is an excellent primer on the subject which ought to be on every designer\’s bookshelf.\r\n\r\nFinally, I thought it was appropriate to dig up that Gilles Deleuze quote again, since this really does seem a prescient description for the possibility of a more \’negative\’ form of everyware:\r\n\r\n

“The progressive and dispersed installation of a new system of domination.”

‘

The survey is ongoing throughout the summer with more articles to be added, but based on the current responses, I can find only two commentators who touch on the issue of technology being used to restrict and control public freedom. Don Braben, of the Venture Research Group, comments that:

“The most important threat by far comes to us today from the insidious tides of bureaucracy because they strangle human ingenuity and undermine our very ability to cope. Unless we can find effective ways of liberating our pioneers within about a decade or so, the economic imperatives mean that society’s breakdown could be imminent.”

However, it’s Matthew Parris who hits the nail on the head:

“Resist the arguments for increasing state control of individual lives and identities, and relentless information gathering. Info-tech will be handing autocrats and governments astonishing new possibilities: this is one technological advance which does need to be watched, limited and sometimes resisted.”