Archive
Security

Security is about preventing adverse consequences from the intentional and unwarranted actions of others. What this definition basically means is that we want people to behave in a certain way… and security is a way of ensuring that they do so.

Bruce Schneier, Beyond Fear

A simpler way of thinking about Interaction Designers is that they are the shapers of behavior. Interaction Designers… all attempt to understand and shape human behavior. This is the purpose of the profession: to change the way people behave.


Jon Kolko
, Thoughts on Interaction Design

(Italic emphases are original; bold emphases are mine)

It’s interesting to see such similar language used in two fields which are rarely seen as related. But they are, of course: they are about human interaction with technology. To some extent, security – certainly the design of countermeasures – may be a rigorous, analytical subset of interaction design, just as interaction design is a subset of the intersection of technology and psychology. Designers in one field ought to be able to learn usefully from those in others.

Interaction design is not commonly defined as Jon Kolko does above – it was reading that specific quote on his website which persuaded me to buy his book – but it’s pretty close to the idea of design with intent.

Read More

IDPS : Miquel Mora
Image from Miquel Mora’s website

We’ve looked before at a number of technologies and products aimed at ‘preventing’ photography and image recording in some way, from censoring photographs of ‘copyrighted content’ and banknotes, to Georgia Tech’s CCD-flooding system.

Usually these systems are about locking out the public, or removing freedoms in some way (a lot of organisations seem to fear photography), but a few ‘fightback’ devices have been produced, aiming to empower the individual against others (e.g. Hewlett-Packard’s ‘paparazzi-proof’ camera) or against authority (e.g. the Backflash system intended to render a car number plate unreadable when photographed by a speed camera). The field of sousveillance – lots of interesting articles by Régine Debatty here – is also a ‘fightback’ in a parallel vein.

Taking the fightback idea further, into the realms of everyware, Miquel Mora’s IDentity Protection System, shown last month at the RCA’s Great Exhibition (many thanks to Katrin Svabo Bech for the tip-off), aims to offer the individual a way to control how his or her image is recorded – again, Régine from We Make Money Not Art:

With IDPS (IDentity Protection System), interaction designer Miquel Mora is proposing a new way to protect our visual identity from the invasion of ubiquitous surveillance cameras. He had a heap of green stickers that could stick to your jacket. Or anywhere else. The sticker blurred your image on the video screen.

“With the IDPS project I wanted to sparkle [sic.] debate about all the issues related to identity privacy,” explains Miquel. “Make people think about how our society has become a complete surveillance machine. Our identities have already been stored as data in many servers ready to be tracked. And our self image is our last resort. So we really need tools to protect our privacy. We need tools that can allow us to hide or reveal our visual image. We must have the control over it.”

“For example in one scenario a girl is wearing a tooth jewellery with IDPS technology embedded. So when she smiles she reveals it and it triggers the camera to protect her. With IDPS users can always feel comfortable, knowing that with a simple gesture like smiling, they are in control. The IDPS technology could be embedded in all kind of items, from simple badges to clothes or jewellery. For the working prototype I’m using Processing to track the stickers and pixelate the image around when it founds one.”

IDPS : Miquel Mora
Image from Miquel Mora’s website

While the use of stickers or similar tags (why not RFID?) which can be embedded in items such as jewellery is a very neat idea aesthetically, I am not sure what economic/legal incentive would drive CCTV operators or manufacturers to include something such as IDPS in their systems and respect the wishes of users. CCTV operators generally do not want anyone to be able to exclude him or herself from being monitored and recorded, whether that’s by wearing a hoodie or a smart black hat with maroon ribbon. Or indeed a veil of some kind.

Something which actively fought back against unwanted CCTV or other surveillance intrusion, such as reversing the Georgia Tech system in some way (e.g. detecting the CCD of a digital security camera, and sending a laser to blind it temporarily, or perhaps some kind of UV strobe) would perhaps be more likely to ‘succeed’, although I’m not sure how legal it would be. Still, with RCA-quality interaction designers homing in on these kinds of issues, I think we’re going to see some very interesting concepts and solutions in the years ahead…

Read More

Engineering Mathematics, by K Stroud

Mr Person at Text Savvy looks at an example of ‘Guided Practice’ in a maths textbook – the ‘guidance’ actually requiring attention from the teacher before the students can move on to working independently – and asks whether some type of architecture of control (a forcing function perhaps) would improve the situation, by making sure (to some extent) that each student understood what’s going on before being able to continue:

Image from Text Savvy
Image from Text Savvy
Is there room here for an architecture of control, which can make Guided Practice live up to its name?

This is a very interesting problem. Of course, learning software could prevent the student moving to the next screen until the correct answer is entered in a box. This must have been done hundreds of times in educational software, perhaps combined with tooltips (or the equivalent) that explain what the error is, or how to think differently to solve it – something like the following (I’ve just mocked this up, apologies for the hideous design):

Greyed-out Next button as a forcing function

The ‘Next’ button is greyed out to prevent the student advancing to the next problem until this one is correctly solved, and the deformed speech bubble thing gives a hint on how to think about correcting the error.

But just as a teacher doesn’t know absolutely if a student has really worked out the answer for him/herself, or copied it from another student, or guessed it, so the software doesn’t ‘know’ that the student has really solved the problem in the ‘correct’ way. (Certainly in my mock-up above, it wouldn’t be too difficult to guess the answer without having any understanding of the principle involved. We might say, “Well, implement a ’3 wrong answers and you’re out’ policy to stop guessing,” but how does that actually help the student learn? I’ll return to this point later.)

Blind spots in understanding

I think that brings us to something which, frankly, worried me a lot when I was a kid, and still intrigues (and scares) me today: no-one can ever really know how (or how well) someone else ‘understands’ something.

What do I mean by that?

I think we all, if we’re honest, will admit to having areas of knowledge / expertise / understanding on which we’re woolly, ignorant, or with which we are not fully at ease. Sometimes the lack of knowledge actually scares us; other times it’s merely embarrassing.

For many people, maths (anything beyond simple arithmetic) is something to be feared. For others, it’s practical stuff such as car maintenance, household wiring, and so on. Medicine and medical stuff worries me, because I have never made the effort to learn enough about it, and it’s something that could affect me in a major way; equally, I’m pretty ignorant of a lot of literature, poetry and fine art, but that’s embarrassing rather than worrying.

Think for yourself: which areas of knowledge are outside your domain, and does your lack of understanding scare/intimidate you, or just embarrass you? Or don’t you mind either way?

Bringing this back to education, think back to exams, tests and other assessments you’ve taken in your life. How much did you “get away with”? Be honest. How many aspects did you fail to understand, yet still get away without confronting? In some universities in the UK, for instance, the pass mark for exams and courses is 40%. That may be an extreme, and it doesn’t necessarily follow that some students actually fail to understand 60% of what they’re taught and still pass, but it does mean that a lot of people are ‘qualified’ without fully understanding aspects of their own subject.

What’s also important is that even if everyone in the class got, say, 75% right, that 75% understanding would be different for each person: if we had four questions, A, B, C and D, some people would get A, B, and C right and D wrong; others A, B, D right and C wrong, and so on. Overall, the ‘understanding in common’ among a sample of students would be nowhere near 75%. It might, in fact, be small. And even if two students have both got the same answer right, they may ‘understand’ the issue differently, and may not be able to understand how the other one understands it. How does a teacher cope with this? How can a textbook handle it? How should assessors handle it?

I’ll admit something here. I never ‘liked’ algebraic factorisation when I was doing GCSE (age 14-15) A-level (16-17) or engineering degree level maths – I could work out that, say, (2x² + 2)(3x + 5)(x – 1) = 6x^4 + 4x³ – 4x² + 4x – 10 (I think! I don’t think there’s an HTML character code for a superscript 4, sorry), but there’s no way I could have done that in reverse, extracting the factors (2x² + 2)(3x + 5)(x – 1) from the expanded expression, other than by laborious trial and error. Something in my mathematical understanding made me ‘unable’ to do this, but I still got away with it, and other than meaning I wasted a bit more time in exams, I don’t think this blind spot affected me too much.

OK, that’s an excessively boring example, but there must be many much, much worse examples where an understanding blind spot has actually adversely affected a situation, or the competence of a whole company or project. Just reading sites such as Ben Goldacre’s Bad Science (where some shocking scientific misunderstandings and nonsense are highlighted) or even SharkTank (where some dreadful IT misunderstandings, often by management, are chronicled) or any number of other collections of failures, shows very clearly that there are a lot of people in influential positions, with great power and resources at their fingertips, who have significant knowledge and understanding blind spots even within domains with which they are supposedly professionally involved.

Forcing functions in textbooks

Back to education again, then: assuming that we agree that incompetence is bad, then gaps in understanding are important to resolve, or at least to investigate. How well can a teaching system or textbook be designed to make sure students really understand what they’re doing?

Putting mistake-proofing (poka-yoke) or forcing functions into conventional paper textbooks is much harder than doing it in software, but there are ways of doing it. A few years ago, I remember coming across a couple of late-1960s SI Metric training manuals which claimed to be able to “convert” the way the reader thought (i.e. Imperial to SI) through a “unique” method, which was quoted on the cover (in rather direct language) as something like “You make a mistake: you are CORRECTED. You fail to grasp a fundamental concept: you CANNOT proceed.” The way this was accomplished was simply by, similarly to (but not the same as) the classic Choose Your Own Adventure method, having multiple routes through the book, with the ‘page numbers’ being a three digit code generated by the student based on the answers to the questions on the current page. I’ve tried to mock up (from distant memory) the top and bottom sections of a typical page:

Mock-up of a 1960s 'guided learning' textbook

In effect, the instructions routed the student back and forth through the book based on the level of understanding demonstrated by answering the questions: a kind of flow chart or algorithm implemented in a paperback book, and with little incentive to ‘cheat’ since it was not obvious how far through the book one was. (Of course, the ‘length’ of the book would differ for different students depending on how well they did in the exercises they did.) There were no answers to look up: proceeding to whatever next stage was appropriate would show the student whether he/she had understood the concept correctly.

When I can find the books again (along with a lot of my old books, I don’t have them with me where I’m living at present), I will certainly post up some real images on the blog, and explain the system further. (It’s frustrating me now as I type this early on a Sunday morning that I can’t remember the name of the publisher: there may well already be an enthusiasts’ website devoted to them. Of course, I can remember the cover design pretty well, with wide sans-serif capital letters on striped blue/white and murky green/white backgrounds; I guess that’s why I’m a designer!)

A weaker way of achieving a ‘mistake-proofing’ effect is to use the output of one page (the result of the calculation) as the input of the next page’s calculation, wherever possible, and confirm it at that point so that the student’s understanding at each stage is either confirmed or shown to be erroneous. So long as the student has to display his/her working, there is little opportunity to ‘cheat’ by turning the page to get the answer. No marks would be awarded for the actual answer; only for the working to reach it, and a student who just cannot understand what’s going wrong with one part of the exercise can go on to the next part with the starting value already known. This would also make marking the exercise much quicker for the teacher, since he or she does not have to follow through the entire working with incorrect values as often happens where a student has got a wrong value very early on in a major series of calculations (I’ve been that student; I had a very patient lecturer once who worked through an 18-side set of my calculations about a belt-driven lawnmower which all had wrong values, based on something I got wrong on the first page.)

Overall, the field of ‘control’ as a way of checking (or assisting) understanding is clearly worth much further consideration. Perhaps there are better ways of recognising users’ blind spots and helping resolve them before problems occur which depend on that knowledge. I’m sure I’ll have more to say too, at a later point, on the issue of widespread ignorance of certain subjects, and gaps in understanding and their effects; it would be interesting to hear readers’ thoughts, though.

Footnote: Security comparison

We saw earlier that there seems to be little point in educational software limiting the number of guesses a student can have at the answer, at least when the student isn’t allowed to proceed until the correct answer is entered. I’m not saying any credit should be awarded for simply guessing (it probably shouldn’t), just that deliberately restricting progress isn’t usually desirable in education. But it is in security: indeed that’s what most password and PIN implementations use. Regular readers of the blog will know that the work of security researchers such as Bruce Schneier, Ross Anderson, Ed Felten and Alex Halderman is frequently mentioned, often in relation to digital rights management, but looking at forcing functions in an educational context also shows how relevant security research is to other areas of design. Security techniques say “don’t let that happen until this has happened”; so do many architectures of control.

Read More

The figure of the Martian devil looms over London: from Quatermass & The Pit, 1958
The figure of a Martian devil looms over London*: from Quatermass & The Pit, 1958, written by the late Nigel Kneale

A couple of years ago, after seeing a programme by Jon Ronson, I was reading about the First Earth Battalion and came across a link to an apparently real document, Nonlethal Weapons: Terms and References, edited by Robert J Bunker of the Institute for National Security Studies at the USAF Academy, Colorado. It’s available on the Memory Hole, here.

Amid the various physical, physiological and psychological techniques described (some of which I’ll be looking at in later posts, as they’re pertinent to architectures of control), one section especially stood out – from page 15 of the document:

K. Holograms. Hologram, Death: Hologram used to scare a target individual to death. Example, a drug lord with a weak heart sees the ghost of his dead rival appearing at his bedside and dies of fright. Hologram, Prophet: The projection of the image of an ancient god over an enemy capitol whose public communications have been seized and used against it in a massive psychological operation. Hologram, Soldier-forces: The projection of soldier-force images which make an opponent think more allied forces exist than actually do, make an opponent believe that allied forces are located in a region where none actually exist, and /or provide false targets for his weapons to fire upon. New concept developed in this document.

Now, these are interesting techniques. I don’t know if ‘hologram’ is being used in the right way here, since these sound like simple projections, e.g. onto clouds (or maybe, in the case of the ‘ghost’ appearing next to the drug lord’s bedside, some kind of volumetric display). And whether such projections would really work in terms of scaring or misleading the enemy – who knows?

Have they ever actually been used? Dummy tanks are a well-known way of deceiving an enemy, but would people be taken in by a “projection of the image of an ancient god”? How would they know that what they were seeing was the “ancient god”? If the image used were such a common representation that it was instantly recognisable, wouldn’t it seem obviously fake? Or would any giant figure looming over a city scare people sufficiently, whether or not they realised what it was supposed to represent? (It’s been suggested that the Angels of Mons, if they existed, may have been “images of angels that the Germans had projected onto the clouds at the outbreak of the battle in order to try and scare the troops on the opposite side…But apparently this idea had backfired, in that the troops had seen these images and believed them to be St George, Joan of Arc, actually leading them against the Germans.”)

The projection of “soldier-force images” has more credibility. Odd atmospheric effects seem to be the explanation behind the various reflected “cities in the sky” that have occasionally been seen: taking this further, it is surely possible to create a mirage-like effect of a massed army to intimidate an enemy.

So, outside of the military context, is there potential for this kind of false image to be used to manipulate and control the public? Not obviously, perhaps, but as the police in many countries become increasingly militarised in outlook (particularly in “security” situations), would the tactic of projecting images of massed officers (maybe with riot shields covering their faces, to make extensive detail less necessary) be considered? Cardboard cutout police cars are occasionally used to scare motorists, as are fake speed cameras (often placed by members of the public) and, of course, fake CCTV cameras.

It also makes me wonder what the legality is of members of the public projecting images onto buildings, clouds, etc. Much of this so far has been done for promotional reasons – e.g. FHM‘s projection of Gail Porter onto the Houses of Parliament – or a technology college in Surrey, the day after A-level results:

“While projection on to a building is not illegal as such, you will be asked to move on by the police because laser projection is viewed as a distraction to drivers and hence a hazard,” says Dominic Bean, formerly head of marketing and business Development at NESCOT. He used projections to promote North East Surrey College of Technology and found that the response from the authorities was far from harsh. “Policemen on Epsom Downs (ten miles away from the projection site) spotted our projection on to Tolworth Towers – near the A3 in Surrey,” says Bean. “It took them nearly 50 minutes to drive over and ask for the image to be removed. They were amazed to see it, and saw the ‘fun’ side.

Guerrilla ‘photon bombing’ or ‘projection bombing’ clearly has a lot of potential for allowing members of the public, activists and counterculture groups to promote their messages, but so far doesn’t appear to have been used for truly subversive ends on a large scale. There is some very clever work going on in this field, such as Troika’s SMS Guerilla Projector, but imagine a politician’s press conference where giant images of his opponent or opposing slogans are projected behind him, or a televised sports event where logos of the sponsor’s rivals are projected (by someone in the crowd) onto the faces of players being shown in close-up. It may have already happened; if not, it won’t be long before it does.

Read More

The criminology students at Cambridge have an excellent view of dystopian architecture

Bruce Schneier talks about ‘Architecture and Security’: architectural decisions based on the immediate fear of certain threats (e.g. car bombs, rioters) continuing to affect users of the buildings long afterwards. And he makes the connexion to architectures of control outside of the built environment, too:

“The same thing can be seen in cyberspace as well. In his book, Code and Other Laws of Cyberspace, Lawrence Lessig describes how decisions about technological infrastructure — the architecture of the internet — become embedded and then impracticable to change. Whether it’s technologies to prevent file copying, limit anonymity, record our digital habits for later investigation or reduce interoperability and strengthen monopoly positions, once technologies based on these security concerns become standard it will take decades to undo them.

It’s dangerously shortsighted to make architectural decisions based on the threat of the moment without regard to the long-term consequences of those decisions.”

Indeed.

The commenters detail a fantastic array of ‘disciplinary architecture‘ examples, including:

  • Pierce Hall, University of Chicago, “built to be “riotproof” by elevating the residence part of the dorm on large concrete pillars and developing chokepoints in the entranceways so that rioting mobs couldn’t force their way through.” (There must be lots of university buildings like this)
  • “The Atlanta Fed building has a beautiful lawn which surrounds the building, and is raised 4 or 5 feet from the surrounding street, with a granite restraining wall. It’s a very effective protection against truck bombs.”
  • The wide boulevards of Baron Haussmann’s Paris, intended to prevent barricading (a frequently invoked example on this blog)
  • The UK Ministry of Defence’s Defence Procurement Agency site at Abbey Wood, Bristol, “is split into car-side and buildings; all parking is as far away from the buildings (car bomb defence), especially the visitor section. you have to walk over a narrow footbridge to get in.

    Between the buildings and the (no parking enforced by armed police) road is ‘lake’. This stops suicide bomber raids without the ugliness of the concrete barriers.

    What we effectively have is a modern variant of an old castle. The lake supplants the moat, but it and the narrow choke point/drawbridge.”

  • SUNY Binghamton’s “College in the Woods, a dorm community… features concrete “quads” with steps breaking them into multiple levels to prevent charges; extremely steep, but very wide, stairs, to make it difficult to defend the central quad”
  • University of Texas at Austin: “The west mall (next to the Union) used to be open and grassy. They paved it over with pebble-y pavement to make it painful for hippies to walk barefoot and installed giant planters to break up the space. They also installed those concrete walls along Guadalupe (the drag) to create a barrier between town and gown, and many other “improvements.”"
  • I’m especially amused by the “making it painful for hippies to walk barefoot” comment! This is not too far from the anti-skateboarding corrugation sometimes used (e.g. the third photo here), though it seems that in our current era, there is a more obvious disconnect between ‘security’ architecture (which may also involve vast surveillance or everyware networks, such as the City of London’s Ring of Steel) and that aimed at stopping ‘anti-social’ behaviour, such as homeless people sleeping, skateboarders, or just young people congregating.

    Read More

    Image from Flickr user Monkeys & Kiwis

    Image from Monkeys & Kiwis (Flickr)

    Chris Weightman let me know about how it felt to watch last Thursday’s iPod Flashmob at London’s Liverpool Street station: the dominant sense was of a mass of people overturning the ‘prescribed’ behaviour designed into an environment, and turning the area into their own canvas, overlaying individualised, externally silent experiences on the usual commuter traffic.

    Probably wouldn’t get away with that sort of thing at an airport any more anyway, but what will happen to this kind of informal gathering in the era of the societies of control? When everyware monitors exactly who’s where and forces the barriers closed for anyone hoping to use the space for something other than that for which it was intended?

    Read More

    @danlockton

    Error: Twitter did not respond. Please wait a few minutes and refresh this page.

    Upcoming talks & events

    I'm speaking or running workshops at:

    Some of my previous presentations

    Comments & trackbacks

    Blog 2005-date