1
00:00:01,120 --> 00:00:03,020
Oh, I guess it is.

2
00:00:03,820 --> 00:00:05,180
I guess it is.

3
00:00:05,180 --> 00:00:06,140
There we go.

4
00:00:06,140 --> 00:00:07,060
Awesome.

5
00:00:07,060 --> 00:00:14,660
Because as we were just sitting here joking, we're like, uh, this is absolutely the slot to see who made it to bed early.

6
00:00:14,660 --> 00:00:18,600
And who has already, ooh, and now I'm everywhere.

7
00:00:18,700 --> 00:00:20,500
This is awesome.

8
00:00:20,500 --> 00:00:23,360
We called it the hangover slot.

9
00:00:23,360 --> 00:00:24,660
So welcome.

10
00:00:24,880 --> 00:00:25,760
Yeah.

11
00:00:25,980 --> 00:00:31,240
And of course we only have one microphone, so the good news is that works better.

12
00:00:31,320 --> 00:00:33,300
So welcome, everyone.

13
00:00:33,640 --> 00:00:40,640
And we're going to take a little bit of a different approach, I guess, than just presentation slash panel.

14
00:00:40,780 --> 00:00:59,540
Because one of the issues with this is it's an evolving space when we're talking about the data and the privacy and all the issues with, I mean, if you ask anyone to define as Britton's going to talk about, like, some of the aspects of the data privacy in XR.

15
00:00:59,540 --> 00:01:06,520
I mean, we don't even have a common definition for some of the technology, so then how are you going to define what it's doing?

16
00:01:06,620 --> 00:01:17,280
So I'm Liz, and this is Britton, and we're going to talk, first Britton's going to lay a great foundation and give us a framework from which to have a discussion.

17
00:01:17,300 --> 00:01:34,780
And then the idea is we'll talk amongst ourselves, and then once y'all have had an opportunity to wake up, get the brain cells firing, then we thought we would open it up to a conversation and questions from the group.

18
00:01:34,780 --> 00:01:45,720
So , bear with us, and I'm going to let a much smarter person than I introduce the topic and explain a little bit of where some of the challenges lie.

19
00:01:48,740 --> 00:01:51,320
Question one, can you hear me?

20
00:01:51,600 --> 00:01:52,560
Awesome.

21
00:01:52,620 --> 00:01:56,080
Question two, who's heard of Lego Universe?

22
00:01:57,540 --> 00:02:04,390
Alright, I have a salty story for your Sunday morning about Lego Universe.

23
00:02:05,120 --> 00:02:16,250
Lego Universe was a highly anticipated massive multiplayer online game, like Roblox, Minecraft, that ended up being shuttered.

24
00:02:16,960 --> 00:02:27,100
The experience looked great, and the company was really looking to allow users to build their own type of content and their own environments.

25
00:02:27,400 --> 00:02:35,580
But given how utterly trusted Lego was as a brand , they committed to whitelisting content before it went live.

26
00:02:35,580 --> 00:02:40,360
So they were going to preview everything to make sure it was safe for you and your kids.

27
00:02:40,680 --> 00:02:50,660
The only problem was that there's a term in content moderation that Lego did not think about, and it's called time to penis.

28
00:02:51,120 --> 00:03:03,400
Time to penis literally means the duration between a person entering a virtual world and adult content appearing in that virtual space.

29
00:03:03,500 --> 00:03:08,560
And with all puns intended for Lego Universe, the time to penis was not very long.

30
00:03:10,520 --> 00:03:26,480
Lego needed, amongst other things, to figure out an automated, scalable, economical way to prevent teenagers and kids from drawing penises in the virtual world, and they couldn't do it.

31
00:03:26,740 --> 00:03:32,200
It became a wide-scale problem, and it actually ended up killing the project.

32
00:03:33,220 --> 00:03:36,520
This is not an unusual story.

33
00:03:36,540 --> 00:03:47,440
Many companies find that their expectations about governing and moderating user behavior and user data flows and spatial computing are turned on their head.

34
00:03:48,440 --> 00:03:54,120
My name is Britton Heller, and I like to describe myself as the lawyer of the black mirror.

35
00:03:54,760 --> 00:04:03,060
I am a visiting scholar at the Virtual Human Interaction Lab at Stanford University, and I teach international law and AI policy.

36
00:04:03,060 --> 00:04:07,060
And I've been focusing on immersive environments for about seven years.

37
00:04:08,260 --> 00:04:12,060
There are three things that I would like you to take away today.

38
00:04:12,400 --> 00:04:18,970
One, immersive media has a different impact on our bodies and our minds.

39
00:04:19,680 --> 00:04:24,700
And this is what differentiates it from flat-screen social media.

40
00:04:24,920 --> 00:04:30,080
Existing privacy law does not accommodate for this.

41
00:04:30,600 --> 00:04:47,260
Two, the different technical stacks between flat-screen social media and immersive content mean that we have different layers of enforcement when you're looking at behavioral tracking and modification in XR.

42
00:04:48,020 --> 00:04:50,640
And three, AI will not save us.

43
00:04:50,640 --> 00:04:52,580
And that one is worth repeating twice.

44
00:04:52,580 --> 00:04:55,300
AI will not save us.

45
00:04:55,640 --> 00:05:09,280
Overall, the systems that we create in 3D environments are fundamentally different from 2D environments because of the technical stack, the potential impact on users, and the uninformed state of the law.

46
00:05:09,720 --> 00:05:11,860
This leads us to three questions.

47
00:05:11,860 --> 00:05:15,520
What kinds of data flows do you get from XR environments?

48
00:05:15,520 --> 00:05:18,420
What does this mean for business models and the law?

49
00:05:18,420 --> 00:05:20,500
And why does this matter to users?

50
00:05:23,180 --> 00:05:29,560
Imagine that you and I are playing a race car-oriented game in XR.

51
00:05:30,200 --> 00:05:35,160
And I see this red McLaren, and I really, really like this car.

52
00:05:35,160 --> 00:05:40,460
I was going to say a Tesla, but the one that they're hacking over there, I don't know if it's actually going to be able to drive after this week.

53
00:05:40,600 --> 00:05:42,420
So, I like the Tesla.

54
00:05:42,420 --> 00:05:43,500
I like McLaren.

55
00:05:43,500 --> 00:05:44,760
You can like the Tesla.

56
00:05:46,340 --> 00:05:52,460
When I see this car, my body starts to physiologically react to my pleasure.

57
00:05:52,780 --> 00:05:55,160
So, my heart rate goes up a little bit.

58
00:05:55,160 --> 00:05:57,260
My skin gets a little more moist.

59
00:05:57,260 --> 00:05:59,060
My pupils dilate.

60
00:05:59,180 --> 00:06:00,860
I really like this car.

61
00:06:01,860 --> 00:06:13,180
Later on, as we're walking around the conference, and we go into a different experience, I see a similar red car drive by, driven by someone who looks more than a little bit like me.

62
00:06:13,980 --> 00:06:23,340
I go to a virtual sports bar, and someone who looks exactly like my crush says, isn't it a great time to buy a new car right now?

63
00:06:23,800 --> 00:06:31,180
I go to my email, and I start getting targeted ads from Geico about why I should re-up my car insurance.

64
00:06:31,980 --> 00:06:38,420
This sounds like science fiction, but the framework for it actually already exists.

65
00:06:38,440 --> 00:06:46,940
Companies have been putting advertisements in XR environments since 2021, I believe it was announced.

66
00:06:46,940 --> 00:06:53,180
And I've written papers about how advertisements in immersive contexts are actually experiential.

67
00:06:53,400 --> 00:06:55,240
They don't look like billboards.

68
00:06:55,240 --> 00:06:59,400
You actually pay for the privilege of having the car advertised to you.

69
00:07:00,380 --> 00:07:08,920
I developed a term called biometric psychography to describe the potential for this harm.

70
00:07:09,300 --> 00:07:19,680
Where your likes, dislikes, and consumer preferences are married with your physiological reactions, often involuntary.

71
00:07:20,280 --> 00:07:22,240
This is not against the law.

72
00:07:22,620 --> 00:07:28,880
This is not covered by normal privacy law, because privacy law covers your personal identifying information.

73
00:07:29,420 --> 00:07:33,560
And when you and I entered into the game, I had a verifiable billing address.

74
00:07:33,560 --> 00:07:36,620
I had a user account with my authentic identity.

75
00:07:36,620 --> 00:07:38,040
The companies know who we are.

76
00:07:38,040 --> 00:07:39,860
That's not what's at issue.

77
00:07:40,060 --> 00:07:47,680
It's the inferences about our behavior and our physiology and our preferences that are really at risk.

78
00:07:48,160 --> 00:07:51,520
So, it's your mental privacy, not your identity.

79
00:07:51,660 --> 00:07:55,660
So, privacy law is not the right regime to deal with this.

80
00:07:57,680 --> 00:08:07,640
It actually makes me a little bit upset, because I'm a lawyer, and I'm like, I don't like it when new technologies are a misfit with existing law.

81
00:08:13,140 --> 00:08:26,940
Because there are different psychological and neurological impacts than socializing with people in video game worlds, I'd like to review the three characteristics that make something immersive.

82
00:08:27,060 --> 00:08:34,380
And I think that when you understand this, you really get that this is not flat screen media anymore.

83
00:08:34,860 --> 00:08:36,720
First is presence.

84
00:08:37,260 --> 00:08:44,710
Presence has been studied in communications departments for decades, and formally it's called the illusion of non-mediation.

85
00:08:45,740 --> 00:08:49,760
When you go into an XR environment, it feels real.

86
00:08:51,200 --> 00:08:59,540
The first thing that we do at the Virtual Human Interaction Lab when we have somebody visit is I have them walk the plank.

87
00:09:00,200 --> 00:09:23,980
I put them in an experience where they are over a chasm and they are walking along the plank because nothing brings the feeling of presence to you more acutely than feeling that vertigo and feeling your heart rate rise and seeing how your physiology reacts to the screens and the spatial audio and the impact to show you that this is not a Twitter feed,

88
00:09:23,980 --> 00:09:28,460
this is not Facebook, and therefore maybe we shouldn't be regulating it in the same way.

89
00:09:32,230 --> 00:09:41,770
Jeremy Bailenson, who is the founding director of the lab, says we should think of VR not as a media experience but closer to an actual experience.

90
00:09:42,030 --> 00:09:51,350
And the visceral pit in your stomach you get when you have fear of heights, that's what that is.

91
00:09:52,650 --> 00:10:03,570
And we do that before talking about empathy and education and all of the other benefits of VR so that people understand its power.

92
00:10:04,010 --> 00:10:09,330
Second is immersion, and that's when users really feel like they're in a virtual environment.

93
00:10:09,870 --> 00:10:16,290
A virtual violin performance has to have all of the trappings of watching a performance in an actual theater.

94
00:10:16,470 --> 00:10:22,530
Different views from different seats, different movement flows through aisles, spatially oriented sound.

95
00:10:22,670 --> 00:10:35,520
So it's the way that XR experiences use your sensory input to stimulate the user through light, sound, sense, tactile input.

96
00:10:36,000 --> 00:10:41,360
Finally there's embodiment, and this is my favorite one because it reminds me of Looney Tunes.

97
00:10:42,240 --> 00:10:48,150
Embodiment is the feeling like your avatar or your virtual body is your actual body.

98
00:10:48,760 --> 00:10:56,840
And a researcher named Mel Slater took a famous social psychology experiment called the rubber hand experiment.

99
00:10:57,420 --> 00:11:09,780
And he had people look down in VR and see a rubber hand placed in front of them, and then proceeded to go Looney Tunes on it, to hit it with a mallet , to stab it, to really abuse the virtual arm.

100
00:11:09,940 --> 00:11:19,440
And when you watch the recordings of these, you can find them on YouTube, people scream, people jump, people react like it's their actual arm .

101
00:11:21,500 --> 00:11:36,020
This is the power of embodiment, and it can be beneficial in medical applications if somebody has phantom limb pain where you want to show them an arm that is not theirs, and have their brain actually associate what happens to that with their physiognomy.

102
00:11:36,120 --> 00:11:44,820
But it also can place users at risk considering the violence and other user harms that we're starting to see emerge in XR.

103
00:11:46,440 --> 00:11:50,920
So if this feels so real to our bodies, what does it do to our minds?

104
00:11:52,540 --> 00:12:01,780
Tom Furness, who is one of the inventors of VR headsets, says that when something happens to you in XR, it's like it's imprinted on your brain in permanent ink.

105
00:12:02,880 --> 00:12:14,100
The experiences that you have in a virtual environment are processed through your hippocampus in the same way that you create memories, like you and I sitting here having a conversation today.

106
00:12:15,840 --> 00:12:25,960
It's more like entering somebody's living room and screaming in their face than it is reading critical words on Facebook or Twitter.

107
00:12:27,440 --> 00:12:40,460
Because of how XR impacts our bodies and our minds, it's a mistake to just cut and paste terms of service from flat screen social media and presume that they're going to do the same thing.

108
00:12:40,460 --> 00:12:45,060
And that sounds really obvious, but that's what a lot of companies are doing these days.

109
00:12:46,360 --> 00:12:52,160
Second, I promised we'd talk about different stack layers and moderation vectors in spatial computing.

110
00:12:53,360 --> 00:13:02,280
What that means in normal people speak is that when you do content moderation on Facebook or Twitter, you look at two things, conduct and content.

111
00:13:03,080 --> 00:13:10,620
When you move from a 2D to a 3D environment, you have to look at content, conduct and environment.

112
00:13:10,620 --> 00:13:19,700
So the architecture of your world, like we talked about with the penises in Lego Universe, becomes a moderation factor.

113
00:13:19,700 --> 00:13:25,380
One that you don't have when you have a text-based social media environment.

114
00:13:27,700 --> 00:13:34,380
That means that there are actually different ways to mess with people in XR worlds.

115
00:13:34,380 --> 00:13:36,560
I like to think about spam.

116
00:13:36,680 --> 00:13:39,960
And how does spam translate into XR?

117
00:13:40,500 --> 00:13:45,180
Pretend you and I are tired of my sports car, so we go to a sports bar.

118
00:13:46,160 --> 00:13:49,600
And in the sports bar, I can buy Liz a beer.

119
00:13:50,320 --> 00:14:01,540
I don't want Liz coming to my bar though, or playing on my pool table, so I buy her so many beers that it fills up the virtual pool table and she can't play the game.

120
00:14:03,260 --> 00:14:16,640
Impeding a user's gameplay in an XR environment is the functional equivalent to spam in a flat screen computing environment, but it would never be defined as such if you didn't think about it in three dimensions.

121
00:14:22,160 --> 00:14:26,200
I'm going to skip a little bit ahead because we have a lot to talk about.

122
00:14:29,400 --> 00:14:41,600
Three , platforms are having a lot of challenges trying to create trust and safety regimes and privacy regimes because of all of these complicating factors.

123
00:14:42,240 --> 00:14:48,400
This is a new form of media with new impacts on your body and mind, you need new rules.

124
00:14:49,340 --> 00:14:56,180
A lot of people ask, why didn't Lego just create a filter to screen out all the penises?

125
00:14:57,160 --> 00:15:08,580
And the answer was that most social media content is moderated by automated filters in an ex-ante fashion, so before it ever hits a flat feed.

126
00:15:08,720 --> 00:15:13,120
Facebook takes 97% of hate speech off before you ever see it.

127
00:15:13,420 --> 00:15:16,700
And the way that they do this is by using classifiers.

128
00:15:17,180 --> 00:15:21,940
So it's basically a huge AI profanity filter.

129
00:15:22,840 --> 00:15:27,040
This is not possible in the XR context yet.

130
00:15:28,600 --> 00:15:40,900
We don't have scalable, affordable, reliable ways to create classifiers for 3D environments.

131
00:15:40,960 --> 00:15:43,860
We don't have the data sets yet to use.

132
00:15:43,860 --> 00:15:52,200
Computer vision is the way that I think we're going to be able to do this, but think about all the different ways you can describe a cat.

133
00:15:53,080 --> 00:16:03,500
We don't have publicly available data sets yet to try to audit what a cat would actually be in its many forms and colors and shapes and sizes.

134
00:16:04,700 --> 00:16:10,640
Currently when companies do content moderation, one, they just don't do it for XR.

135
00:16:10,940 --> 00:16:23,860
Two, they use a voice to text transcription and then run it through social media filters, which does not catch context or behavioral or environmental factors .

136
00:16:24,260 --> 00:16:34,240
Or three , they try to use realtime behavioral tracking , which is just not scalable and puts the burden on users.

137
00:16:37,080 --> 00:16:47,140
When you report a violation in a platform like Horizon Worlds, it takes one to two minutes of content and gives it to the company.

138
00:16:47,500 --> 00:16:53,500
That normally is not enough to determine the context of what's actually happening.

139
00:16:53,560 --> 00:17:02,960
And if you watch videos of people who are reporting abuse happening, you often can't tell who is saying what to whom and what's happening.

140
00:17:02,960 --> 00:17:04,940
Especially in 60 seconds.

141
00:17:07,080 --> 00:17:10,900
Reporting is done differently as well on every different platform.

142
00:17:11,040 --> 00:17:23,680
So that's like if we went to Vegas and you call 911, but then if you went to Henderson and you had to send them a fax, and then if you went to Reno and you had to show up in person.

143
00:17:24,240 --> 00:17:33,760
When you use public safety services, if you had to call for help in a different way in every different city you went to, you would never use 911.

144
00:17:33,760 --> 00:17:42,740
And I think companies are finding that it's the same way if you don't have standardized safety protocols across different XR platforms and XR worlds.

145
00:17:46,410 --> 00:17:59,430
Generative AI looks promising as a tool to help, but it does not yet have the discretion or the contextual understanding necessary to help with the nuance that will be required for helping to modify or govern user behavior.

146
00:18:00,110 --> 00:18:08,630
Realistically, AI based solutions are several years away from having sufficient sophistication, enough data and adequate training to work in spatial environments.

147
00:18:11,700 --> 00:18:18,860
So, overall, the differences between social media and XR are stark.

148
00:18:19,460 --> 00:18:26,880
And they emerge from the interactive features of immersive experiences and the neurological impacts that this has on users.

149
00:18:27,080 --> 00:18:31,380
And this has resulted in violations of what I called the right to mental privacy.

150
00:18:31,620 --> 00:18:35,180
Other scholars in Chile have called this neuro rights.

151
00:18:35,300 --> 00:18:43,220
Brain-computer interface scholars are talking about a battle for your brain.

152
00:18:43,740 --> 00:18:47,580
There's a new book that came out discussing that .

153
00:18:47,580 --> 00:19:13,840
And they're all part and parcel of the same thing where the sanctity of the content of your thoughts and the inferences that can be made about your health and your sexual preferences, your political preferences, your gender, your age, all of these things we can determine from data flows really shouldn't be used to send you advertisements.

154
00:19:14,980 --> 00:19:18,400
If so, I think it's actually a failure of the imagination.

155
00:19:25,340 --> 00:19:28,380
I think that's a good way to turn it to us.

156
00:19:29,940 --> 00:19:38,420
And one of the things that really strikes my mind is it's not just the gaming experience.

157
00:19:38,420 --> 00:19:44,600
This is moving beyond so many different aspects and potential.

158
00:19:44,600 --> 00:19:59,000
So as Britton was talking about, moving into the healthcare environment, that your healthcare will be delivered potentially through this data that is being collected from your physical reactions.

159
00:19:59,000 --> 00:20:04,500
So the questions start to become, is this data painting a correct picture?

160
00:20:04,500 --> 00:20:06,000
Is this the full picture?

161
00:20:06,000 --> 00:20:09,140
Is it picking up on all the nuances?

162
00:20:09,440 --> 00:20:11,700
And who's getting access to that?

163
00:20:11,800 --> 00:20:24,520
And there's a big difference between what I may post on social media at 2am when I am fired up about something and what I would actually say or do.

164
00:20:24,520 --> 00:20:38,740
Or you think of a lot of the, as we saw during remote environments where people were having job interviews over Zoom or other conference calling.

165
00:20:38,800 --> 00:20:47,420
And a lot of it dealt with, there were companies, and some states have started taking a harder look at this, where they were creating biases.

166
00:20:47,420 --> 00:21:08,460
That if you didn't make the proper amount of eye contact, or if it looked like you were distracted during, because the sensors on the screen weren't picking this up properly, that suddenly you were getting penalized during your job interview because you weren't meeting this set standard.

167
00:21:08,460 --> 00:21:29,060
And so now what happens when we take that and all of those AI data sets that are expecting certain behaviors, they're not expecting children to start drawing inappropriate things, which anyone who's been in an elementary school, you should have expected it.

168
00:21:29,060 --> 00:21:37,840
And you should have expected fart jokes, you should have expected lots of poop, and all those different things.

169
00:21:37,840 --> 00:21:49,040
But what happens when we're trying to create protections, and we're trying to do all this with a bias towards, like, we're already starting so far behind.

170
00:21:49,040 --> 00:22:10,280
And now we're taking all these other little cues of how does the VR headset, like how does that experience know that it wasn't because a spider crawled across your foot or someone else in the room thought it would be hilarious to tap you on the shoulder as you were playing the game or ,

171
00:22:10,280 --> 00:22:35,680
or, I'm not saying this has ever happened, I've definitely never done this to someone playing, but what happens if you move furniture while they're in the middle of and suddenly they're tripping over something because it was really freaking funny and it serves them right but suddenly that reaction is getting captured and how do you know that I haven't logged in to Britton's account?

172
00:22:36,000 --> 00:22:48,740
That I'm not playing as her and should I be so lucky to have all the sensors pick up and be like, hmm, you have the same facial structure, you have all this and I'm like, yes I do.

173
00:22:48,820 --> 00:22:50,980
Yes, that's right.

174
00:22:50,980 --> 00:23:02,700
Or, you're just off today or heavens forbid, I think of all the times I've tried to log in to my iPhone and it's like facial recognition, not recognition, I'm like, wait, what?

175
00:23:03,540 --> 00:23:11,500
No, oh my god, are you telling me I didn't get enough sleep last night and suddenly, or oh, god, is my resting bitch face back?

176
00:23:11,500 --> 00:23:13,160
Like, oh, I didn't mean to do that.

177
00:23:13,160 --> 00:23:18,520
So how do regulators and how do you work all those different aspects in?

178
00:23:18,520 --> 00:23:20,340
Because we're already playing catch up.

179
00:23:26,240 --> 00:23:38,780
One of the things that I like to do when I talk to regulators is tell them the type and quality of information you can get about a person from these data flows.

180
00:23:38,780 --> 00:23:41,500
And I realize I didn't mention that before.

181
00:23:41,560 --> 00:24:04,220
There was a study that came out last week this is the absolute newest information from UC Berkeley and the study said that a machine learning model was able to accurately predict the height, weight, age, marital status of a user in XR by the way they moved.

182
00:24:07,770 --> 00:24:21,130
So I know earlier I said that it doesn't go into the realm of personal identifying information, but initial studies are starting to show that you can actually tell somebody's foot size by the way they move.

183
00:24:21,130 --> 00:24:45,810
The lab at Berkeley and the lab at Stanford have had some similar studies and Berkeley came out with a study that said there was 100 seconds of recorded data you could uniquely identify a person in XR with 94% accuracy from a data set of 50,000 people.

184
00:24:46,950 --> 00:24:54,830
Stanford did this earlier but the data set was a couple thousand people, it wasn't statistically significant.

185
00:24:55,350 --> 00:24:57,590
50,000 people.

186
00:24:57,590 --> 00:25:07,390
That might be you in the Taylor Swift crowd by the way that you tilt your head and point can be uniquely identified in an immersive environment.

187
00:25:08,310 --> 00:25:18,350
The type of medical and sort of human rights oriented information that I'm concerned about really is tied into eye tracking.

188
00:25:19,270 --> 00:25:38,170
So the type of information you can get by somebody's pupil reaction you can tell who somebody is sexually attracted to you can tell whether or not somebody is likely to be telling the truth and you can also tell whether or not somebody shows preclinical signs of certain medical ailments like schizophrenia,

189
00:25:38,170 --> 00:25:40,910
ADHD Parkinson's and Huntington's.

190
00:25:41,010 --> 00:25:56,950
These are preclinical signs these are things you may not know about yourself yet, your doctor may not know about you yet and a company if they were to parse the data set would have access to that information.

191
00:25:57,630 --> 00:26:01,290
This is what I mean by the right to mental privacy.

192
00:26:02,150 --> 00:26:17,830
It's not just the content of your thoughts, it's the implications that can be made about who you uniquely are your medical conditions and the type of behaviors that you may choose to engage in or not.

193
00:26:19,950 --> 00:26:36,230
One of the things we're seeing is the states are starting to try to play catch up because, keeping in mind data brokers are taking this information and creating these pictures and they're selling them.

194
00:26:36,290 --> 00:26:46,090
And the regulations really are not keeping up with who should have access to this and how do we protect it.

195
00:26:46,290 --> 00:26:51,410
And it's also what happens if it gets wrong.

196
00:26:51,630 --> 00:26:57,370
That one out of 50,000 it's wrong.

197
00:26:57,610 --> 00:27:05,230
But yet this is now flagged in a file and it's you know as a child you're told this will go down in your permanent record.

198
00:27:05,850 --> 00:27:16,650
Well how do we fix that permanent record when it's our biometric and it's our mental information that, oh wait, you know, objection your honor.

199
00:27:16,650 --> 00:27:19,810
I was just having a bad day and that wasn't me.

200
00:27:20,450 --> 00:27:26,950
Or the, you know, it that was someone else and that piece of information.

201
00:27:26,950 --> 00:27:29,170
So it's not the entire picture that gets off.

202
00:27:29,170 --> 00:27:30,890
It's just one piece.

203
00:27:30,890 --> 00:27:32,350
How do you fix that?

204
00:27:36,970 --> 00:27:38,810
I don't have a good answer for that.

205
00:27:38,810 --> 00:27:40,430
I wish I did.

206
00:27:40,430 --> 00:27:45,970
Because right now these type of data sets aren't auditable by the public.

207
00:27:47,070 --> 00:27:58,090
In certain jurisdictions people are proposing a right to have all your user information about you available, but these are profiles made to sell you something.

208
00:27:58,390 --> 00:28:02,130
It's not an essential part of your user account and things.

209
00:28:02,870 --> 00:28:08,390
Another thing I tell regulators is that you can't outsmart the machine.

210
00:28:08,390 --> 00:28:14,650
Because a lot of them think that somebody advertising something to me, that's obvious.

211
00:28:14,650 --> 00:28:18,630
That's not I'm not going to fall for that.

212
00:28:18,890 --> 00:28:24,910
In XR environments you can actually switch out elements in the environment at blink rate.

213
00:28:27,550 --> 00:28:43,130
It's been done in experimental context but there's nothing saying that you could have somebody with a can of soda and switching out Coke and Pepsi and tracking somebody's more positive reaction to one versus the other.

214
00:28:43,510 --> 00:28:52,830
It's kind of like that social psychology experiment where you're told to count the number of basketball passes and so you miss the gorilla walking in the background.

215
00:28:53,930 --> 00:29:06,450
It's a similar type of a dynamic where people think they're smarter than the system, but the system works faster than you can articulate your preferences or requests cognitively.

216
00:29:07,670 --> 00:29:11,010
And that's a really kind of funky, scary thing.

217
00:29:11,110 --> 00:29:22,110
If you watch sports and Liz is here and I'm back in California, Liz and I will actually see different ads behind the players.

218
00:29:22,950 --> 00:29:30,190
Augmented advertising is already a thing and it's based on your zip code.

219
00:29:31,050 --> 00:29:38,230
And somebody in the stadium will see even different ads than Liz or I would see on different network channels.

220
00:29:38,250 --> 00:29:40,190
They sell this space.

221
00:29:40,410 --> 00:29:49,690
Advertisement in an immersive context is more about targeting and personalization than it is in an offline context.

222
00:29:49,690 --> 00:30:01,710
And that makes sense, but the capacity and the ability to really target it to people makes XR the most persuasive medium that we've developed so far.

223
00:30:03,010 --> 00:30:08,690
And one of the things that we saw and we keep going back to is the data sets.

224
00:30:08,690 --> 00:30:10,230
What is it getting based on?

225
00:30:10,230 --> 00:30:25,010
Where are those data sets getting built from that are creating some of these models and being able to audit it and being able to audit and get to your information and make sure, like, hey, is this the picture that I see?

226
00:30:25,210 --> 00:30:40,610
And basing it on a bias towards, well, English speaking, US based things, when you're talking about an immersive experience that is intended to open up the world.

227
00:30:40,610 --> 00:30:50,110
Like, the idea is that you were playing and you were experiencing things with people in any different physical location.

228
00:30:50,110 --> 00:31:06,490
So now how do you build the rules and even train that it's getting it right when not everyone's going to look the same, react the same and different cultures have built in different mannerisms.

229
00:31:06,890 --> 00:31:16,490
And as we saw with a lot of the, you know, again, even just trying to unlock your iPhone, heavens forbid, you're a woman of color.

230
00:31:16,490 --> 00:31:17,930
Because guess what?

231
00:31:17,930 --> 00:31:22,210
All of the modeling that was based on was not you.

232
00:31:22,350 --> 00:31:23,890
Not even a little bit.

233
00:31:23,890 --> 00:31:26,850
And so they had to go back and say, oops, our bad.

234
00:31:26,910 --> 00:31:45,310
Well now, what do we do when we're talking about collecting all this data and it's like, on the reactions of you know, we talk about a lot in the medical world, a lot of the early training was done and it wasn't done based on women's bodies.

235
00:31:45,570 --> 00:31:53,530
And it wasn't based on... so it's like, oh, well, you're going to react to this medication in the following manners, or these are the following symptoms.

236
00:31:53,530 --> 00:31:57,290
It's like, but no.

237
00:31:57,550 --> 00:31:58,710
I am not.

238
00:31:58,710 --> 00:32:17,770
So now you've got the VR and it's assuming, heavens forbid, I don't want to be a redhead middle aged woman in my, like, I want to be a kick ass like ninja dragon, whatever the hell I want.

239
00:32:18,110 --> 00:32:40,330
So how are we going to start building that and work on regulators when you've got because, again, heavens forbid, heavens forbid that Australia, the US, New Zealand like, insert country, get the upper hand in being the regulator who sets the rules for this.

240
00:32:40,330 --> 00:32:43,410
Because, oh no, we can't let Canada do that.

241
00:32:43,410 --> 00:32:45,750
I mean, they're just nice and maple syrup.

242
00:32:46,450 --> 00:32:59,950
So how do you broach those conversations when you're going all over the world and talking to them and saying, no, no, no, we need to let this country take the lead or play nice with them and not share the data.

243
00:33:06,860 --> 00:33:17,480
If y'all notice, I give Britton all the really hard questions because this is what she gets for being so smart and being a professor, shaping young minds that are creating this future.

244
00:33:17,480 --> 00:33:18,200
So, sorry.

245
00:33:18,220 --> 00:33:21,300
But those aren't young minds, those are like crusty old minds.

246
00:33:21,300 --> 00:33:23,640
That's why I'm like, hmm, about this.

247
00:33:25,080 --> 00:33:29,800
A lot of people in Europe argue that GDPR should cover it.

248
00:33:29,960 --> 00:33:36,180
They argue that Article 1 of GDPR should cover all of the privacy protections for XR and then we're done.

249
00:33:36,460 --> 00:33:38,220
I take issue with that.

250
00:33:38,780 --> 00:33:46,000
Because these are new types of data flows and they're not really anticipated by the regulatory structure.

251
00:33:47,220 --> 00:33:53,540
And they're more akin to medical data to me than they are personal identifying information.

252
00:33:56,800 --> 00:34:10,540
The Future on Privacy Forum just did a really optimistic study where they determined that biometric laws are , biometric laws in the US are covered by state based law.

253
00:34:10,780 --> 00:34:23,080
And if you have a business that creates XR products , you know this because there are certain states you're really, really worried about selling in and certain states you may choose to not release your product in.

254
00:34:23,360 --> 00:34:26,940
And those may be Illinois, Washington, or Texas.

255
00:34:28,200 --> 00:34:39,480
There are other states that have privacy laws, not biometric laws, but you think about, sometimes I talk to regulators and I ask them if they've tried Smell-O-Vision.

256
00:34:40,300 --> 00:34:42,260
And they look at me like I'm nuts.

257
00:34:42,580 --> 00:35:01,020
And I tell them that in the lab and in commercial context now, you can actually go before a campfire in XR and you don't just hear the campfire and you don't just see the campfire, you can actually smell the charcoal and in the lab we put a little toasted marshmallow in there as well just for fun.

258
00:35:01,780 --> 00:35:04,900
You can go into a garden and smell flowers.

259
00:35:06,820 --> 00:35:11,440
These type of inputs are really not anticipated by law .

260
00:35:13,100 --> 00:35:24,780
Also, there was a company that recently released a breath gauge for a meditation app.

261
00:35:25,020 --> 00:35:28,780
And my question for them is is that biometric data?

262
00:35:28,920 --> 00:35:34,400
It could be body-based data based on some of the states so it would be regulated as such.

263
00:35:34,400 --> 00:35:36,320
In other states, it wouldn't be.

264
00:35:36,560 --> 00:35:59,140
I think the way that I make regulators understand this is I try to actually bring them into the developer's mindset and bring them into the chair of somebody who has to make a decision about selling and producing these products and doing so in an environment that is ambiguous at best.

265
00:36:03,190 --> 00:36:06,030
Some countries are better about it than others.

266
00:36:06,450 --> 00:36:11,570
Australia has an e-safety commissioner's office so they're very, very motivated.

267
00:36:11,570 --> 00:36:16,550
New Zealand is very concerned about public safety in the online context.

268
00:36:16,550 --> 00:36:19,530
France has had a national metaverse strategy.

269
00:36:19,950 --> 00:36:28,390
China and Colombia and one other country have started to hold trials in the metaverse.

270
00:36:28,390 --> 00:36:30,170
Don't do that by the way.

271
00:36:30,170 --> 00:36:31,730
That's not a good idea.

272
00:36:32,990 --> 00:36:36,570
Countries are starting to engage in little ways.

273
00:36:36,710 --> 00:36:43,510
I think Bahamas had an embassy in the metaverse.

274
00:36:44,830 --> 00:37:05,490
I think the way to actually get to these countries is to talk to them more about their economies and corporate environments and that should get them more motivated rather than talking about digital diplomacy and kind of a new sovereign space or other type of nonsense things.

275
00:37:06,330 --> 00:37:09,730
When you think about how even in the U.S.

276
00:37:09,930 --> 00:37:28,470
a lot of our laws that touch on things that we deal with day to day, the DMCA, CFA, a lot of them came because members of Congress for example were afraid that their blockbuster rental history was going to be published.

277
00:37:28,990 --> 00:37:29,950
Oh yeah.

278
00:37:29,950 --> 00:37:34,470
Or they saw a movie and they said, you know what?

279
00:37:34,470 --> 00:37:35,470
War games.

280
00:37:35,470 --> 00:37:36,490
Huh.

281
00:37:36,530 --> 00:37:37,510
Huh.

282
00:37:37,510 --> 00:37:58,170
So I love that idea of putting it in that personal context because unfortunately that does ground it for them and show them because so often we spend time chasing the technology like oh we have to react to this when it's like no let's look at what it's actually doing.

283
00:37:58,170 --> 00:37:59,610
What is it doing at its core?

284
00:37:59,610 --> 00:38:01,750
What is the actual concern?

285
00:38:01,770 --> 00:38:03,750
And then how do we build from there?

286
00:38:03,750 --> 00:38:32,130
So I love that you're getting them that hands on but how do y'all scale that kind of advocacy or how do we as a community of users who are concerned about or builders how do we take that idea and that approach and scale it beyond and bring it down to that local level or that regional level of hey do this,

287
00:38:32,130 --> 00:38:35,670
see this, experience this and know that this is going to impact what you're doing.

288
00:38:36,490 --> 00:38:38,750
I think you don't use law.

289
00:38:39,390 --> 00:38:50,810
I want to call out someone in the front row Caroline Cinders who's research about how to use effective design to create healthy online communities and environments is awesome.

290
00:38:52,170 --> 00:38:53,270
Yay!

291
00:38:53,910 --> 00:39:11,910
So looking at design based principles, looking at social psychology about how we create cultures some of my very boring academic work focuses on the theory of code as law and how that has ignored norms.

292
00:39:12,210 --> 00:39:17,650
And norms are the way that we create culture and we self regulate our own online environments.

293
00:39:17,650 --> 00:39:27,150
And try not to place the full burden on users but distribute it collectively amongst a whole community.

294
00:39:28,170 --> 00:39:31,530
It seems like a cop out answer because I'm a lawyer.

295
00:39:32,830 --> 00:39:35,510
But this isn't a legal problem I think.

296
00:39:35,510 --> 00:39:42,850
It's more of a social problem and an issue of science not catching up to politics.

297
00:39:45,030 --> 00:39:52,090
Well and I think that also putting it on the users overlooks the builders , the makers.

298
00:39:52,090 --> 00:40:09,490
Like if we are intentional from the design aspect and when I say we, I mean the people at the companies who are building it from product to engineering to all that understanding and seeing that big picture and knowing when to call it oh this is going to impact this.

299
00:40:09,750 --> 00:40:10,690
Let's be intentional.

300
00:40:10,690 --> 00:40:12,950
Let's bring them into the conversation.

301
00:40:13,230 --> 00:40:19,350
So as a DEF CON community I think that's one of the easiest ways to start.

302
00:40:19,390 --> 00:40:20,990
I was like start the change.

303
00:40:21,210 --> 00:40:31,910
And I think we can also be really intentional about how we design these products and who we are accommodating when we design them.

304
00:40:32,730 --> 00:40:36,690
How many people here are familiar with simulator sickness?

305
00:40:36,850 --> 00:40:38,270
Probably a bunch.

306
00:40:38,310 --> 00:40:48,370
If you're not, it's if you've gone into a VR world and you feel nauseous and sick to your stomach and really disoriented that's simulator sickness.

307
00:40:48,890 --> 00:40:56,610
In the earlier iterations of headsets more women than men reported simulator sickness.

308
00:40:56,610 --> 00:40:58,330
People started to write about this.

309
00:40:58,330 --> 00:41:11,530
Some said it was just my delicate female constitution and the fact that I may produce babies one day or the fact that I don't play first person shooter games.

310
00:41:11,530 --> 00:41:12,510
It's all bullshit.

311
00:41:12,910 --> 00:41:21,730
What actually was happening was that the headset was designed for an average male form between 5'10 and 6 feet tall.

312
00:41:21,730 --> 00:41:26,450
There is one measurement that is essential to preventing you getting simulator sickness.

313
00:41:26,450 --> 00:41:28,890
It's the interpupillary distance.

314
00:41:28,890 --> 00:41:31,750
The distance between your eyes.

315
00:41:31,750 --> 00:41:36,470
If you go to the optometrist, they measure this to put you in a pair of prescription glasses.

316
00:41:36,890 --> 00:41:42,270
The interpupillary distance on early VR headsets was not adjustable.

317
00:41:42,570 --> 00:41:48,050
So it was akin to putting 51% of the population in the wrong pair of glasses.

318
00:41:48,710 --> 00:41:52,990
No wonder women were reporting sickness and discomfort.

319
00:41:53,130 --> 00:42:01,070
And there were studies following that by Jessica Outlaw that actually showed people that women weren't returning to VR environments because they felt uncomfortable.

320
00:42:01,830 --> 00:42:04,270
There were similar studies that came out.

321
00:42:04,270 --> 00:42:11,610
One from the MIT Media Lab where there was a researcher doing her master's thesis work in Nairobi.

322
00:42:11,710 --> 00:42:25,210
She took Oculus Go to try to put it on Kenyan entrepreneurs and she found that with the women 50% of the time the strap snapped when she tried to fit it over their hair.

323
00:42:25,710 --> 00:42:28,570
50% of the time.

324
00:42:28,670 --> 00:42:35,190
She ended up deviating from her master's thesis to design an adjustable fucking strap.

325
00:42:36,050 --> 00:42:44,050
Easy fix if you think about the wide beautiful variety of people who you want to be your customers.

326
00:42:44,050 --> 00:42:49,090
It's smart to think about the wide diversity of body shapes and types.

327
00:42:49,970 --> 00:42:54,510
Disabled populations are some of the earliest adopters of XR hardware.

328
00:42:54,830 --> 00:43:01,190
And they are the last people that many companies think about when they design these products and services.

329
00:43:01,530 --> 00:43:10,350
Oculus didn't change their vantage point to make it adjustable whether or not I was standing or sitting until update 31.

330
00:43:11,130 --> 00:43:20,170
And it came on the heels of a Scientific American article that showed that somebody had to modify an Xbox controller to use a rock climbing game.

331
00:43:20,370 --> 00:43:25,830
They were a user with muscular dystrophy and so they really wanted to know what rock climbing felt like.

332
00:43:26,490 --> 00:43:30,910
And they had to modify it themselves because the game wouldn't accommodate them.

333
00:43:32,970 --> 00:43:37,130
This is something that we can do as a community.

334
00:43:38,370 --> 00:43:52,490
So when you're doing your prototype testing or your platform building or your experiential design, think about all of the people you want in your world.

335
00:43:52,590 --> 00:43:53,910
And then go bigger.

336
00:43:54,930 --> 00:43:55,690
Yeah.

337
00:43:55,690 --> 00:44:06,810
And I think bringing it back to what Britton was talking about before is like that full stack of an understanding it's not a level playing field.

338
00:44:06,810 --> 00:44:10,210
And by that I mean it's not a flat screen.

339
00:44:10,250 --> 00:44:23,130
And so as you're building and as you're designing, taking all of those different aspects and also incorporating it into the conversations on the biometric data.

340
00:44:23,130 --> 00:44:24,090
What exactly?

341
00:44:24,090 --> 00:44:27,090
So we're not using those same definitions.

342
00:44:27,550 --> 00:44:29,390
It's not the same game.

343
00:44:29,390 --> 00:44:36,450
And being, again, intentional in how you're building, how you're designing, but also how you're approaching it.

344
00:44:36,450 --> 00:44:41,990
And be it with the conversations you're having with regulars as you're watching that.

345
00:44:42,090 --> 00:44:44,610
I think really just kind of bringing it all.

346
00:44:44,610 --> 00:44:48,450
This is not, you know, this is an immersive environment.

347
00:44:48,450 --> 00:44:51,250
It is the entire all encompassing environment.

348
00:44:51,670 --> 00:44:59,010
And there's some best practices that you can follow as developers or even as security experts.

349
00:44:59,090 --> 00:45:05,330
A best practice for XR is to actually keep the data on device.

350
00:45:06,230 --> 00:45:09,890
That means that you have to get a warrant to access the data.

351
00:45:10,550 --> 00:45:16,350
The problem with that is it really impedes your processing speed.

352
00:45:16,350 --> 00:45:18,590
It's very, very expensive.

353
00:45:18,710 --> 00:45:20,590
It kind of drains your battery.

354
00:45:21,310 --> 00:45:43,230
So the other thing you can do is when you're looking to third party cloud providers, you can be really deliberate about asking them about their data retention, storage, disposal, all of their data policies because what your third party data provider does is basically what you do.

355
00:45:43,310 --> 00:45:45,850
And being a savvy customer.

356
00:45:45,970 --> 00:45:55,110
So pushing back if there aren't privacy protective services like you feel meets the threshold that you want to protect your users.

357
00:45:56,090 --> 00:45:59,410
And that's excellent because the change starts with calling it out.

358
00:45:59,690 --> 00:46:18,510
And bringing it to the attention of and paying attention to because you also think of all the different users and whether they're going to understand a 12 year old child is not going to care about all their different things, but it's like all they know is there's a lag time.

359
00:46:18,810 --> 00:46:19,490
And they're annoyed.

360
00:46:19,490 --> 00:46:26,570
It's like, no, let's make sure that we are paying attention, that we are bringing it in, and that we are reporting it, raising it.

361
00:46:26,570 --> 00:46:28,450
It's kind of the name and shame.

362
00:46:28,970 --> 00:46:34,310
Hey, this is a great game that you've created for children or geared towards this market.

363
00:46:34,390 --> 00:46:37,810
Now you're creating their permanent record for their school.

364
00:46:38,110 --> 00:46:49,510
The equivalent of that example that's going to follow them forever and is going to be based on AI modeling and data points that are not necessarily accurate.

365
00:46:49,510 --> 00:47:02,770
I mean, they're going to be based on, if we're looking at the early sets, the 5, 11, 5, 10 male interactions and all of that different thing.

366
00:47:02,770 --> 00:47:18,970
If you had to think of one way to bring it home, of how you're dreaming of electric sheep, what are some good takeaways other than, I mean, I love what you were saying with the proactive steps.

367
00:47:19,030 --> 00:47:21,270
What's a good nugget?

368
00:47:21,570 --> 00:47:23,230
What's the quote?

369
00:47:25,790 --> 00:47:28,150
It's the hangover spot on Sunday morning.

370
00:47:28,150 --> 00:47:29,690
I don't know if I have a quote.

371
00:47:40,350 --> 00:47:49,010
Someone asked what is inspiring in this space, which is a great question to end on because it's all doom and gloom when I go to the dinner party.

372
00:47:49,750 --> 00:47:51,290
XR is magic.

373
00:47:52,510 --> 00:47:53,830
It's magic.

374
00:47:54,570 --> 00:48:01,830
It makes, it can it can make you feel like you are in a different body.

375
00:48:02,070 --> 00:48:09,530
You start to embody the characteristics of your avatar in a social environment within two minutes.

376
00:48:09,990 --> 00:48:15,690
So if I make myself an eight foot tall dragon, I'm going to dominate that space in two minutes.

377
00:48:16,450 --> 00:48:25,230
It takes two and a half minutes for me to put you in my lab context and give you a third arm and have you pop three balloons at the same time.

378
00:48:26,570 --> 00:48:28,770
Neuroplasticity is magic.

379
00:48:28,770 --> 00:48:35,770
XR is a means to access your neuroplasticity, your imagination is really the limit.

380
00:48:35,770 --> 00:48:38,710
And we've never had a technology like this before.

381
00:48:38,930 --> 00:48:41,210
So let's not fuck it up.

382
00:48:41,510 --> 00:48:42,890
That's my quote.

383
00:48:42,970 --> 00:48:44,330
I like that.

384
00:48:44,330 --> 00:48:53,310
Thank you so much and thank you to the XR village for bringing this topic, inviting us.

385
00:48:53,410 --> 00:48:56,230
Please go check it out if you haven't already.

386
00:48:56,230 --> 00:48:58,050
I'm Lawyer Liz on Twitter.

387
00:48:58,050 --> 00:49:00,710
Please feel free to engage.

388
00:49:00,710 --> 00:49:02,550
I'm Britton Heller.

389
00:49:02,550 --> 00:49:06,990
You can find me as Britton Heller on Twitter or on LinkedIn.

390
00:49:08,170 --> 00:49:09,930
Thank you so much.