Oh, I guess it is.
I guess it is.
There we go. Awesome.
Because as we were just sitting here joking,
we're like, uh, this is absolutely
the slot to see who
made it to bed early.
And who has already, ooh,
and now I'm everywhere.
This is awesome.
We called it the hangover slot.
So welcome.
Yeah. And of course we only
have one microphone, so the good
news is that works better.
So welcome, everyone.
And we're going to take a little
bit of a different approach,
I guess, than just presentation
slash panel.
Because one of the
issues with this is
it's an evolving space when we're
talking about the data and the privacy
and all the issues with,
I mean, if you ask anyone to define
as Britton's going to talk about,
like, some of the aspects
of the data privacy in XR.
I mean, we don't even have a common definition
for some of the technology,
so then how are you going to define what it's
doing? So I'm Liz,
and this is Britton, and
we're going to talk, first Britton's
going to lay a great foundation
and give us a framework
from which to have a discussion.
And then the idea is we'll talk
amongst ourselves, and then once y'all have
had an opportunity
to wake up,
get the brain cells firing,
then we thought we would open
it up to a conversation and
questions from the group.
So, bear with us,
and I'm going to let a much smarter person
than I introduce the
topic and
explain a little bit of where some of the
challenges lie.
Question one, can you hear me?
Awesome.
Question two, who's heard
of Lego Universe?
Alright,
I have a salty story
for your Sunday morning about
Lego Universe.
Lego Universe
was a highly
anticipated massive multiplayer
online game, like Roblox,
Minecraft, that
ended up being shuttered.
The experience looked
great, and the company
was really looking to allow
users to build their own type
of content and their own environments.
But given how utterly
trusted Lego was as a
brand, they committed to
whitelisting content before
it went live. So they were going to preview
everything to make sure it was safe
for you and your kids.
The only problem was that
there's a term in content
moderation that
Lego did not think about, and
it's called time to penis.
Time to penis
literally means
the duration
between a person entering a virtual
world and adult content
appearing in that virtual space.
And with all puns
intended for Lego Universe,
the time to penis was not very long.
Lego needed, amongst
other things, to
figure out an automated,
scalable, economical
way to prevent teenagers
and kids from drawing penises
in the virtual world,
and they couldn't do it.
It became a wide-scale
problem, and it actually ended up killing
the project.
This is not an
unusual story. Many
companies find that their expectations
about governing and moderating
user behavior and
user data flows and spatial
computing are turned on their head.
My
name is Britton Heller, and I
like to describe myself as the lawyer
of the black mirror.
I am a visiting scholar at the
Virtual Human Interaction Lab at Stanford
University, and I teach
international law and AI policy.
And I've been focusing on immersive
environments for about seven years.
There are three things that I would like you to
take away today.
One, immersive media
has a different impact on our
bodies and our minds.
And this is what
differentiates it from flat-screen
social media.
Existing privacy law
does not accommodate for
this.
Two, the different technical
stacks between flat-screen
social media and
immersive content
mean that we have different
layers of enforcement when you're
looking at behavioral tracking
and modification in XR.
And three, AI
will not save us. And that one is
worth repeating twice. AI
will not save us.
Overall, the systems that we
create in 3D environments
are fundamentally different
from 2D environments
because of the technical stack, the
potential impact on users, and the
uninformed state of the law.
This leads us to three
questions. What kinds of data flows
do you get from XR environments?
What does this mean for business
models and the law? And why does
this matter to users?
Imagine that you and I
are playing a race
car-oriented game in XR.
And I see this
red McLaren, and I
really, really like this car.
I was going to say a Tesla, but the one that they're
hacking over there, I don't know if it's actually going to be able to drive
after this week. So, I
like the Tesla. I like
McLaren. You can like the Tesla.
When I see
this car, my body starts
to physiologically react
to my pleasure. So, my
heart rate goes up a little bit.
My skin gets a little more moist.
My pupils dilate.
I really like this car.
Later on, as we're walking around
the conference, and we go into a different experience,
I see
a similar red car drive
by, driven by someone who looks
more than a little bit like me.
I go to a virtual sports
bar, and someone who looks exactly
like my crush
says, isn't it a great
time to buy a new car right now?
I go to my email, and
I start getting targeted ads from
Geico about why I should
re-up my car insurance.
This sounds like
science fiction, but the framework
for it actually already
exists. Companies have been
putting advertisements in XR environments
since
2021, I believe
it was announced. And I've
written papers about how advertisements
in immersive contexts are
actually experiential.
They don't look like billboards.
You actually pay for the privilege of having
the car advertised to you.
I developed
a term called
biometric psychography
to describe
the potential for this harm.
Where your
likes, dislikes, and consumer
preferences are married
with your physiological
reactions, often involuntary.
This is
not against the law.
This is not covered by normal privacy
law, because privacy law covers your
personal identifying information.
And when you and I entered into
the game, I had a verifiable billing
address. I had a user account
with my authentic identity.
The companies know who we are. That's not
what's at issue. It's the
inferences about our behavior
and our physiology
and our preferences that are really
at risk. So,
it's your mental privacy, not your
identity. So, privacy law
is not the right regime to deal
with this.
It
actually makes me a little bit upset, because
I'm a lawyer, and I'm like, I don't
like it when new technologies
are a misfit with
existing law.
Because there are different
psychological and neurological
impacts than
socializing with people in video game
worlds,
I'd like to review the three characteristics
that make something immersive.
And I think that when you understand
this, you
really get that this is not
flat screen media anymore.
First is presence.
Presence has been studied
in communications departments for
decades, and formally it's
called the illusion of non-mediation.
When you go
into an XR environment, it feels
real.
The first thing
that we do at the Virtual Human
Interaction Lab when we have somebody visit
is I have them walk
the plank.
I put them in an experience
where they are over a chasm and they are
walking along the plank because nothing
brings the feeling of presence
to you
more acutely than feeling that
vertigo and feeling your
heart rate rise and seeing how your
physiology reacts
to the screens and the
spatial audio and the impact
to show you that this is not a Twitter
feed, this is not Facebook, and therefore
maybe we shouldn't be regulating it in the same
way.
Jeremy Bailenson, who is the founding
director of the lab, says we should think of
VR not as a media experience
but closer to an actual
experience. And the
visceral pit in your stomach
you get when you have
fear of heights,
that's what
that is.
And we do that before talking
about empathy and education
and
all of the
other benefits of VR so that people
understand its power.
Second is immersion, and that's when users
really feel like they're in a virtual
environment.
A virtual violin performance has to
have all of the trappings of watching
a performance in an actual theater.
Different views from different seats,
different movement flows through aisles,
spatially oriented sound.
So it's
the way that
XR experiences use your sensory
input to stimulate the
user through light, sound,
sense, tactile
input.
Finally there's embodiment, and this is
my favorite one because it reminds me
of Looney Tunes.
Embodiment is the feeling
like your avatar or your virtual body
is your actual body.
And a researcher
named Mel Slater
took a famous social
psychology experiment called the rubber
hand experiment. And he had
people look down in VR
and see a rubber hand placed in front
of them, and then proceeded to go
Looney Tunes on it, to hit it with a
mallet, to stab it, to really
abuse the virtual arm.
And when you watch the recordings of these,
you can find them on YouTube, people
scream, people jump,
people react like it's their
actual arm.
This is the
power of embodiment, and it can
be beneficial in medical applications
if somebody has phantom limb pain
where you want to show them an arm that is
not theirs, and have their brain actually
associate what happens to that
with their physiognomy.
But it also can place users at risk
considering the violence
and other user harms that we're
starting to see emerge in XR.
So if this feels so real to our bodies,
what does it do to our minds?
Tom Furness,
who is one of the inventors of VR
headsets, says that when something happens
to you in XR, it's like it's
imprinted on your brain in permanent
ink.
The experiences that you have in a virtual
environment are processed through your hippocampus
in the same way that you create
memories, like you
and I sitting here having a conversation
today.
It's more like
entering somebody's living room
and screaming in their face
than it is reading critical
words on Facebook
or Twitter.
Because of how
XR impacts our bodies
and our minds, it's a mistake
to just cut and paste terms
of service from flat screen social
media and presume that
they're going to do the same thing. And that sounds
really obvious, but that's what a lot
of companies are doing these days.
Second,
I promised we'd talk about different stack layers
and moderation vectors in spatial
computing.
What that means in normal people
speak is that when you do content
moderation on Facebook or Twitter,
you look at two things, conduct
and content.
When you move from a 2D
to a 3D environment, you have
to look at content, conduct
and environment. So the
architecture of your world,
like we talked about with the
penises in Lego Universe,
becomes a moderation factor.
One that you don't have
when you have a text-based
social media environment.
That means that there
are actually different ways to
mess with people in
XR worlds. I like
to think about spam.
And how does spam translate into
XR? Pretend
you and I are tired of my
sports car, so we go to a sports
bar. And in the
sports bar, I can buy Liz
a beer. I don't
want Liz coming to my bar
though, or playing on my pool table,
so I buy her so many beers
that it fills up the virtual pool table
and she can't play the
game.
Impeding a user's gameplay
in an XR environment
is the functional equivalent to
spam in a flat screen computing
environment, but it would never be defined
as such if you didn't think about it
in three dimensions.
I'm going to skip a
little bit ahead because we have a lot
to talk about.
Three, platforms
are having a lot of challenges
trying to create trust
and safety regimes and privacy
regimes because of all of
these complicating factors.
This is a
new form of media with
new impacts on your body and mind, you need
new rules.
A lot of people ask,
why didn't Lego just create a filter
to screen out
all the penises?
And the answer was
that most social media content
is moderated by automated
filters in an ex-ante
fashion, so before it ever hits
a flat feed.
Facebook takes 97% of hate
speech off before you ever see it.
And the way that they do this is
by using classifiers.
So it's
basically a huge AI profanity
filter.
This is not possible
in the XR context yet.
We don't have
scalable, affordable,
reliable ways to create
classifiers
for 3D environments.
We don't have the data sets yet
to use. Computer vision is
the way that I think
we're going to be able to do this, but think about
all the different ways you can
describe a cat.
We don't have
publicly available data sets yet to try
to audit what a cat would
actually be in its many forms
and colors and shapes and sizes.
Currently when companies do content
moderation, one, they
just don't do it for XR.
Two, they use a
voice to text transcription
and then run it through social
media filters, which
does not catch context
or behavioral or environmental
factors. Or
three, they try to
use realtime behavioral
tracking, which is
just not scalable and puts the burden
on users.
When you report a violation
in a platform like
Horizon Worlds, it takes one to
two minutes of content
and gives it to the company.
That normally is not
enough to determine the context
of what's actually happening.
And if you watch videos
of people who are reporting
abuse happening,
you often can't tell who is saying what
to whom and what's happening.
Especially in 60 seconds.
Reporting is done
differently as well on every different
platform. So that's like
if we went to
Vegas and you call 911,
but then if you went to Henderson
and you had to send them a fax,
and then if you went to Reno
and you had to show up in person.
When you use public safety
services, if you had to call for help
in a different way in every
different city you went to, you
would never use 911.
And I think
companies are finding that it's the same way
if you don't have standardized safety protocols
across different XR platforms
and XR worlds.
Generative AI looks promising
as a tool to help, but it does not yet
have the discretion or the contextual
understanding necessary to help
with the nuance that will be required
for helping to modify
or govern user behavior.
Realistically, AI based
solutions are several years away from having
sufficient sophistication, enough data
and adequate training to work in spatial
environments.
So, overall,
the differences between
social media and XR
are stark.
And they emerge from
the interactive features of immersive experiences
and the neurological impacts
that this has on users.
And this has resulted in violations of what I
called the right to mental privacy.
Other scholars in Chile have called this
neuro rights.
Brain-computer interface scholars
are talking about a
battle
for your brain.
There's a new book that came out
discussing that.
And they're all
part and parcel of the same thing
where the sanctity of the content of
your thoughts and
the inferences that can be
made about your health
and your sexual
preferences, your political
preferences, your gender, your age,
all of these things we can determine from
data flows
really shouldn't be used
to send you advertisements.
If so,
I think it's actually a failure of the
imagination.
I think that's a good
way to turn it to us.
And one
of the things that really
strikes my mind is
it's not just
the gaming experience.
This is moving beyond
so many different aspects
and potential.
So as Britton was talking about,
moving into the healthcare environment,
that your healthcare
will be delivered potentially
through this data
that is being collected
from your physical reactions.
So the questions
start to become, is this data
painting a correct picture?
Is this the full picture? Is it
picking up on all the nuances?
And who's getting access
to that? And there's
a big difference between
what I may post on
social media at 2am
when I am fired up about
something and what I would actually
say or do.
Or you think of a lot of the,
as we saw during
remote environments
where people were having job
interviews over Zoom
or other
conference calling.
And a lot of it dealt
with, there were companies, and
some states have started taking a harder
look at this, where they were creating
biases. That if you didn't make
the proper amount of eye contact,
or if it looked like you were distracted
during, because
the sensors on the screen
weren't picking this up properly,
that suddenly you were
getting penalized
during your job interview
because you weren't meeting
this set standard.
And so now what happens when we take
that and all of those
AI
data sets that are
expecting certain behaviors, they're not
expecting children
to start drawing inappropriate
things, which
anyone who's been in an elementary school,
you should have expected it.
And you should have expected fart jokes,
you should have expected
lots of poop,
and all those different things.
But what happens
when we're trying to create
protections,
and we're trying to do all this
with a bias towards, like, we're already
starting so far behind.
And now we're taking
all these other little cues of
how does the VR
headset, like how does that experience
know that it wasn't because a
spider crawled across
your foot or someone else in the
room thought it would be hilarious
to tap you on the shoulder
as you were playing the game
or, or,
I'm not saying this has ever happened, I've
definitely never done this to someone
playing, but what happens if you
move furniture while they're
in the middle of and suddenly they're
tripping over something because it was really
freaking funny and
it serves them right
but suddenly that reaction
is getting captured
and how do you know that
I haven't logged in to Britton's account?
That I'm not
playing as her and should I
be so lucky to
have all the sensors pick up
and be like, hmm, you have the same
facial structure, you have all this
and I'm like, yes I do.
Yes, that's right.
Or, you're just off today
or heavens forbid, I think of
all the times I've tried to log in
to my iPhone
and it's like facial recognition, not
recognition, I'm like, wait, what?
No, oh my god,
are you telling me I didn't get enough sleep last night
and suddenly, or
oh, god, is my resting bitch face back?
Like, oh, I didn't mean to do that.
So how do regulators and how
do you work all those different
aspects in? Because we're already
playing catch up.
One of the things that
I like to do when I
talk to regulators is
tell them the type
and quality of information
you can get about a person from these
data flows. And I realize I didn't
mention that before.
There was a study that came out last week
this is the absolute newest information
from UC Berkeley
and the study
said that a machine learning
model was able to accurately
predict the height, weight, age,
marital status
of a user in
XR by the way they moved.
So
I know earlier I said that it doesn't
go into the realm of personal identifying
information, but initial studies
are starting to show that
you can actually tell somebody's
foot size by the way
they move.
The lab at
Berkeley and the lab at Stanford
have had some
similar studies and Berkeley
came out with a study that
said
there was 100 seconds
of recorded data you could
uniquely identify a person
in XR with 94%
accuracy
from a data set of 50,000
people.
Stanford did this earlier
but the data set was
a couple thousand people, it wasn't
statistically significant.
50,000 people.
That might be
you in the Taylor Swift crowd
by the way that you tilt
your head and point can be uniquely
identified in an immersive environment.
The type
of medical
and sort of human rights
oriented information that I'm concerned about
really is
tied into eye tracking.
So the type of information you can get
by somebody's pupil reaction
you can tell who
somebody is sexually attracted to
you can tell whether or not somebody is likely
to be telling the truth
and you can also tell whether or not somebody
shows preclinical signs of certain
medical ailments
like schizophrenia, ADHD
Parkinson's and Huntington's.
These are preclinical signs
these are things you may not know about yourself
yet, your doctor may not
know about you yet
and a company
if they were to
parse the data set would have
access to that information.
This is what I mean
by the right to mental privacy.
It's not
just the content
of your thoughts, it's the
implications that can be made about
who you uniquely are
your medical conditions
and the type of behaviors that you may
choose to engage in or not.
One of the things
we're seeing is the states are starting
to try to play catch up
because, keeping in mind
data brokers
are taking this information and
creating these pictures
and they're
selling them. And
the regulations really are not
keeping up
with who should have access
to this and how do we protect it.
And it's also
what happens if
it gets wrong.
That one
out of 50,000
it's wrong.
But yet this is now
flagged in a file and it's
you know as a child you're told this will go
down in your permanent record.
Well how do we fix that
permanent record when it's our
biometric and it's
our mental information
that, oh wait, you know,
objection your honor. I was just
having a bad day and that wasn't me.
Or
the, you know, it
that was someone else and that
piece of information. So it's not the
entire picture that gets off.
It's just one piece. How do you fix
that?
I don't have a good answer for that.
I wish I did.
Because right now
these type of data sets aren't
auditable by the public.
In certain jurisdictions
people are proposing a right to have
all your user information about you
available, but these are
profiles made
to sell you something.
It's not an essential part of your
user account and things.
Another thing I tell regulators
is that you
can't outsmart the machine.
Because a lot of them think that
somebody
advertising something to me, that's obvious.
That's not
I'm not going to fall for that.
In XR environments you can actually
switch out elements
in the environment at blink rate.
It's
been done in experimental context
but there's nothing saying that you could
have somebody with a can of soda
and switching out Coke and
Pepsi and
tracking somebody's more
positive reaction to one versus the other.
It's kind of like
that social psychology experiment where
you're told to count the number of
basketball passes and so you
miss the gorilla walking in the background.
It's
a similar type of a dynamic
where people think they're smarter
than the system, but the system
works faster than you can
articulate your preferences or
requests cognitively.
And that's
a really kind of funky, scary thing.
If you watch
sports
and Liz is here and I'm back in
California, Liz
and I will actually see different ads
behind the players.
Augmented advertising is
already a thing and
it's based on your
zip code.
And somebody in the stadium
will see even different
ads than Liz or I would see
on different network channels.
They sell this space.
Advertisement in an immersive
context is more about
targeting and personalization
than it is
in an offline context. And that makes sense,
but the capacity
and the ability to really
target it to people
makes XR the most persuasive
medium that we've
developed so far.
And one of the things that
we saw and we keep going back to is
the data sets.
What is it getting based on? Where
are those data sets getting built from
that are creating some of these
models and
being able to audit it
and being able to audit and get to your
information and make sure, like, hey,
is this the picture that I see?
And basing it
on a bias towards,
well, English
speaking, US
based things, when you're
talking about an immersive experience
that is intended to
open up the world.
Like, the idea is that you
were playing and you were experiencing
things with people
in any different physical
location. So now
how do you build the
rules and even train
that it's getting it right
when not
everyone's going to look the same, react the same
and different cultures have built
in different
mannerisms.
And as we saw with a lot
of the, you know, again,
even just trying to unlock your iPhone,
heavens forbid, you're
a woman of color.
Because guess what? All of
the modeling that was based
on was not you.
Not even a little bit. And so they had
to go back and say, oops, our bad.
Well now, what do we do when we're
talking about collecting all this data
and it's like, on
the reactions of
you know, we talk about a lot in
the medical world, a lot
of the early
training was done and it wasn't
done based on women's
bodies. And it wasn't based
on... so it's like, oh, well,
you're going to react to this
medication in the following manners, or these
are the following symptoms. It's like, but
no.
I am not.
So now you've got the VR and
it's assuming, heavens forbid,
I don't want to be
a redhead
middle aged woman in
my, like, I want to
be a kick ass
like ninja
dragon, whatever the hell
I want. So
how are we going to start
building that and work on regulators when you've got
because, again,
heavens forbid, heavens forbid
that
Australia, the US, New Zealand
like, insert
country, get the upper
hand in being
the regulator who
sets the rules for this.
Because, oh no, we can't let
Canada do that. I mean, they're just nice
and maple syrup.
So how do you broach
those conversations
when you're going all over the world
and talking to them and saying, no, no, no,
we need to let this country take the lead
or play nice with them
and not share the data.
If y'all notice, I give
Britton all the really hard questions
because this is what she gets for being
so smart and being a professor,
shaping young minds
that are creating this future. So, sorry.
But those aren't young minds, those are like
crusty old minds. That's why I'm like,
hmm, about this.
A lot of people
in Europe argue that GDPR
should cover it.
They argue that Article 1 of GDPR
should cover all of the privacy protections
for XR and then we're done.
I take issue with that.
Because these are new types
of data flows and
they're not really anticipated by
the regulatory structure.
And they're
more akin to medical data
to me than they are personal
identifying information.
The Future on Privacy
Forum just did a
really optimistic
study where
they determined that biometric laws
are, biometric laws in the US
are covered by state based law.
And if you have a business
that creates XR
products, you know this because there are
certain states you're really, really worried
about selling in and certain states
you may choose to not release your product
in. And those may be
Illinois, Washington, or
Texas.
There are other states that have privacy
laws, not biometric laws, but
you
think about, sometimes I talk to regulators
and I ask them if they've tried
Smell-O-Vision.
And they look at me like I'm nuts.
And I tell them that in the lab
and in commercial context now,
you can actually go before a
campfire in XR and you don't
just hear the campfire and you don't just
see the campfire, you can actually
smell the charcoal
and in the lab we put a little
toasted marshmallow in there as well just for
fun.
You can go into a garden and smell flowers.
These type of inputs
are really not anticipated
by law.
Also,
there was a
company that
recently released a
breath
gauge for a meditation app.
And my question for them is
is that biometric data?
It could be body-based data
based on some of the states
so it would be regulated as such.
In other states, it wouldn't be.
I think the way that I make regulators
understand this is I
try to actually bring them into the
developer's mindset
and bring them into
the chair of somebody who has to make a
decision about
selling and producing these products
and doing so in an
environment that is ambiguous at best.
Some countries are better about it than others.
Australia
has an e-safety commissioner's office
so they're very, very motivated.
New Zealand is very concerned about public
safety in the online
context. France has had
a national metaverse strategy.
China and
Colombia and
one other country
have started to hold trials in the
metaverse. Don't do that
by the way. That's not a good idea.
Countries are starting to engage in little
ways. I think
Bahamas had
an embassy
in the metaverse.
I think
the way to actually get to these countries is
to talk to
them more about their economies
and corporate environments and that
should get them more motivated rather
than talking about digital diplomacy
and
kind of a new
sovereign space or other
type of nonsense things.
When you think
about how even in the U.S.
a lot of our
laws that touch on
things that we deal with
day to day, the DMCA,
CFA, a lot of them came
because members of Congress
for example were afraid that their
blockbuster rental history
was going to be published.
Oh yeah.
Or they saw a movie
and they said, you know what?
War games. Huh.
Huh.
So I love
that idea of putting it in that
personal context because
unfortunately that does
ground it for them
and show them because so often we
spend time chasing the technology
like oh we have to react
to this when it's like no
let's look at what it's
actually doing. What is it doing at its core?
What is the actual concern?
And then how do we build from there?
So I love that you're
getting them that hands on but how do y'all
scale that kind
of advocacy or how do we
as a community
of users who are concerned
about or builders
how do we take that
idea and that approach
and scale it
beyond
and bring it down to that
local level or that regional level
of hey
do this, see this, experience this and know
that this is going to impact what you're doing.
I think you don't
use law. I want
to call out someone in the front row
Caroline Cinders who's
research about how to use effective
design to create healthy online
communities and environments is
awesome.
Yay!
So looking at
design based principles,
looking at social psychology
about how we create cultures
some of my
very boring academic work focuses
on the theory
of code as law and how
that has ignored norms.
And norms are the way that we create
culture and we self regulate our own
online environments.
And try not to place
the full burden on
users but
distribute it collectively amongst
a whole community.
It seems
like a cop out answer because I'm a lawyer.
But this
isn't a legal problem I think.
It's more of a
social problem and an issue
of science not catching up
to politics.
Well and I
think that also putting it on the users
overlooks
the builders, the makers.
Like if we are intentional
from the design aspect
and when I say we, I mean the people
at the companies who are building it
from product to engineering
to all that understanding and
seeing that big picture
and knowing when to call it
oh this is going to impact this.
Let's be intentional. Let's bring them into the
conversation. So as
a DEF CON community
I think that's one of the easiest ways
to start. I was like
start the change.
And I think we can also be really
intentional about how we design
these products and who
we are accommodating
when we design them.
How many people
here are familiar with simulator sickness?
Probably a bunch.
If you're not, it's
if you've gone into a VR world and you
feel nauseous and sick to your
stomach and really disoriented
that's simulator sickness.
In the earlier
iterations of headsets
more women than men
reported simulator sickness.
People started to write about this.
Some said it was just my delicate
female constitution
and the fact that I may
produce babies one day
or the fact that I
don't play first person shooter
games. It's all bullshit.
What actually was happening
was that the headset was designed
for an average male form
between 5'10 and
6 feet tall. There is one
measurement that is essential to preventing
you getting simulator sickness.
It's the interpupillary distance.
The distance between
your eyes. If you go to
the optometrist, they measure this to put you
in a pair of prescription glasses.
The interpupillary
distance on early VR headsets
was not adjustable.
So it was akin to putting 51%
of the population in the wrong
pair of glasses.
No wonder women were reporting
sickness and discomfort.
And there were studies following that
by Jessica Outlaw that actually showed
people that women weren't returning to
VR environments because they felt uncomfortable.
There were similar
studies that came out.
One from the MIT Media Lab
where there was a researcher doing her
master's thesis work in
Nairobi. She took Oculus Go
to try to put it on
Kenyan entrepreneurs
and she found that with the women
50% of the time
the strap snapped
when she tried to fit it over their hair.
50%
of the time.
She ended up deviating from
her master's thesis to design an
adjustable fucking strap.
Easy
fix if you think about the wide
beautiful variety of people
who you want to be
your customers. It's smart
to think about the wide diversity
of body shapes and types.
Disabled populations
are some of the earliest adopters
of XR hardware.
And they are the last people that many
companies think about when they design
these products and services.
Oculus didn't change
their vantage point to make
it adjustable whether or not I was
standing or sitting until
update 31.
And it came on the heels of a Scientific
American article that showed
that somebody had to modify an
Xbox controller to use a rock
climbing game. They were
a user with muscular dystrophy and so
they really wanted to know what rock climbing
felt like.
And they had to modify it themselves
because the game wouldn't accommodate them.
This is something that we
can do as a community.
So
when you're doing your
prototype testing or your
platform building or
your experiential
design, think
about all of the people you want
in your world. And then go
bigger.
Yeah. And I think bringing it back
to what
Britton was talking about before is like that full
stack of an
understanding it's not
a level playing field. And by that
I mean it's not a flat
screen. And so
as you're building and as you're
designing, taking all of those different
aspects and
also incorporating it
into the conversations
on the biometric data.
What exactly? So we're not
using those same definitions.
It's not the same game.
And being, again,
intentional in how you're
building, how you're designing, but also how you're
approaching it. And
be it with the conversations you're having
with regulars as you're watching
that. I think really
just kind of bringing it all. This is
not, you know, this is
an immersive environment. It is the
entire all encompassing environment.
And there's some best
practices that you can follow as
developers
or even as security experts.
A best practice
for XR is to actually
keep the data on device.
That
means that you have to get a warrant to
access the data.
The problem with that is
it really impedes
your processing speed. It's
very, very expensive.
It kind of drains your battery.
So the other thing you can do
is when you're looking to third party
cloud providers,
you can be really deliberate
about asking them about their data
retention, storage,
disposal,
all of their data policies
because what your third party data provider
does
is basically what you do.
And being a savvy customer.
So pushing back
if there aren't privacy protective services
like you feel meets the threshold
that you want
to protect your users.
And that's
excellent because the change starts with calling it out.
And bringing it
to the attention of and paying attention to
because you also think of all the different users
and whether they're going
to understand
a 12 year old child
is not going to care
about
all their different things, but it's like
all they know is there's a lag time.
And they're annoyed. It's like, no, let's
make sure that we are paying attention,
that we are bringing it in, and that we are
reporting it, raising it.
It's kind of the name and shame.
Hey, this is a great game that you've
created for children or geared
towards this market.
Now you're creating their permanent record
for their school.
The equivalent of that example
that's going to follow them forever
and is going to be based on
AI modeling and
data points that are not
necessarily accurate. I mean, they're going to be based
on, if we're looking at the early sets,
the 5,
11, 5, 10
male
interactions
and all of that
different thing.
If you had to think of
one way to bring it
home, of how you're
dreaming of electric sheep,
what are some good takeaways
other than, I mean, I love what you were saying
with the proactive
steps.
What's a good nugget?
What's the quote?
It's the hangover spot
on Sunday morning. I don't know if I have a quote.
Someone asked what is
inspiring in this space, which is
a great question to end on because
it's all doom and gloom
when I go to the dinner party.
XR is magic.
It's magic.
It makes, it can
it can make
you feel
like you are in a different body.
You start to embody
the characteristics of your avatar
in a social environment
within two minutes.
So if I make myself an
eight foot tall dragon, I'm going to dominate
that space in two minutes.
It takes two and a half
minutes for me to put you in
my lab context and give you a third
arm and have you pop three balloons
at the same time.
Neuroplasticity
is magic. XR is a
means to access your neuroplasticity,
your imagination is
really the limit. And we've never had
a technology like this before.
So let's not fuck it up.
That's my quote.
I like that.
Thank you so much and thank you to
the XR village for
bringing
this topic, inviting us.
Please go check it out
if you haven't already. I'm
Lawyer Liz on Twitter. Please feel
free to engage.
I'm Britton Heller. You can
find me as Britton Heller on
Twitter or on LinkedIn.
Thank you
so much.