WEBVTT 00:01.120 --> 00:03.020 Oh, I guess it is. 00:03.820 --> 00:05.180 I guess it is. 00:05.180 --> 00:06.140 There we go. 00:06.140 --> 00:07.060 Awesome. 00:07.060 --> 00:14.660 Because as we were just sitting here joking, we're like, uh, this is absolutely the slot to see who made it to bed early. 00:14.660 --> 00:18.600 And who has already, ooh, and now I'm everywhere. 00:18.700 --> 00:20.500 This is awesome. 00:20.500 --> 00:23.360 We called it the hangover slot. 00:23.360 --> 00:24.660 So welcome. 00:24.880 --> 00:25.760 Yeah. 00:25.980 --> 00:31.240 And of course we only have one microphone, so the good news is that works better. 00:31.320 --> 00:33.300 So welcome, everyone. 00:33.640 --> 00:40.640 And we're going to take a little bit of a different approach, I guess, than just presentation slash panel. 00:40.780 --> 00:59.540 Because one of the issues with this is it's an evolving space when we're talking about the data and the privacy and all the issues with, I mean, if you ask anyone to define as Britton's going to talk about, like, some of the aspects of the data privacy in XR. 00:59.540 --> 01:06.520 I mean, we don't even have a common definition for some of the technology, so then how are you going to define what it's doing? 01:06.620 --> 01:17.280 So I'm Liz, and this is Britton, and we're going to talk, first Britton's going to lay a great foundation and give us a framework from which to have a discussion. 01:17.300 --> 01:34.780 And then the idea is we'll talk amongst ourselves, and then once y'all have had an opportunity to wake up, get the brain cells firing, then we thought we would open it up to a conversation and questions from the group. 01:34.780 --> 01:45.720 So , bear with us, and I'm going to let a much smarter person than I introduce the topic and explain a little bit of where some of the challenges lie. 01:48.740 --> 01:51.320 Question one, can you hear me? 01:51.600 --> 01:52.560 Awesome. 01:52.620 --> 01:56.080 Question two, who's heard of Lego Universe? 01:57.540 --> 02:04.390 Alright, I have a salty story for your Sunday morning about Lego Universe. 02:05.120 --> 02:16.250 Lego Universe was a highly anticipated massive multiplayer online game, like Roblox, Minecraft, that ended up being shuttered. 02:16.960 --> 02:27.100 The experience looked great, and the company was really looking to allow users to build their own type of content and their own environments. 02:27.400 --> 02:35.580 But given how utterly trusted Lego was as a brand , they committed to whitelisting content before it went live. 02:35.580 --> 02:40.360 So they were going to preview everything to make sure it was safe for you and your kids. 02:40.680 --> 02:50.660 The only problem was that there's a term in content moderation that Lego did not think about, and it's called time to penis. 02:51.120 --> 03:03.400 Time to penis literally means the duration between a person entering a virtual world and adult content appearing in that virtual space. 03:03.500 --> 03:08.560 And with all puns intended for Lego Universe, the time to penis was not very long. 03:10.520 --> 03:26.480 Lego needed, amongst other things, to figure out an automated, scalable, economical way to prevent teenagers and kids from drawing penises in the virtual world, and they couldn't do it. 03:26.740 --> 03:32.200 It became a wide-scale problem, and it actually ended up killing the project. 03:33.220 --> 03:36.520 This is not an unusual story. 03:36.540 --> 03:47.440 Many companies find that their expectations about governing and moderating user behavior and user data flows and spatial computing are turned on their head. 03:48.440 --> 03:54.120 My name is Britton Heller, and I like to describe myself as the lawyer of the black mirror. 03:54.760 --> 04:03.060 I am a visiting scholar at the Virtual Human Interaction Lab at Stanford University, and I teach international law and AI policy. 04:03.060 --> 04:07.060 And I've been focusing on immersive environments for about seven years. 04:08.260 --> 04:12.060 There are three things that I would like you to take away today. 04:12.400 --> 04:18.970 One, immersive media has a different impact on our bodies and our minds. 04:19.680 --> 04:24.700 And this is what differentiates it from flat-screen social media. 04:24.920 --> 04:30.080 Existing privacy law does not accommodate for this. 04:30.600 --> 04:47.260 Two, the different technical stacks between flat-screen social media and immersive content mean that we have different layers of enforcement when you're looking at behavioral tracking and modification in XR. 04:48.020 --> 04:50.640 And three, AI will not save us. 04:50.640 --> 04:52.580 And that one is worth repeating twice. 04:52.580 --> 04:55.300 AI will not save us. 04:55.640 --> 05:09.280 Overall, the systems that we create in 3D environments are fundamentally different from 2D environments because of the technical stack, the potential impact on users, and the uninformed state of the law. 05:09.720 --> 05:11.860 This leads us to three questions. 05:11.860 --> 05:15.520 What kinds of data flows do you get from XR environments? 05:15.520 --> 05:18.420 What does this mean for business models and the law? 05:18.420 --> 05:20.500 And why does this matter to users? 05:23.180 --> 05:29.560 Imagine that you and I are playing a race car-oriented game in XR. 05:30.200 --> 05:35.160 And I see this red McLaren, and I really, really like this car. 05:35.160 --> 05:40.460 I was going to say a Tesla, but the one that they're hacking over there, I don't know if it's actually going to be able to drive after this week. 05:40.600 --> 05:42.420 So, I like the Tesla. 05:42.420 --> 05:43.500 I like McLaren. 05:43.500 --> 05:44.760 You can like the Tesla. 05:46.340 --> 05:52.460 When I see this car, my body starts to physiologically react to my pleasure. 05:52.780 --> 05:55.160 So, my heart rate goes up a little bit. 05:55.160 --> 05:57.260 My skin gets a little more moist. 05:57.260 --> 05:59.060 My pupils dilate. 05:59.180 --> 06:00.860 I really like this car. 06:01.860 --> 06:13.180 Later on, as we're walking around the conference, and we go into a different experience, I see a similar red car drive by, driven by someone who looks more than a little bit like me. 06:13.980 --> 06:23.340 I go to a virtual sports bar, and someone who looks exactly like my crush says, isn't it a great time to buy a new car right now? 06:23.800 --> 06:31.180 I go to my email, and I start getting targeted ads from Geico about why I should re-up my car insurance. 06:31.980 --> 06:38.420 This sounds like science fiction, but the framework for it actually already exists. 06:38.440 --> 06:46.940 Companies have been putting advertisements in XR environments since 2021, I believe it was announced. 06:46.940 --> 06:53.180 And I've written papers about how advertisements in immersive contexts are actually experiential. 06:53.400 --> 06:55.240 They don't look like billboards. 06:55.240 --> 06:59.400 You actually pay for the privilege of having the car advertised to you. 07:00.380 --> 07:08.920 I developed a term called biometric psychography to describe the potential for this harm. 07:09.300 --> 07:19.680 Where your likes, dislikes, and consumer preferences are married with your physiological reactions, often involuntary. 07:20.280 --> 07:22.240 This is not against the law. 07:22.620 --> 07:28.880 This is not covered by normal privacy law, because privacy law covers your personal identifying information. 07:29.420 --> 07:33.560 And when you and I entered into the game, I had a verifiable billing address. 07:33.560 --> 07:36.620 I had a user account with my authentic identity. 07:36.620 --> 07:38.040 The companies know who we are. 07:38.040 --> 07:39.860 That's not what's at issue. 07:40.060 --> 07:47.680 It's the inferences about our behavior and our physiology and our preferences that are really at risk. 07:48.160 --> 07:51.520 So, it's your mental privacy, not your identity. 07:51.660 --> 07:55.660 So, privacy law is not the right regime to deal with this. 07:57.680 --> 08:07.640 It actually makes me a little bit upset, because I'm a lawyer, and I'm like, I don't like it when new technologies are a misfit with existing law. 08:13.140 --> 08:26.940 Because there are different psychological and neurological impacts than socializing with people in video game worlds, I'd like to review the three characteristics that make something immersive. 08:27.060 --> 08:34.380 And I think that when you understand this, you really get that this is not flat screen media anymore. 08:34.860 --> 08:36.720 First is presence. 08:37.260 --> 08:44.710 Presence has been studied in communications departments for decades, and formally it's called the illusion of non-mediation. 08:45.740 --> 08:49.760 When you go into an XR environment, it feels real. 08:51.200 --> 08:59.540 The first thing that we do at the Virtual Human Interaction Lab when we have somebody visit is I have them walk the plank. 09:00.200 --> 09:23.980 I put them in an experience where they are over a chasm and they are walking along the plank because nothing brings the feeling of presence to you more acutely than feeling that vertigo and feeling your heart rate rise and seeing how your physiology reacts to the screens and the spatial audio and the impact to show you that this is not a Twitter feed, 09:23.980 --> 09:28.460 this is not Facebook, and therefore maybe we shouldn't be regulating it in the same way. 09:32.230 --> 09:41.770 Jeremy Bailenson, who is the founding director of the lab, says we should think of VR not as a media experience but closer to an actual experience. 09:42.030 --> 09:51.350 And the visceral pit in your stomach you get when you have fear of heights, that's what that is. 09:52.650 --> 10:03.570 And we do that before talking about empathy and education and all of the other benefits of VR so that people understand its power. 10:04.010 --> 10:09.330 Second is immersion, and that's when users really feel like they're in a virtual environment. 10:09.870 --> 10:16.290 A virtual violin performance has to have all of the trappings of watching a performance in an actual theater. 10:16.470 --> 10:22.530 Different views from different seats, different movement flows through aisles, spatially oriented sound. 10:22.670 --> 10:35.520 So it's the way that XR experiences use your sensory input to stimulate the user through light, sound, sense, tactile input. 10:36.000 --> 10:41.360 Finally there's embodiment, and this is my favorite one because it reminds me of Looney Tunes. 10:42.240 --> 10:48.150 Embodiment is the feeling like your avatar or your virtual body is your actual body. 10:48.760 --> 10:56.840 And a researcher named Mel Slater took a famous social psychology experiment called the rubber hand experiment. 10:57.420 --> 11:09.780 And he had people look down in VR and see a rubber hand placed in front of them, and then proceeded to go Looney Tunes on it, to hit it with a mallet , to stab it, to really abuse the virtual arm. 11:09.940 --> 11:19.440 And when you watch the recordings of these, you can find them on YouTube, people scream, people jump, people react like it's their actual arm . 11:21.500 --> 11:36.020 This is the power of embodiment, and it can be beneficial in medical applications if somebody has phantom limb pain where you want to show them an arm that is not theirs, and have their brain actually associate what happens to that with their physiognomy. 11:36.120 --> 11:44.820 But it also can place users at risk considering the violence and other user harms that we're starting to see emerge in XR. 11:46.440 --> 11:50.920 So if this feels so real to our bodies, what does it do to our minds? 11:52.540 --> 12:01.780 Tom Furness, who is one of the inventors of VR headsets, says that when something happens to you in XR, it's like it's imprinted on your brain in permanent ink. 12:02.880 --> 12:14.100 The experiences that you have in a virtual environment are processed through your hippocampus in the same way that you create memories, like you and I sitting here having a conversation today. 12:15.840 --> 12:25.960 It's more like entering somebody's living room and screaming in their face than it is reading critical words on Facebook or Twitter. 12:27.440 --> 12:40.460 Because of how XR impacts our bodies and our minds, it's a mistake to just cut and paste terms of service from flat screen social media and presume that they're going to do the same thing. 12:40.460 --> 12:45.060 And that sounds really obvious, but that's what a lot of companies are doing these days. 12:46.360 --> 12:52.160 Second, I promised we'd talk about different stack layers and moderation vectors in spatial computing. 12:53.360 --> 13:02.280 What that means in normal people speak is that when you do content moderation on Facebook or Twitter, you look at two things, conduct and content. 13:03.080 --> 13:10.620 When you move from a 2D to a 3D environment, you have to look at content, conduct and environment. 13:10.620 --> 13:19.700 So the architecture of your world, like we talked about with the penises in Lego Universe, becomes a moderation factor. 13:19.700 --> 13:25.380 One that you don't have when you have a text-based social media environment. 13:27.700 --> 13:34.380 That means that there are actually different ways to mess with people in XR worlds. 13:34.380 --> 13:36.560 I like to think about spam. 13:36.680 --> 13:39.960 And how does spam translate into XR? 13:40.500 --> 13:45.180 Pretend you and I are tired of my sports car, so we go to a sports bar. 13:46.160 --> 13:49.600 And in the sports bar, I can buy Liz a beer. 13:50.320 --> 14:01.540 I don't want Liz coming to my bar though, or playing on my pool table, so I buy her so many beers that it fills up the virtual pool table and she can't play the game. 14:03.260 --> 14:16.640 Impeding a user's gameplay in an XR environment is the functional equivalent to spam in a flat screen computing environment, but it would never be defined as such if you didn't think about it in three dimensions. 14:22.160 --> 14:26.200 I'm going to skip a little bit ahead because we have a lot to talk about. 14:29.400 --> 14:41.600 Three , platforms are having a lot of challenges trying to create trust and safety regimes and privacy regimes because of all of these complicating factors. 14:42.240 --> 14:48.400 This is a new form of media with new impacts on your body and mind, you need new rules. 14:49.340 --> 14:56.180 A lot of people ask, why didn't Lego just create a filter to screen out all the penises? 14:57.160 --> 15:08.580 And the answer was that most social media content is moderated by automated filters in an ex-ante fashion, so before it ever hits a flat feed. 15:08.720 --> 15:13.120 Facebook takes 97% of hate speech off before you ever see it. 15:13.420 --> 15:16.700 And the way that they do this is by using classifiers. 15:17.180 --> 15:21.940 So it's basically a huge AI profanity filter. 15:22.840 --> 15:27.040 This is not possible in the XR context yet. 15:28.600 --> 15:40.900 We don't have scalable, affordable, reliable ways to create classifiers for 3D environments. 15:40.960 --> 15:43.860 We don't have the data sets yet to use. 15:43.860 --> 15:52.200 Computer vision is the way that I think we're going to be able to do this, but think about all the different ways you can describe a cat. 15:53.080 --> 16:03.500 We don't have publicly available data sets yet to try to audit what a cat would actually be in its many forms and colors and shapes and sizes. 16:04.700 --> 16:10.640 Currently when companies do content moderation, one, they just don't do it for XR. 16:10.940 --> 16:23.860 Two, they use a voice to text transcription and then run it through social media filters, which does not catch context or behavioral or environmental factors . 16:24.260 --> 16:34.240 Or three , they try to use realtime behavioral tracking , which is just not scalable and puts the burden on users. 16:37.080 --> 16:47.140 When you report a violation in a platform like Horizon Worlds, it takes one to two minutes of content and gives it to the company. 16:47.500 --> 16:53.500 That normally is not enough to determine the context of what's actually happening. 16:53.560 --> 17:02.960 And if you watch videos of people who are reporting abuse happening, you often can't tell who is saying what to whom and what's happening. 17:02.960 --> 17:04.940 Especially in 60 seconds. 17:07.080 --> 17:10.900 Reporting is done differently as well on every different platform. 17:11.040 --> 17:23.680 So that's like if we went to Vegas and you call 911, but then if you went to Henderson and you had to send them a fax, and then if you went to Reno and you had to show up in person. 17:24.240 --> 17:33.760 When you use public safety services, if you had to call for help in a different way in every different city you went to, you would never use 911. 17:33.760 --> 17:42.740 And I think companies are finding that it's the same way if you don't have standardized safety protocols across different XR platforms and XR worlds. 17:46.410 --> 17:59.430 Generative AI looks promising as a tool to help, but it does not yet have the discretion or the contextual understanding necessary to help with the nuance that will be required for helping to modify or govern user behavior. 18:00.110 --> 18:08.630 Realistically, AI based solutions are several years away from having sufficient sophistication, enough data and adequate training to work in spatial environments. 18:11.700 --> 18:18.860 So, overall, the differences between social media and XR are stark. 18:19.460 --> 18:26.880 And they emerge from the interactive features of immersive experiences and the neurological impacts that this has on users. 18:27.080 --> 18:31.380 And this has resulted in violations of what I called the right to mental privacy. 18:31.620 --> 18:35.180 Other scholars in Chile have called this neuro rights. 18:35.300 --> 18:43.220 Brain-computer interface scholars are talking about a battle for your brain. 18:43.740 --> 18:47.580 There's a new book that came out discussing that . 18:47.580 --> 19:13.840 And they're all part and parcel of the same thing where the sanctity of the content of your thoughts and the inferences that can be made about your health and your sexual preferences, your political preferences, your gender, your age, all of these things we can determine from data flows really shouldn't be used to send you advertisements. 19:14.980 --> 19:18.400 If so, I think it's actually a failure of the imagination. 19:25.340 --> 19:28.380 I think that's a good way to turn it to us. 19:29.940 --> 19:38.420 And one of the things that really strikes my mind is it's not just the gaming experience. 19:38.420 --> 19:44.600 This is moving beyond so many different aspects and potential. 19:44.600 --> 19:59.000 So as Britton was talking about, moving into the healthcare environment, that your healthcare will be delivered potentially through this data that is being collected from your physical reactions. 19:59.000 --> 20:04.500 So the questions start to become, is this data painting a correct picture? 20:04.500 --> 20:06.000 Is this the full picture? 20:06.000 --> 20:09.140 Is it picking up on all the nuances? 20:09.440 --> 20:11.700 And who's getting access to that? 20:11.800 --> 20:24.520 And there's a big difference between what I may post on social media at 2am when I am fired up about something and what I would actually say or do. 20:24.520 --> 20:38.740 Or you think of a lot of the, as we saw during remote environments where people were having job interviews over Zoom or other conference calling. 20:38.800 --> 20:47.420 And a lot of it dealt with, there were companies, and some states have started taking a harder look at this, where they were creating biases. 20:47.420 --> 21:08.460 That if you didn't make the proper amount of eye contact, or if it looked like you were distracted during, because the sensors on the screen weren't picking this up properly, that suddenly you were getting penalized during your job interview because you weren't meeting this set standard. 21:08.460 --> 21:29.060 And so now what happens when we take that and all of those AI data sets that are expecting certain behaviors, they're not expecting children to start drawing inappropriate things, which anyone who's been in an elementary school, you should have expected it. 21:29.060 --> 21:37.840 And you should have expected fart jokes, you should have expected lots of poop, and all those different things. 21:37.840 --> 21:49.040 But what happens when we're trying to create protections, and we're trying to do all this with a bias towards, like, we're already starting so far behind. 21:49.040 --> 22:10.280 And now we're taking all these other little cues of how does the VR headset, like how does that experience know that it wasn't because a spider crawled across your foot or someone else in the room thought it would be hilarious to tap you on the shoulder as you were playing the game or , 22:10.280 --> 22:35.680 or, I'm not saying this has ever happened, I've definitely never done this to someone playing, but what happens if you move furniture while they're in the middle of and suddenly they're tripping over something because it was really freaking funny and it serves them right but suddenly that reaction is getting captured and how do you know that I haven't logged in to Britton's account? 22:36.000 --> 22:48.740 That I'm not playing as her and should I be so lucky to have all the sensors pick up and be like, hmm, you have the same facial structure, you have all this and I'm like, yes I do. 22:48.820 --> 22:50.980 Yes, that's right. 22:50.980 --> 23:02.700 Or, you're just off today or heavens forbid, I think of all the times I've tried to log in to my iPhone and it's like facial recognition, not recognition, I'm like, wait, what? 23:03.540 --> 23:11.500 No, oh my god, are you telling me I didn't get enough sleep last night and suddenly, or oh, god, is my resting bitch face back? 23:11.500 --> 23:13.160 Like, oh, I didn't mean to do that. 23:13.160 --> 23:18.520 So how do regulators and how do you work all those different aspects in? 23:18.520 --> 23:20.340 Because we're already playing catch up. 23:26.240 --> 23:38.780 One of the things that I like to do when I talk to regulators is tell them the type and quality of information you can get about a person from these data flows. 23:38.780 --> 23:41.500 And I realize I didn't mention that before. 23:41.560 --> 24:04.220 There was a study that came out last week this is the absolute newest information from UC Berkeley and the study said that a machine learning model was able to accurately predict the height, weight, age, marital status of a user in XR by the way they moved. 24:07.770 --> 24:21.130 So I know earlier I said that it doesn't go into the realm of personal identifying information, but initial studies are starting to show that you can actually tell somebody's foot size by the way they move. 24:21.130 --> 24:45.810 The lab at Berkeley and the lab at Stanford have had some similar studies and Berkeley came out with a study that said there was 100 seconds of recorded data you could uniquely identify a person in XR with 94% accuracy from a data set of 50,000 people. 24:46.950 --> 24:54.830 Stanford did this earlier but the data set was a couple thousand people, it wasn't statistically significant. 24:55.350 --> 24:57.590 50,000 people. 24:57.590 --> 25:07.390 That might be you in the Taylor Swift crowd by the way that you tilt your head and point can be uniquely identified in an immersive environment. 25:08.310 --> 25:18.350 The type of medical and sort of human rights oriented information that I'm concerned about really is tied into eye tracking. 25:19.270 --> 25:38.170 So the type of information you can get by somebody's pupil reaction you can tell who somebody is sexually attracted to you can tell whether or not somebody is likely to be telling the truth and you can also tell whether or not somebody shows preclinical signs of certain medical ailments like schizophrenia, 25:38.170 --> 25:40.910 ADHD Parkinson's and Huntington's. 25:41.010 --> 25:56.950 These are preclinical signs these are things you may not know about yourself yet, your doctor may not know about you yet and a company if they were to parse the data set would have access to that information. 25:57.630 --> 26:01.290 This is what I mean by the right to mental privacy. 26:02.150 --> 26:17.830 It's not just the content of your thoughts, it's the implications that can be made about who you uniquely are your medical conditions and the type of behaviors that you may choose to engage in or not. 26:19.950 --> 26:36.230 One of the things we're seeing is the states are starting to try to play catch up because, keeping in mind data brokers are taking this information and creating these pictures and they're selling them. 26:36.290 --> 26:46.090 And the regulations really are not keeping up with who should have access to this and how do we protect it. 26:46.290 --> 26:51.410 And it's also what happens if it gets wrong. 26:51.630 --> 26:57.370 That one out of 50,000 it's wrong. 26:57.610 --> 27:05.230 But yet this is now flagged in a file and it's you know as a child you're told this will go down in your permanent record. 27:05.850 --> 27:16.650 Well how do we fix that permanent record when it's our biometric and it's our mental information that, oh wait, you know, objection your honor. 27:16.650 --> 27:19.810 I was just having a bad day and that wasn't me. 27:20.450 --> 27:26.950 Or the, you know, it that was someone else and that piece of information. 27:26.950 --> 27:29.170 So it's not the entire picture that gets off. 27:29.170 --> 27:30.890 It's just one piece. 27:30.890 --> 27:32.350 How do you fix that? 27:36.970 --> 27:38.810 I don't have a good answer for that. 27:38.810 --> 27:40.430 I wish I did. 27:40.430 --> 27:45.970 Because right now these type of data sets aren't auditable by the public. 27:47.070 --> 27:58.090 In certain jurisdictions people are proposing a right to have all your user information about you available, but these are profiles made to sell you something. 27:58.390 --> 28:02.130 It's not an essential part of your user account and things. 28:02.870 --> 28:08.390 Another thing I tell regulators is that you can't outsmart the machine. 28:08.390 --> 28:14.650 Because a lot of them think that somebody advertising something to me, that's obvious. 28:14.650 --> 28:18.630 That's not I'm not going to fall for that. 28:18.890 --> 28:24.910 In XR environments you can actually switch out elements in the environment at blink rate. 28:27.550 --> 28:43.130 It's been done in experimental context but there's nothing saying that you could have somebody with a can of soda and switching out Coke and Pepsi and tracking somebody's more positive reaction to one versus the other. 28:43.510 --> 28:52.830 It's kind of like that social psychology experiment where you're told to count the number of basketball passes and so you miss the gorilla walking in the background. 28:53.930 --> 29:06.450 It's a similar type of a dynamic where people think they're smarter than the system, but the system works faster than you can articulate your preferences or requests cognitively. 29:07.670 --> 29:11.010 And that's a really kind of funky, scary thing. 29:11.110 --> 29:22.110 If you watch sports and Liz is here and I'm back in California, Liz and I will actually see different ads behind the players. 29:22.950 --> 29:30.190 Augmented advertising is already a thing and it's based on your zip code. 29:31.050 --> 29:38.230 And somebody in the stadium will see even different ads than Liz or I would see on different network channels. 29:38.250 --> 29:40.190 They sell this space. 29:40.410 --> 29:49.690 Advertisement in an immersive context is more about targeting and personalization than it is in an offline context. 29:49.690 --> 30:01.710 And that makes sense, but the capacity and the ability to really target it to people makes XR the most persuasive medium that we've developed so far. 30:03.010 --> 30:08.690 And one of the things that we saw and we keep going back to is the data sets. 30:08.690 --> 30:10.230 What is it getting based on? 30:10.230 --> 30:25.010 Where are those data sets getting built from that are creating some of these models and being able to audit it and being able to audit and get to your information and make sure, like, hey, is this the picture that I see? 30:25.210 --> 30:40.610 And basing it on a bias towards, well, English speaking, US based things, when you're talking about an immersive experience that is intended to open up the world. 30:40.610 --> 30:50.110 Like, the idea is that you were playing and you were experiencing things with people in any different physical location. 30:50.110 --> 31:06.490 So now how do you build the rules and even train that it's getting it right when not everyone's going to look the same, react the same and different cultures have built in different mannerisms. 31:06.890 --> 31:16.490 And as we saw with a lot of the, you know, again, even just trying to unlock your iPhone, heavens forbid, you're a woman of color. 31:16.490 --> 31:17.930 Because guess what? 31:17.930 --> 31:22.210 All of the modeling that was based on was not you. 31:22.350 --> 31:23.890 Not even a little bit. 31:23.890 --> 31:26.850 And so they had to go back and say, oops, our bad. 31:26.910 --> 31:45.310 Well now, what do we do when we're talking about collecting all this data and it's like, on the reactions of you know, we talk about a lot in the medical world, a lot of the early training was done and it wasn't done based on women's bodies. 31:45.570 --> 31:53.530 And it wasn't based on... so it's like, oh, well, you're going to react to this medication in the following manners, or these are the following symptoms. 31:53.530 --> 31:57.290 It's like, but no. 31:57.550 --> 31:58.710 I am not. 31:58.710 --> 32:17.770 So now you've got the VR and it's assuming, heavens forbid, I don't want to be a redhead middle aged woman in my, like, I want to be a kick ass like ninja dragon, whatever the hell I want. 32:18.110 --> 32:40.330 So how are we going to start building that and work on regulators when you've got because, again, heavens forbid, heavens forbid that Australia, the US, New Zealand like, insert country, get the upper hand in being the regulator who sets the rules for this. 32:40.330 --> 32:43.410 Because, oh no, we can't let Canada do that. 32:43.410 --> 32:45.750 I mean, they're just nice and maple syrup. 32:46.450 --> 32:59.950 So how do you broach those conversations when you're going all over the world and talking to them and saying, no, no, no, we need to let this country take the lead or play nice with them and not share the data. 33:06.860 --> 33:17.480 If y'all notice, I give Britton all the really hard questions because this is what she gets for being so smart and being a professor, shaping young minds that are creating this future. 33:17.480 --> 33:18.200 So, sorry. 33:18.220 --> 33:21.300 But those aren't young minds, those are like crusty old minds. 33:21.300 --> 33:23.640 That's why I'm like, hmm, about this. 33:25.080 --> 33:29.800 A lot of people in Europe argue that GDPR should cover it. 33:29.960 --> 33:36.180 They argue that Article 1 of GDPR should cover all of the privacy protections for XR and then we're done. 33:36.460 --> 33:38.220 I take issue with that. 33:38.780 --> 33:46.000 Because these are new types of data flows and they're not really anticipated by the regulatory structure. 33:47.220 --> 33:53.540 And they're more akin to medical data to me than they are personal identifying information. 33:56.800 --> 34:10.540 The Future on Privacy Forum just did a really optimistic study where they determined that biometric laws are , biometric laws in the US are covered by state based law. 34:10.780 --> 34:23.080 And if you have a business that creates XR products , you know this because there are certain states you're really, really worried about selling in and certain states you may choose to not release your product in. 34:23.360 --> 34:26.940 And those may be Illinois, Washington, or Texas. 34:28.200 --> 34:39.480 There are other states that have privacy laws, not biometric laws, but you think about, sometimes I talk to regulators and I ask them if they've tried Smell-O-Vision. 34:40.300 --> 34:42.260 And they look at me like I'm nuts. 34:42.580 --> 35:01.020 And I tell them that in the lab and in commercial context now, you can actually go before a campfire in XR and you don't just hear the campfire and you don't just see the campfire, you can actually smell the charcoal and in the lab we put a little toasted marshmallow in there as well just for fun. 35:01.780 --> 35:04.900 You can go into a garden and smell flowers. 35:06.820 --> 35:11.440 These type of inputs are really not anticipated by law . 35:13.100 --> 35:24.780 Also, there was a company that recently released a breath gauge for a meditation app. 35:25.020 --> 35:28.780 And my question for them is is that biometric data? 35:28.920 --> 35:34.400 It could be body-based data based on some of the states so it would be regulated as such. 35:34.400 --> 35:36.320 In other states, it wouldn't be. 35:36.560 --> 35:59.140 I think the way that I make regulators understand this is I try to actually bring them into the developer's mindset and bring them into the chair of somebody who has to make a decision about selling and producing these products and doing so in an environment that is ambiguous at best. 36:03.190 --> 36:06.030 Some countries are better about it than others. 36:06.450 --> 36:11.570 Australia has an e-safety commissioner's office so they're very, very motivated. 36:11.570 --> 36:16.550 New Zealand is very concerned about public safety in the online context. 36:16.550 --> 36:19.530 France has had a national metaverse strategy. 36:19.950 --> 36:28.390 China and Colombia and one other country have started to hold trials in the metaverse. 36:28.390 --> 36:30.170 Don't do that by the way. 36:30.170 --> 36:31.730 That's not a good idea. 36:32.990 --> 36:36.570 Countries are starting to engage in little ways. 36:36.710 --> 36:43.510 I think Bahamas had an embassy in the metaverse. 36:44.830 --> 37:05.490 I think the way to actually get to these countries is to talk to them more about their economies and corporate environments and that should get them more motivated rather than talking about digital diplomacy and kind of a new sovereign space or other type of nonsense things. 37:06.330 --> 37:09.730 When you think about how even in the U.S. 37:09.930 --> 37:28.470 a lot of our laws that touch on things that we deal with day to day, the DMCA, CFA, a lot of them came because members of Congress for example were afraid that their blockbuster rental history was going to be published. 37:28.990 --> 37:29.950 Oh yeah. 37:29.950 --> 37:34.470 Or they saw a movie and they said, you know what? 37:34.470 --> 37:35.470 War games. 37:35.470 --> 37:36.490 Huh. 37:36.530 --> 37:37.510 Huh. 37:37.510 --> 37:58.170 So I love that idea of putting it in that personal context because unfortunately that does ground it for them and show them because so often we spend time chasing the technology like oh we have to react to this when it's like no let's look at what it's actually doing. 37:58.170 --> 37:59.610 What is it doing at its core? 37:59.610 --> 38:01.750 What is the actual concern? 38:01.770 --> 38:03.750 And then how do we build from there? 38:03.750 --> 38:32.130 So I love that you're getting them that hands on but how do y'all scale that kind of advocacy or how do we as a community of users who are concerned about or builders how do we take that idea and that approach and scale it beyond and bring it down to that local level or that regional level of hey do this, 38:32.130 --> 38:35.670 see this, experience this and know that this is going to impact what you're doing. 38:36.490 --> 38:38.750 I think you don't use law. 38:39.390 --> 38:50.810 I want to call out someone in the front row Caroline Cinders who's research about how to use effective design to create healthy online communities and environments is awesome. 38:52.170 --> 38:53.270 Yay! 38:53.910 --> 39:11.910 So looking at design based principles, looking at social psychology about how we create cultures some of my very boring academic work focuses on the theory of code as law and how that has ignored norms. 39:12.210 --> 39:17.650 And norms are the way that we create culture and we self regulate our own online environments. 39:17.650 --> 39:27.150 And try not to place the full burden on users but distribute it collectively amongst a whole community. 39:28.170 --> 39:31.530 It seems like a cop out answer because I'm a lawyer. 39:32.830 --> 39:35.510 But this isn't a legal problem I think. 39:35.510 --> 39:42.850 It's more of a social problem and an issue of science not catching up to politics. 39:45.030 --> 39:52.090 Well and I think that also putting it on the users overlooks the builders , the makers. 39:52.090 --> 40:09.490 Like if we are intentional from the design aspect and when I say we, I mean the people at the companies who are building it from product to engineering to all that understanding and seeing that big picture and knowing when to call it oh this is going to impact this. 40:09.750 --> 40:10.690 Let's be intentional. 40:10.690 --> 40:12.950 Let's bring them into the conversation. 40:13.230 --> 40:19.350 So as a DEF CON community I think that's one of the easiest ways to start. 40:19.390 --> 40:20.990 I was like start the change. 40:21.210 --> 40:31.910 And I think we can also be really intentional about how we design these products and who we are accommodating when we design them. 40:32.730 --> 40:36.690 How many people here are familiar with simulator sickness? 40:36.850 --> 40:38.270 Probably a bunch. 40:38.310 --> 40:48.370 If you're not, it's if you've gone into a VR world and you feel nauseous and sick to your stomach and really disoriented that's simulator sickness. 40:48.890 --> 40:56.610 In the earlier iterations of headsets more women than men reported simulator sickness. 40:56.610 --> 40:58.330 People started to write about this. 40:58.330 --> 41:11.530 Some said it was just my delicate female constitution and the fact that I may produce babies one day or the fact that I don't play first person shooter games. 41:11.530 --> 41:12.510 It's all bullshit. 41:12.910 --> 41:21.730 What actually was happening was that the headset was designed for an average male form between 5'10 and 6 feet tall. 41:21.730 --> 41:26.450 There is one measurement that is essential to preventing you getting simulator sickness. 41:26.450 --> 41:28.890 It's the interpupillary distance. 41:28.890 --> 41:31.750 The distance between your eyes. 41:31.750 --> 41:36.470 If you go to the optometrist, they measure this to put you in a pair of prescription glasses. 41:36.890 --> 41:42.270 The interpupillary distance on early VR headsets was not adjustable. 41:42.570 --> 41:48.050 So it was akin to putting 51% of the population in the wrong pair of glasses. 41:48.710 --> 41:52.990 No wonder women were reporting sickness and discomfort. 41:53.130 --> 42:01.070 And there were studies following that by Jessica Outlaw that actually showed people that women weren't returning to VR environments because they felt uncomfortable. 42:01.830 --> 42:04.270 There were similar studies that came out. 42:04.270 --> 42:11.610 One from the MIT Media Lab where there was a researcher doing her master's thesis work in Nairobi. 42:11.710 --> 42:25.210 She took Oculus Go to try to put it on Kenyan entrepreneurs and she found that with the women 50% of the time the strap snapped when she tried to fit it over their hair. 42:25.710 --> 42:28.570 50% of the time. 42:28.670 --> 42:35.190 She ended up deviating from her master's thesis to design an adjustable fucking strap. 42:36.050 --> 42:44.050 Easy fix if you think about the wide beautiful variety of people who you want to be your customers. 42:44.050 --> 42:49.090 It's smart to think about the wide diversity of body shapes and types. 42:49.970 --> 42:54.510 Disabled populations are some of the earliest adopters of XR hardware. 42:54.830 --> 43:01.190 And they are the last people that many companies think about when they design these products and services. 43:01.530 --> 43:10.350 Oculus didn't change their vantage point to make it adjustable whether or not I was standing or sitting until update 31. 43:11.130 --> 43:20.170 And it came on the heels of a Scientific American article that showed that somebody had to modify an Xbox controller to use a rock climbing game. 43:20.370 --> 43:25.830 They were a user with muscular dystrophy and so they really wanted to know what rock climbing felt like. 43:26.490 --> 43:30.910 And they had to modify it themselves because the game wouldn't accommodate them. 43:32.970 --> 43:37.130 This is something that we can do as a community. 43:38.370 --> 43:52.490 So when you're doing your prototype testing or your platform building or your experiential design, think about all of the people you want in your world. 43:52.590 --> 43:53.910 And then go bigger. 43:54.930 --> 43:55.690 Yeah. 43:55.690 --> 44:06.810 And I think bringing it back to what Britton was talking about before is like that full stack of an understanding it's not a level playing field. 44:06.810 --> 44:10.210 And by that I mean it's not a flat screen. 44:10.250 --> 44:23.130 And so as you're building and as you're designing, taking all of those different aspects and also incorporating it into the conversations on the biometric data. 44:23.130 --> 44:24.090 What exactly? 44:24.090 --> 44:27.090 So we're not using those same definitions. 44:27.550 --> 44:29.390 It's not the same game. 44:29.390 --> 44:36.450 And being, again, intentional in how you're building, how you're designing, but also how you're approaching it. 44:36.450 --> 44:41.990 And be it with the conversations you're having with regulars as you're watching that. 44:42.090 --> 44:44.610 I think really just kind of bringing it all. 44:44.610 --> 44:48.450 This is not, you know, this is an immersive environment. 44:48.450 --> 44:51.250 It is the entire all encompassing environment. 44:51.670 --> 44:59.010 And there's some best practices that you can follow as developers or even as security experts. 44:59.090 --> 45:05.330 A best practice for XR is to actually keep the data on device. 45:06.230 --> 45:09.890 That means that you have to get a warrant to access the data. 45:10.550 --> 45:16.350 The problem with that is it really impedes your processing speed. 45:16.350 --> 45:18.590 It's very, very expensive. 45:18.710 --> 45:20.590 It kind of drains your battery. 45:21.310 --> 45:43.230 So the other thing you can do is when you're looking to third party cloud providers, you can be really deliberate about asking them about their data retention, storage, disposal, all of their data policies because what your third party data provider does is basically what you do. 45:43.310 --> 45:45.850 And being a savvy customer. 45:45.970 --> 45:55.110 So pushing back if there aren't privacy protective services like you feel meets the threshold that you want to protect your users. 45:56.090 --> 45:59.410 And that's excellent because the change starts with calling it out. 45:59.690 --> 46:18.510 And bringing it to the attention of and paying attention to because you also think of all the different users and whether they're going to understand a 12 year old child is not going to care about all their different things, but it's like all they know is there's a lag time. 46:18.810 --> 46:19.490 And they're annoyed. 46:19.490 --> 46:26.570 It's like, no, let's make sure that we are paying attention, that we are bringing it in, and that we are reporting it, raising it. 46:26.570 --> 46:28.450 It's kind of the name and shame. 46:28.970 --> 46:34.310 Hey, this is a great game that you've created for children or geared towards this market. 46:34.390 --> 46:37.810 Now you're creating their permanent record for their school. 46:38.110 --> 46:49.510 The equivalent of that example that's going to follow them forever and is going to be based on AI modeling and data points that are not necessarily accurate. 46:49.510 --> 47:02.770 I mean, they're going to be based on, if we're looking at the early sets, the 5, 11, 5, 10 male interactions and all of that different thing. 47:02.770 --> 47:18.970 If you had to think of one way to bring it home, of how you're dreaming of electric sheep, what are some good takeaways other than, I mean, I love what you were saying with the proactive steps. 47:19.030 --> 47:21.270 What's a good nugget? 47:21.570 --> 47:23.230 What's the quote? 47:25.790 --> 47:28.150 It's the hangover spot on Sunday morning. 47:28.150 --> 47:29.690 I don't know if I have a quote. 47:40.350 --> 47:49.010 Someone asked what is inspiring in this space, which is a great question to end on because it's all doom and gloom when I go to the dinner party. 47:49.750 --> 47:51.290 XR is magic. 47:52.510 --> 47:53.830 It's magic. 47:54.570 --> 48:01.830 It makes, it can it can make you feel like you are in a different body. 48:02.070 --> 48:09.530 You start to embody the characteristics of your avatar in a social environment within two minutes. 48:09.990 --> 48:15.690 So if I make myself an eight foot tall dragon, I'm going to dominate that space in two minutes. 48:16.450 --> 48:25.230 It takes two and a half minutes for me to put you in my lab context and give you a third arm and have you pop three balloons at the same time. 48:26.570 --> 48:28.770 Neuroplasticity is magic. 48:28.770 --> 48:35.770 XR is a means to access your neuroplasticity, your imagination is really the limit. 48:35.770 --> 48:38.710 And we've never had a technology like this before. 48:38.930 --> 48:41.210 So let's not fuck it up. 48:41.510 --> 48:42.890 That's my quote. 48:42.970 --> 48:44.330 I like that. 48:44.330 --> 48:53.310 Thank you so much and thank you to the XR village for bringing this topic, inviting us. 48:53.410 --> 48:56.230 Please go check it out if you haven't already. 48:56.230 --> 48:58.050 I'm Lawyer Liz on Twitter. 48:58.050 --> 49:00.710 Please feel free to engage. 49:00.710 --> 49:02.550 I'm Britton Heller. 49:02.550 --> 49:06.990 You can find me as Britton Heller on Twitter or on LinkedIn. 49:08.170 --> 49:09.930 Thank you so much.