Experiment 3: User’s experience of the proposed privacy mechanism 34

participant’s device. This imprecision can certainly be eradicated in the commercial device by embedding infrared sensors with the system so that the camera and sensors are aligned in the same direction.

We also calculated mean error percentage by the users while performing the given tasks.

For multi-user task, the mean error percentage is 3.6%, 2.4%, 3.1% and 2.1% for User A, User B, User C and User D respectively. However, for single-user task, the mean error percentage increased to 9.3%, 14.0%, 6.6% and 9.1% for User A, User B, User C and user D respectively. In figure 2.11, we show the mean error percentage together with the respective standard deviations. These results are appealing and indicate that the above mentioned approach is promising in achieving privacy from pervasive devices even if there are more than two users at the same place with di↵erent privacy settings.

Figure 2.11: Mean error percentage by each user for the given tasks.

2.4.4 Experiment 3: User’s experience of the proposed privacy

2. Does the user feel satisfied when s/he has the trigger to the lifelog sensor of the person in sight?

3. Are the contextual parameters, in this case, geographic location and time al-location for privacy constraints, enough or is there a need to add another parameter?

4. Is the proposed mechanism influential in eradicating the threat of anonymous logging?

2.4.4.1 Participants

We asked 16 users (12 male 4 female) to wear the system for one day. All users were students and among them, 12 were from computer science department while 4 were from other departments. They were explained the purpose of the experiment and briefed about the use of lifelog devices and the way these devices cause privacy concerns among the neighboring people.

2.4.4.2 Results

In response to question 1, all the users denied being captured by a stranger and most of them agreed that they would intentionally change their behavior in case they knew they were being photographed.

In the next step, the users were asked if they had the authority over the remote control of the camera shutter directed towards them. In response to the second question, 14 users replied ‘yes’ and explained that the decision of allowing/disallowing would depend upon their mood and situation. This conclusion strengthens the idea of creating a mechanism which may protect from anonymous logging.

In answer to question 3, 12 users warranted that the geo and temporal constraints are enough to ensure privacy and that the system is very easy to operate. Four users claimed that there can be some other contextual parameters apart from geo and temporal constraints, two of them had no other option in mind at that time. One user asserted that an option of broadening and curtailing of the restricted area should be supplemented in the prototype, which positively allots more authority in the hands of the user. The other user replied that while performing a certain activity we may switch o↵ being logged by neighbors.

Finally for question 4, 7 users made a privacy policy and refrained their partner from capturing them, while the remaining users allowed their partner to log them at their current location. The users who made the privacy policy were all satisfied with the working of the system, because they were cloaked from the sensors of the partner, and the only information being logged was their name, time and location. According to them, it was easy to inscribe a privacy policy and apply restrictions over the passerby’s lifelogging device. The system worked successfully all the time due to the fine range of the infrared LED and receiver that helped in instant detection of human proximity.

2.4.5 Benefits and limitations of the prototype system

The proposed privacy approach is promising in varied situations, especially when people are close to each other during a discussion, and the face is not in the view of the camera but voice is clear and audible to the device. If there were a privacy system with face recognition as a tool to recognize people, it would fail to do so because the faces would not be visible in the situations like the one mentioned above, and the device may continue to log the voice regardless of the privacy setting of users. Moreover, computer vision based technique is not feasible for a lifelog device because huge power is consumed to run these algorithms on a portable device as studied by Anuar et al. in [47]. Our technique does not require execution of complex algorithms, thus, it is viable in a commercial lifelog device where power consumption is considered as one of the significant factors.

The system was able to detect the person in sight from 0.15 meters up to 6 meters accurately when both the users were facing each other. However, in some settings, the infrared transceiver system may be deliberately or accidentally obstructed and, as a result, logging of users with active privacy settings may occur. This weak spot can be prevailed over by embedding a light sensor with the device that may stop it from logging if there is no significant light change near the device for a threshold time. In this manner, the person trying to obstruct the infrared signal to acquire false logs may not be able to log further.

With the current prototype system, the neighboring lifelog sensors are deactivated for 150 seconds when there is a person in sight with active privacy settings. The logging suspension duration is lengthy and can be annoying in gatherings where one person activates privacy and denies logging while majority of people have no issue with being logged by the neighbors. To solve this issue, the prototype device can be configured to resume logging

as soon as there is a person in sight with permissions to log. Furthermore, in case of audio recording, the user wearing prototype system can record a person with active privacy setting even when he is behind that user. The reason is that unlike camera, microphone can record sound coming from all directions. But, using our system the sensors are suspended only when the users are facing each other. To resolve this problem, we suggest that for specifically audio sensor, Bluetooth must be employed to suspend audio recording instead of infrared based human proximity method. In this way, a person with active privacy setting may suspend audio recording by all neighboring lifelog devices at a place without being in their sight.