Arca: A Trustworthy and Privacy-Enhancing Smart Home Camera
Arca is based on extensive research, including 60 interviews we conducted with both primary and adjacent users of smart cameras.
We designed Arca to address the experiences of neighbors, guests, domestic workers and other bystanders who interact with and are impacted by smart cameras.
On its face, Arca is a design prototype for a more inclusive, transparent, and privacy-enhancing smart home camera.
As part of a multi-year design research project funded by the National Science Foundation, our work investigates tensions, trust, and tradeoffs with smart devices and surveillance.
Smart home security cameras like Amazon’s Ring Doorbell and Google’s Nest Cams exemplify this issue. These products are used deliberately and incidentally to surveil family members, roommates, guests, neighbors, domestic workers, and passersby.
Our research defines these types of actors as adjacent users who interact with and are impacted by smart devices yet lack the awareness, consent, control, and benefits of use enjoyed by primary users.
We designed Arca to address the experiences of adjacent users who lack awareness, consent, control, and benefits
Arca camera in medium privacy mode, Owners can always unmask video to review events, but other users may be notified.
Our research led to four key principles that informed our design approach:
1
Complex Interaction Models
Accept that the problem is hard and user needs may conflict. Acknowledge that there are inherent tensions and tradeoffs between primary and adjacent users stemming from power imbalances and conflicting needs. Design solutions must find compromises, concessions, or win-wins.
2
Conflicting Needs
Work with and through the primary users. Ultimately they hold most of the power. We explore three basic approaches: - Empower and encourage primary users to extend access/control to adjacent users.
3
Power Imbalance
Discourage primary users from oversensing their environment and from casually and incidentally surveilling adjacent users by providing them with better tools to balance their personal security/functionality with others’ privacy (including members of their household or family).
4
Power Imbalance
Reshape social norms and expectations such that adjacent users come to request or demand better awareness, consent, and control from primary users.
We designed Arca to address the experiences of adjacent users who lack awareness, consent, control, and benefits:
Other smart cameras offer a one-size-fits-all approach to sharing. Arca allows you to customize who you do (or don’t) share access with. The options range from equal Co-Owner to a limited Status View for letting neighbors, tenants, or workers know the location and privacy mode of devices.
Arca's indication system reliably displays when a camera is fully activated (True On) or deactivated (True Off) with a combination of lights, sounds, and physical sensor-overlays. For greater transparency, the camera and a microphone sensors are independently indicated on the device.
Medium Privacy mode adds a removable mask that blurs video and muffles audio. Owners can always unmask video to review events, but other users may be notified. Further, unmasked video is watermarked and the time and user who unmasked the video is visible in the history view.
Strong Privacy mode fully disables the cam/mic from recording. But you can still be notified with text descriptions of events—like when the kids arrive home, or the cat is chewing on plants.
Arca allows you to customize who you do (or don’t) share access with. The options range from equal Co-Owner to a limited Status View for letting neighbors, tenants, or workers know the location and privacy mode of devices.
The options range from equal Co-Owner to a limited Status View for letting neighbors, tenants, or workers know the location and privacy mode of devices.
With Status View you can share only basic information about the settings or location of your device. For example, you can use Status View to show a guest where your cameras are located and demonstrate that they are set to a privacy mode.
If you want to inform others but without sharing any access to your cameras, you can instead send them Arca’s Shareable mode guide. If you simply want to explain or prove how Arca works to someone, you can share the mobile screen guide. This allows them to learn about the different modes, and have greater trust that their privacy is being protected.
If you want to give someone more access, Arca allows you to select from 3 tiered levels. Co-Owner grants them full access. Basic Controls grants them access to displays and mode selection, but does not allow more advanced settings like sharing access or configuring events. View Only limits access to live video/audio and recorded timeline events. If none of these are suitable, users can create a Custom category of shared access.
True On and True Off. Arca's indication system reliably displays when a camera is fully activated (True On) or deactivated (True Off) with a combination of lights, sounds, and physical sensor-overlays.
Medium Privacy is designed to discourage you and other co-users from reviewing videos of your household, guests, neighbors, and so on. This gives you and your household a double peace of mind. Peeking is discouraged, but it’s always an option if something happens.
Medium Privacy mode adds a removable mask that blurs video and muffles audio.
Owners can always unmask video to review events, but other users may be notified. Further, unmasked video is watermarked and the time and user who unmasked the video is visible in the history view.
Medium Privacy is designed to discourage you and other co-users from reviewing videos of your household, guests, neighbors, and so on. Unmasking video is a somewhat tedious process, and the unmasking feature holds users socially accountable by notifying other users if video is unmasked. This gives you and your household a double peace of mind. Peeking is discouraged, but it’s always an option if something happens.
Strong Privacy mode fully disables the cam/mic from recording. But you can still be notified with text descriptions of events—like when the kids arrive home, or the cat is chewing on plants.
Differentiating “on” and “off” states is straightforward with simple electrical devices. But digital devices with sensors, network connectivity, and data processing capabilities contain a multitude of ons and offs. The various sensors, processors, and actuators of these systems regularly permute through countless states of digital on/off, true/false, and 0/1. Given the trend toward “always on” devices, the concept of an off state is often either misleading or irrelevant. Devices that appear “off“ may actually still be sensing or processing data. And devices that appear “on"may be performing a vast array of operations.
To improve trust and transparency, Arca’s on-device indication system clearly defines a True On and True Off state. The in-app indication system parallels the iconography and clarity of the on-device indication.
The True On and Off indicators were designed to intuitively communicate states to adjacent users without requiring instruction. A more subtle function of True On and Off states is to anchor users’ mental model with a floor and ceiling for each sensor. Medium and Strong privacy conceptually fit “in between” the True On and Off states.