Intentional Unusabilty: Supporting …

                              Intentional Unusabilty: Supporting
                              deniability through unorthodox design

Xianhang Zhang                                    Abstract
University of Washington                          Social software is different from singe user software
Seattle, WA 98115 USA                             because when we use it, we care about how our actions
Xianhang@u.washington.edu                         affect others' perception of us. The design features of
                                                  the software interact with this cognitive, social
                                                  reasoning process or "theory of mind" and affect user
                                                  behavior. However, this influence can sometimes be
                                                  counterintuitive to those versed in traditional
                                                  interaction design. One important set of social protocols
                                                  that we use in our everyday lives is plausible deniability
                                                  - white lies that allow us to hide the true motivations
                                                  for our actions. This paper shows how plausible
                                                  deniability can be achieved in social software by directly
                                                  violating established design guidelines and deliberate
                                                  usability degradation. Such "deliberate unusability" is a
                                                  common feature of social software constructed with the
                                                  theory of mind as a guiding principle and show the
                                                  need for a new set of design guidelines for social
                                                  software that take this cognitive modeling into account.

                                                  Keywords
                                                  Social software, plausible deniability, theory of mind,
                                                  social reasoning, social psychology, usability,
Copyright is held by the author/owner(s).
CHI 2007, April 28 ­ May 3, 2007, San Jose, USA
ACM 1-xxxxxxxxxxxxxxxxxx.
                                                                                                                2




ACM Classification Keywords                               We construct and use these theories of mind to guide
H1.2 User/Machine Systems --- Software psychology,        our social reasoning process and they form a crucial
H5.3. Group and Organization Interfaces --- Theory and    part of how we decide how to act in social situations.
models                                                    When we are interact via social software, the software
                                                          modulates the range of interactions that are possible.
Introduction                                              The design of the software affect what theories of mind
Traditional HCI and interaction design has focused        are constructed and, as a result, what users will choose
around usability. An application is usable if it is       to do. Thus, it becomes possible to use these theories
efficient, effective, easy to use, fun or some other      of mind to construct a model of user behavior and how
metric pertaining to the subjective experience of the     it will emerge through social software design as well as
user. One powerful tool in this approach, borrowed        how to influence and encourage certain group
from psychology, is the mental model. Mental models       behaviors through this design.
are naïve, cognitive schemas about how objects work
and how one interacts with them, like "The progress       Plausible deniability
bar measures how much time is remaining". These           Judging motivations forms an important part of our
mental models provide us with predictions and             social reasoning process because motivations allow us
expectations about the results of an interaction and      to predict how people will react in future scenarios.
usability is enhanced if the user's mental model is a     Plausible deniability is the ability to hide the true
good fit with the actual behavior of the application.     motivations of our actions by providing others with a
                                                          plausible, alternate hypothesis or "convenient fiction"
This mental modeling approach is effective for single     that can explain our behavior. Such motivation hiding
user application interaction but needs to be augmented    acts as an incredibly powerful social tool by allowing us
in the case of social software because users not only     to mitigate potentially socially awkward situations
have a mental model of the application, they also         ("Sorry I didn't answer your call, my cell phone was on
contain "social mental models" or "theories of mind" of   vibrate ") or giving us an advantage in social
the people they are interacting with. We model other      negotiations (playing hard to get in a relationship).
people through these theories like "John thinks he's
shy" or "Lisa likes John". However, theories of mind      In order to support such plausible deniability in cell
differ from the traditional mental models because         phone example, the social situation has to be set up so:
minds are also capable of possessing theories of mind.
This means such theories can be multilayered and                  I know "my cell phone is on vibrate" is a
recursive like "John thinks I think he's shy" or "Lisa            convenient fiction for me not answering.
thinks that John doesn't know that I'm aware that Lisa
likes John".                                                      I know I've told you that my cell phone was on
                                                                  vibrate.
                                                                                                                     3




        I know that you can't know for sure that my         error into the system would support such plausible
        cell phone wasn't on vibrate.                       deniability and allow users to "forget" to invite certain
                                                            people to an event.
        Therefore, you are forced to accept my
        convenient fiction.                                 Default settings:
                                                            Default settings allow us to be ambiguous about
It is this need to support convenient fictions that often   whether we agree with the defaults of the system or
is at odds with conventional HCI. Oftentimes, effective     whether we simply don't bother to change them. For
plausible deniability involves deliberately making          example, if the default action on accepting a friend
software harder to use to enhance the ambiguity             request on a social networking site is that they can only
present in plausible deniability. This paper details        see a limited part of your profile, then you could alter
several design mechanisms for supporting plausible          the default for most of your normal friends so that they
deniability by deliberate usability degradation.            can see all of your profile but keep it at the default for
                                                            certain friends. Those friends who can only view the
Omitting information:                                       limited profile would not be able to tell if that was a
Omitting information is the most direct approach to         deliberate decision or carelessness on your part. But
supporting plausible deniability by directly hiding the     such ambiguity can only be achieved if the default
information necessary to determine motivation. For          setting is plausibly difficult to use. Thus, plausibility can
example, most email systems don't tell you when an          be enhanced by deliberately making the setting more
email you send has been read by the recipient.              unusable by making it harder to understand or placing
Although this information might be useful to the            it in a more obscure location so that users can plausibly
sender, it would also prevent the recipient from            claim "Oh, I can't be bothered changing that".
plausibly claiming "it must have got caught in the spam
filter" when they would rather not have to bother           The nature of a default setting also changes the
replying to an email.                                       meaning of what changes in the default represent. Any
                                                            change from the default indicates that not only do you
Error prone UIs:                                            not prefer the default; you dislike it to such an extent
Making user interfaces deliberately more error prone        that you are willing to expend the effort to change that
can allow users to plausibly claim they made an error       setting. If the default setting when adding friends was
when they actually did something intentionally. This        that they could see your full profile, then by setting
can allow users to avoid appearing to be rude when          someone as limited, you're sending the message to
attempting socially awkward tasks. For example, if a        them that "you're so awkward/creepy/unpleasant that I
group event planning tool had a highly sophisticated,       was uncomfortable with you seeing all of my profile".
foolproof invitation system; it would be hard to            Instead, if the setting was limited by default, then the
plausibly claim that you accidentally forgot to invite      social message you are sending by setting someone as
somebody. Subtle UI tweaks that introduce room for          full is "you're so cool and interesting and close to me
                                                                                                                         4




that I made a special effort to give you more access to       limitations for example which can also limit usability.
my profile".                                                  Finally, if all else fails, then it's always possible to
                                                              pretend to be bad designers who are ignorant of the
Perceived vs actual usability:                                design flaws and who studiously avoid investigating
Plausible deniability doesn't have to involve actual          them.
usability degradation. What is important is that you
believe other people think it is difficult for you to use.    Conclusions:
This means that it could be possible to take advantage        Building social software is very different from building
of perceptual biases to introduce perceived unusability       conventional software and a new set of design
without significantly degrading actual usability.             principles and paradigms are needed for effective social
                                                              software applications. Rather than focusing on usability,
The effect of unusability                                     the most important aspects of social software is the
Social expression                                             facilitating of desirable group behaviors.
Supporting plausible deniability also tends to make
rude actions even ruder. Because a plausible, polite          In this paper, we present a cognitive model called
alternative is present, that I chose not to use it sends      "theory of mind" that allows designers to predict user
the message that I want you to know that my                   behavior based on a set of cognitive reasoning
motivations are indeed rude. This is not necessarily a        principles. We focus on the particular design problem of
bad thing in social software as it allows users to            supporting plausible deniability in social software and
express a larger gamut of social messages.                    shown how software sometimes needs to be in direct
                                                              violation of traditional notions of usability to effectively
Plausibly denying plausible deniability                       support such behavior. Supporting plausible deniability
Designing for plausible deniability is only effective if      often involves deliberately making the system less
users are unaware that this was your intention. Once          transparent and more ambiguous through intentionally
users become aware of this, then such actions become          poor usability but such design changes allowed a wider
much less credible. Thus, designers themselves need a         range of social expression to be performed.
plausible reason for their design decisions to make their
software less usable.                                         In the future, gathering empirical data on how theories
                                                              of mind interact with software design and how users
If the initial design of the software is usable, then it is   perceive others through the lens of social software
very hard to justify design decisions making it less          behaviors would allow more accurate and powerful
usable. However, if is hard to use to begin with, then        prediction models to be built and a better
designers can simply claim that improving that                understanding of the design challenges uniquely facing
particular aspect of usability is not a priority. Designers   social software.
can also claim their design decisions were motivated by
other concerns, a concern for privacy or technical