Proc. ACM UIST '98 (Symp. on User Interface Software and Technology),…

Proc. ACM UIST '98 (Symp. on User Interface Software and Technology), San Francisco, CA, November 2­4, 1998, 171­172



            Of Vampire Mirrors and Privacy Lamps: Privacy
          Management in Multi-User Augmented Environments
    Andreas Butz, Clifford Beshers, Steven Feiner, Dept. of Computer Science, 1214 Amsterdam Ave.
  450 CS Building, Columbia University, New York, NY 10027, {butz,beshers,feiner}@cs.columbia.edu


ABSTRACT                                                                                          are public, while all other things on a user's computer screen
We consider the problem of privacy in a 3D multi-user col-                                        are private by default, because most items on the screen in-
laborative environment. We assume that information objects                                        herently have nothing to do with the collaboration. Our sce-
are represented by visual icons, and can either be public or                                      nario requires an approach between these two extremes. We
private, and that users need effective methods for viewing                                        clearly need private information in a collaborative context,
and manipulating that state. We suggest two methods, which                                        and therefore must remove some objects from other people's
we call vampire mirrors and privacy lamps, that are unobtru-                                      views. On the other hand we want the different views of the
sive, simple, and natural.                                                                        shared space to be as similar as possible to enhance spatial
                                                                                                  orientation and provide common reference points. Therefore,
KEYWORDS: Augmented Reality, Virtual Reality, Privacy,                                            we set objects to be public by default.
Collaborative Work
                                                                                                  Managing privacy in augmented environments
Introduction                                                                                      Users need to be able to modify the privacy state of objects
Privacy is an important issue in the design of any multi-user                                     and to review the state of all objects quickly. We want visual
system. We present two methods for visually representing                                          and interaction metaphors that support these tasks simply and
and manipulating the privacy state of objects in multi-user                                       efficiently. At the same time, we want these metaphors to
3D environments. These methods are being developed for                                            enhance the user's sense of a natural physical space. We
a proposed networked collaborative immersive environment                                          excluded standard UI components (e.g., menus and dialog
[3] incorporating camera imagery and synthesized graphics                                         boxes), on the grounds that they were not part of the real
[5]. Each user will sit in a physical telecubicle whose two                                       world. Similarly, we discarded methods such as encoding
walls and desk are stereo projection displays. A set of up                                        privacy state with shadows cast by colored light sources,
to four remote telecubicles will be assembled electronically                                      which, though based on physical reality, are not at all in-
into one large virtual room (see Figs. 1 and 2). A user's                                         tuitive. In general, we feel it is wise to be very careful when
local cubicle is an augmented computing environment ([4])                                         overloading rendering properties with application semantics.
containing both physical and virtual objects, while the phys-                                     For example, we decided that marking privacy state by color-
ical and virtual objects in the remote cubicles appear locally                                    ing objects would interfere with other semantics attached to
only as rendered models. For this work, we assume a simple                                        object colors. We also considered screens local to each ob-
model of privacy: public objects can be experienced (e.g.,                                        ject that could be placed manually and would hide objects
seen) by other users, while private objects cannot.                                               in a way similar to Japanese folding screens, but decided
                                                                                                  that though this was very natural, it would produce a great
Contributions from virtual environments and CSCW
                                                                                                  deal of visual clutter in close vicinity to the objects. Finally,
While research in multi-user virtual environments is a grow-
                                                                                                  although in the initial scenario there is a maximum of four
ing area, most of the focus is on friendly collaboration, as-
                                                                                                  users, we have tried to keep in mind the scalability of the
suming equal accessibility and visual appearance of the en-
                                                                                                  metaphors to many users and groups.
vironment to all users. This uniformity is designed to ensure
a strong sense of presence and interaction in the shared envi-                                    Privacy and publicity lamps
ronment. The exception is Bullock and Benford [2], who dis-                                       One idea with which we are experimenting, that meets most
cuss access restrictions based on restricted subspaces of the                                     of the above requirements is to use virtual spot lights to mark
environment. Most desktop CSCW systems take an opposite                                           private areas. Such a privacy lamp can naturally be picked
point of view [1], assuming that only explicitly shared things                                    up and positioned over arbitrary objects. Raising the lamp
Permission to make digital or hard copies of all or part of this work for personal or             increases the area of light on the desktop, allowing more ob-
classroom use is granted without fee provided that copies are not made or distributed             jects to be selected. The effect of the light source on virtual
for profit or commercial advantage and that copies bear this notice and the full citation
on the first page. To copy otherwise, to republish, to post on servers or to redistribute         objects becomes clearly visible by just including it in their
to lists, requires prior specific permission and/or a fee.                                        lighting calculations. In an augmented reality system, the
UIST 98 San Francisco CA USA                                                                      technique can also be applied to physical objects by render-
Copyright ACM 1998 1-58113-034-1/98/11...$5.00                                                    ing the light beam as a transparent volume or by rendering

                                                                                            171
   Figure 1: (left) A private privacy lamp shining on an
   object and (right) the view from another cubicle.

highlighted overlays on the objects it affects. The objects
within the beam will then be omitted in remote views of the
environment. (Recall that physical objects in the local cubi-
cle are rendered in the other cubicles and thus can be omitted
just like virtual objects.) If the lamp and its beam are visible
to other users, then the objects under it may be private, but                Figure 2: A vampire mirror (above) with all objects
their existence will not be a secret, so we allow for the lamp               public and (below) with selected objects made private.
itself to be marked public or private. Alternatively, if the user
chooses to make objects private by default, publicity lamps               mented reality environment. They allow users to review and
can be used to make objects public. Privacy and publicity                 change privacy of objects in a natural way, without learn-
lamps may even coexist, with privacy lamps used to hide se-               ing new interaction methods. The methods were first imple-
lected objects from an otherwise trusted colleague, and pub-              mented in animated VRML'97 worlds available on the web
licity lamps used simultaneously to reveal selected objects to            at http://www.cs.columbia.edu/~butz/vrml/ and are being ex-
an otherwise untrusted adversary. Because the lamps can be                plored in a augmented reality system currently under devel-
moved around in the same way as the other objects in the                  opment in our lab as a virtual prototype for the physical tele-
environment, they allow a user to manipulate privacy state                cubicle environment.
without new interaction techniques. Their light beams give
a clear visualization of private (or public) areas of space and           Acknowledgements
thus allow a quick review of the privacy state of the local part          Thanks are due Blair MacIntyre and Tobias H¨ llerer for
                                                                                                                             o
of the environment.                                                       many inspiring discussions and contributions to the ideas
                                                                          presented here. This research is supported by a stipend from
Vampire Mirrors                                                           the German Academic Exchange Service (DAAD), by the
Another approach that we are exploring uses a selective mir-              Advanced Network & Services National Tele-Immersion Ini-
ror, which we call a vampire mirror, because it reflects public           tiative, ONR Contract N00014-97-1-0838, gifts from Intel
objects, but not private ones. If a user places the mirror so             and Microsoft, and the Columbia Center for Telecommuni-
that all objects of interest are reflected, she can review their          cations Research under NSF Grant ECD-88-11111.
privacy state at a glance: if she cannot see an object in the
                                                                          REFERENCES
mirror, then others cannot see the object either (see Fig. 2).
                                                                           1. Ronald M. Baecker.          Groupware and Computer-
Searching for objects in a mirror is something we do in daily                 Supported Cooperative Work. Morgan Kaufmann Pub-
life, so this is a metaphor that doesn't require new skills. The              lishers, San, Mateo, California, 1993.
privacy state can be modified by interacting with the mirror
                                                                           2. Adrian Bullock and Steve Benford. An approach to ac-
itself. Objects can be made private by touching their image
                                                                              cess control for collaborative virtual environments. In
in the mirror, and they can be made public again by grasping                  B. Pehrson and E. Skarback, editors, Proc. of the 6th
them and touching the mirror with them. We have also con-                     ERCIM Workshop, pages 233­264, Stockholm, 1994.
sidered reflecting a faint image of private objects. This might
                                                                           3. Advanced Network & Services Inc. The National Tele-
make the visual search for an object faster, and making an
                                                                              Immersion Initiative Home Page. world wide web,
object public could be done by touching the object's ghost                    http://io.advanced.org/tele-immersion/, 1997.
image in the mirror. Note that the mirrors obstruct the user's
view in the figure. We can either make the mirrors transpar-               4. Blair MacIntyre and Steven Feiner. Future multimedia
                                                                              interfaces. Multimedia systems, 1996(4):250­268, 1996.
ent, or make them pop-up from the table when needed.
                                                                           5. Ramesh Raskar, Greg Welch, Matthew Cutts, Adam
Conclusions                                                                   Lake, Lev Stesin, and Henry Fuchs. The office of the
The methods presented in this paper take simple metaphors                     future: A unified approach to image-based modeling and
from the physical world to visualize and manipulate the                       spatially immersive displays. In Proceedings of SIG-
privacy state of virtual and physical objects in an aug-                      GRAPH '98. ACM SIGGRAPH, 1998.


                                                                    172