Privacy is Dead – Lessons Learned from the Cloud Mirror

I just returned from two weeks at Sundance Film Festival 2010. I was invited to install my interactive art piece “The Cloud Mirror” in New Frontier on Main, the venue devoted to art and interactivity rather than film. The Cloud Mirror is a large portrait LCD TV which displays live video from a camera pointed at the viewer. Casual visitors see themselves live on-screen. Superimposed on the image is a “comic book thought bubble” containing a snarky message. This thought bubble follows the visitor’s face around the screen as they move.

For the adventurous, there is another option. A visitor can pick up a badge from a nearby kiosk. Each badge has printed on it a unique fiducial glyph and a unique numeric id. The visitor then registers at a computer kiosk. They enter the badge’s unique id and log in with Facebook Connect, authorizing my Cloud Mirror application to access their data. Alternately, they can fill out a form with their name, email address, and other questions. Facebook is just “easier.”

Returning to the Cloud Mirror itself, visitors see themselves reflected in the mirror; but instead of a generic message in their thought bubble, they instead see information culled directly from their Facebook profile! Their “favorites” (movies, music, activities) are there; their relationship status; their last status update. But the Cloud Mirror doesn’t stop with Facebook: the visitor’s birthday is used to fetch their horoscope. Their name is used to search IMDB for their movie credits (this is Sundance after all!) and the Internet Sex Offender Registry. All the information gathered in this way is packaged up into little messages that fit in a thought bubble (“I didn’t know my name matches 4 registered sex offenders!”)

But there’s another surprise waiting for those wearing bages: When seen in the Cloud Mirror, the fiducial glyph on the badge itself is replaced with a photograph. The visitor is confronted with a “virtual photo album” hanging around their neck, and in that photo album are photos downloaded from Facebook and Flickr photos, those embarassing photos which their Facebook friends tagged them in, and image searches on their name.

What About Privacy?

Do you feel uneasy about this? Are you filled with terror at the prospect of your ephemeral online identity rendered in full color on your face in public? I promise that feeling will pass. People grew comfortable with the Cloud Mirror in stages. The first stage is a casual encounter: walking briskly past the screen they catch a glimpse of their face, and pause to read what the Cloud Mirror has written in their thought bubble. Groups of people gather around: sometimes groups of friends, but often aggregations of random people brought together by the thrill of performing on camera for others. They see how many faces they can fit in the frame, take pictures of one another on camera phones, and laugh together.

And then, someone realizes that this is only part of the story. There’s a registration kiosk, and a pile of badges, and instructions that hint at what the Cloud Mirror *really* does. The ice already broken, the group lines up excitedly to log in to Facebook.

Sometimes, there’s a hold-out. Someone who clings a little more tightly than the others to their illusions of privacy. But peer pressure always wins out in the end. You’ve got a Facebook page… what could you possibly have to hide?

The last stage is when they return a day later. They bring their friends, their family, their spouse. People in their network whose lives they already know. They’re giving their friends the opportunity to share on the big screen. And who on Facebook doesn’t love that?

The Next Generation Cares Less Than You Do

It may seem obvious that a generation that’s had access to social networks since they learned to type would have notions of privacy different from your own. But there’s no clearer illustration of that than the Cloud Mirror. Over the course of the week, I saw groups of junior- and high-schoolers register with the Cloud Mirror without a moment’s hesitation. What happened next was even more fascinating. They would proceed to literally *shove* one another out from in front of the camera, hungry for a moment on stage presenting the social network they’d so carefully cultivated .

There wasn’t a hint of hesitation in their actions. To them, the Internet is for sharing.

If Asked For Your Password

The Internet is for sharing interests and relationships, answering quizzes, and telling the world what you had for breakfast. If there’s a text-input box on a web form labelled “Boxers or briefs,” you can bet that a significant fraction of visitors will cheerfully answer the question. This doesn’t trouble me… I’m guilty of over-sharing too.

What troubles me greatly however is one box in particular that people were willing to fill in: “PASSWORD:”

I used what’s called Facebook Connect to link the Cloud Mirror to people’s online profiles. Facebook Connect is a well-conceived solution to the age-old problem of maintaining separate usernames and password on each website. With Facebook Connect, a participating website can compel its visitors to login instead to Facebook. Facebook responds with the user’s credentials. As a side-effect, Facebook authorizes the website to access the user’s Facebook profile for the duration of the login session. Its growing in popularity, and for many the Connect login screen is a familiar sight.

But entering your username and password into a familiar login screen is simply not safe on any computer other than your own! To be sure, public computers have *never* been safe. What shocked me was the thoughtlessness with which people cheerfully entered a username and password… for the online account that secures a growing amount of their information throughout the Internet!

Implementing Facebook Connect on the Cloud Mirror was an afterthought. I assumed from the start that asking people to enter a username and password was simply too bold. It was by far the most popular way to register.

The lesson here is that if you give someone a shiny trinket, they’ll give you their password in return.

Conclusion

The Cloud Mirror was an oddity at Sundance Film Festival, but an oddity that attracted many thousands of people over the course of the festival, including Robert Redford himself.

For many it was a source of joy which they returned to over and over. For others, it was profoundly awkward. The girl who’s IMDB profile credited her with porn after porn. The woman whose thought bubble said “Facebook says I’m single!” Both she and the man she had just met froze like statues, unwilling to look at one another (too soon!) In my week at the Festival, I heard people discussing the Cloud Mirror over dinner, and showing one another the pictures they’d snapped.

The Cloud Mirror reveals our online identities, but it also reveals that we’re easily persuaded to exchange personal data for a shiny trinket or a quick laugh.