Editor’s note: WRAL TechWire contributing writer Jen McFarland has 20+ years working in IT with experience across a range of tools and technologies. She want to help small businesses and teams design, improve, and maintain the technology that helps them succeed. In 2022 she incorporated Marit Digital.
+++
RALEIGH – Last week, Apple officially waded into the VR arena with its much-anticipated Vision Pro. While Apple’s price point is considerably higher than competitors like Meta’s Quest devices and Sony’s Playstation VR, the addition of such a major player in the market seems to indicate a “watershed” moment for the industry. Much like AI, 2023 seems to represent a big step forward for this transformational technology.
And like AI, there are concerns. VR has been less talked about but brings its own issues with security and privacy. And unlike other online platforms, privacy and security tools have yet to be widely developed for VR tech.
Identification from Motion
A study from February of this year, entitled “Unique Identification of 50,000+ Virtual Reality Users from Head & Hand Motion Data” revealed a high success rate at determining a user’s identity based solely on their motion data. The study authors trained an AI classification model using 5 minutes of data per person with a pool of 50,000+ users. The model then attempted to identify users based only on their motion.
The model was able to identify users with 94.33% accuracy after only 100 seconds of movement data; the accuracy rate was 73.20% accuracy after just 10 seconds of motion. Fingerprints, by contrast, are accurate 98.6% of the time, and facial recognition has an accuracy rate of around 99.8%.
Apple WWDC preview: New AR/VR headset & operating system, more Mac models
According to the paper, it has long been understood that individuals exhibit distinct biomechanical motion patterns that can be used to identify them. In this case, the study authors used machine learning to “learn” head and hand motion by tracking position, velocity, and acceleration in relation to virtual objects in the environment. The VR users providing data represented a diverse group, including individuals from more than 40 countries and using more than 20 different types of VR devices. While past papers have attempted to assess the potential of motion data to track identity, this is the first time a study has used such a large and diverse group for their data.
More data to be found
For many, the anonymity of virtual reality was a big part of the attraction. The idea that users can not only be identified but identified relatively quickly should raise concerns for users. And beyond the ability to discern identity, movement data can also be used to derive personal details, such as height and weight, gender, age, and potentially even health.
The study authors believe a higher rate of accuracy is achievable. More data collected would naturally lead to more accuracy in the assessment. Also, the classification model used could be improved with more time and training. But study authors are aware of the dangers inherent in the data. They suggested the development of “defensive” applications and techniques, specifically an intelligent “corrupting” of VR replays that could help obfuscate identifiable motion.
Gateway to metaverse? Meta’s new VR set is impressive (watch these videos) but …
Self-protection in VR spaces
In the meantime, VR early adopters face risks in an industry still grappling with how to protect the many new forms of data available in the space. Another study published in January of this year, “SoK: Data Privacy in Virtual Reality”, cataloged a wide range of personal data available to “adversaries” in a VR space including stress levels, language semantics, and even real-life location data.
According to the Data Privacy study, users should consider VR devices with privacy features, such as cameras and microphones that are inactive during sleep mode. In addition, users should consider privacy technology like VPNs to prevent tracking. VR applications can also include malicious code, so VR owners should use discretion when deciding what to download. And as with any technology, the paper says, “Users should be mindful of the amount of personal information they are willing to share with the VR application.”
