The Portal Monitor: A Privacy-Aware Event-Driven System for Elder Care

Introduction

Security and ubiquitous computing are often presented as opposites, where trade-offs are required. In the home environment, both security and privacy are critical requirements. Without privacy-preserving design, ubiquitous computing devices and systems can become as much of a risk to their owners as a benefit. This is particularly true when the user population is technologically inexperienced, traditionally a target of fraud, and likely to be suffering the cognitive decline associated with normal aging. Devices designed to assist in monitoring the elderly must therefore be carefully examined in light of their security properties because the population they are designed to assist is particularly vulnerable. We present a targeted design that enhances security and usability while respecting privacy.

The elderly constitute an ever-increasing segment of our total population, and are therefore an important group to consider in system design. As of 2006, 37.3 million Americans are 65 or older, and this figure is predicted to double by 2030 (AOA, 2006). Of these elderly, 30.3% live alone, primarily women (AOA, 2007). Many of these elderly suffer from debilitating conditions: “20% of older US adults have chronic disabilities, 7% to 8% have severe cognitive impairments, roughly one third have mobility limitations, 20% have vision problems, and 33% have hearing impairments” (Freedman, 2002). Evidence also suggests that the quality of elder care is limited, in part due to lack of time and resources by caregivers, who are often unpaid family members volunteering their time (Leenerts, Teel, & Pendleton, 2002; Reuben, Shekelle, & Wenger, 2003). One critical element of our design is the minimization of cognitive load on caregivers, enabling them to make more efficient use of their time, and to give a better quality of care. Thus, our design for privacy also increases usability. In contrast, technologies that often add-on privacy as a post-hoc feature tend to generate so much data and require such attention that usability is decreased (Egelman & Kumaraguru, 2004).

The Portal Monitor described here is designed to be placed inside a home. It monitors activity across portals, such as the front or back door. Portals were selected because they are the primary focus of the occurrences with which our system is concerned – wandering and visitors. Events (e.g., opening the door or ringing the door bell) trigger cameras on both sides of the door to record images. This positioning is designed to enable capture of the most salient features of the event – the physical status of the home occupant (clothing and apparent awareness), the identity of the agent on the outside, and physical indicators of the nature of their interaction. These images are then sent as picture messages (text messages with attached images) to a pre-designated cell phone or phones. A guardian or caregiver can then make use of a device with which they’re already familiar with and commonly have on them (e.g., a cell phone) in order to be sure their loved one has not left the building in a vulnerable state, had an encounter with a known threat, or been approached by an unknown party. When no events are taking place, the system conducts no surveillance. Therefore, human attention is required only when an event occurs. Minimal data are captured, and data deletion is in the hands of the caregiver. Connecting the system’s interface to a device already understood and commonly used by caregivers means that the caregiver is likely to have the device on them and be able to operate it without any further need for training. Because they may not be able to attend to every event received, the system allows the sharing of this duty across several caregivers if desired.