IEEE Technology and Society Magazine - September 2015 - 48

deployment outside of research and medical communities. But the use of these devices will likely become much
more common. We believe, however, the right time to
address these issues is now. Methods to prevent and mitigate these threats should be developed in the early design
phase, and embedded throughout the entire life of the
technology. We view the development of prevention and
mitigation tools as an interdisciplinary effort, as well as a
way to close the loop among BCI researchers, ethicists,
and the science fiction community. Influenced by Wiener's work, in particular his account of information ethics,
this paper represents an initial step towards facilitating
this effort by analyzing the problem of brain malware in
EEG-based BCIs. We examine this problem through the
lenses of Value Sensitive Design, a systematic approach to
accounting for human values in technology design.

Value Sensitive Design
Value Sensitive Design is a theoretically grounded
approach that allows for a principled and comprehensive way of accounting for human values throughout the
design of technology. It leverages a unifying and iterative
tripartite methodology, consisting of conceptual, empirical, and technical investigations. Conceptual investigation focuses on key stakeholders and the values that
they hold important. Empirical investigation engages
with actual or potential stakeholders, with the goal of
evaluating potential success or failure of the investigated technology. In doing so, empirical investigation
leverages a wide range of quantitative and qualitative
methods used in social sciences, including observations,
interviews, surveys, experimental manipulations, and
document collection, as well as measurements of users'
behavior and physiology [24]. Finally, technical investigation focuses on features, architecture, and infrastructure
of the analyzed technology.
VSD has been applied to a large variety of technology design challenges, including human-computer
interaction [24], human-robotic interactions [32], and
computer-supported cooperative work [35]. Due to the
emerging nature of BCI technologies, as well as the possible complexity of assessing potential BCI-enabled privacy threats, in this article we focus on one aspect of the
VSD: conceptual investigation.

Direct and Indirect Stakeholders
Earlier VSD work [24] has shown the need to consider
two groups of people that may potentially be affected
by a technology, referred to as direct and indirect stakeholders. Direct stakeholders are defined as those people who directly interact with technology, and indirect
stakeholders as the people whose data or presence may
be implicated by the technology, even though they are
not directly interacting with it.

Value Sensitive Design and BCI Technology
As a part of the conceptual investigation of existing and
emerging brain-computer interfaces, we have identified ten
distinct groups of stakeholders. We consider the following
groups of people to be direct stakeholders: 1) BCI manufacturers, 2) BCI application developers, 3) people using
BCIs for augmentation, 4) people using BCIs for medical
reasons, 5) medical practitioners, 6) patients' caregivers,
and 7) BCI attackers. Privacy merchants, marketers and
advertisers, and family members not directly involved in
patients' care are considered indirect stakeholders.
Disregarding the values considered to be important
by BCI attackers, we identified the following values to be
important to one or more groups of stakeholders: 1) reliability, 2) ease of use, 3) privacy, 4) independence, 5) autonomy, and 6) ease of access to users' private information.
We recognized that all direct stakeholders (except for
attackers) care about values reliability and privacy. Similarly, we anticipate the majority of direct stakeholders,
except maybe medical practitioners and patients' caregivers, to value ease of use. We further expect that people
using BCIs for medical reasons will deeply value independence, while their caregivers are likely to care about
autonomy. Marketers and advertisers, as well as privacy
merchants, on the other hand, are expected to care most
about the ease of access to users' private information.

Brain Spyware - The Privacy Problem with BCIs
We consider an attacker who uses non-invasive BCIs to
extract private information about users. BCI manufacturers generally distribute software development kits, technical support, as well as guides and tutorials with their
products, all with the goal of promoting faster application development. These open development platforms
typically grant application developers full control over
the devices' acquisition systems, signal processing components, decoding algorithms, and application rendering and control components. Thus, we assume that an
attacker has an access to all of these resources, as well
as to the recorded neural signals.

Methods of Extracting Private Information
As in [14], we consider scenarios where an attacker interacts with users by presenting them with specific stimuli,
and recording their responses to those stimuli. In the
current literature, there are several well-established
methods to present stimuli to BCI users [14]. We assume
an attacker can use any of these presentation methods
to facilitate extraction of private information. We further
assume an attacker can present malicious stimuli in an
overt (conscious) fashion, as well as in a subliminal
(unconscious) way, with subliminal stimulation defined
as the process of affecting people by visual or audio
stimuli of which they are not aware [13].

IEEE TEchnology and SocIETy MagazInE

∕

september 2015

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - September 2015