To get Jennifer into her home, the police take her to the front door of her home. They place her thumb on a small circular reader by the door. Radial LEDs circle underneath her thumb for a moment as it reads. Then a red light above the reader turns off and a green light turns on. The door unlocks and a synthesized voice says, Welcome home, Jennifer!
Similarly to the Thumbdentity, a multifactor authentication would be much more secure. The McFly family is struggling, so you might expect them to have substandard technology, but that the police are using something similar casts that in doubt.
When officers Foley and Reese find the sleeping Jennifer, they thumbprint her on a wireless handheld device, and Officer Foley looks up the young girls information. Looking at the screen she retrieves Jennifer(2015)’s address and age.
Thumbprint is a fine unimodal authenticator, but much better is multimodal biometric or multifactor authenticator to be certain of identity.
Doc Brown uses some specialized binoculars to verify that Marty Jr. is at the scene according to plan. He flips them open and puts his eyes up to them. When we see his view, a reticle of green corners is placed around the closest individual in view. In the lower right hand corner are three measurements, DIST, gamma, and XYZ. These numbers change continuously. A small pair of graphics at the bottom illustrate whether the reticle is to left or right of center.
As discussed in Chapter 8 of Make It So, augmented reality systems like this can have several awarenesses, and this has some sensor display and people awareness. I’m not sure what use the sensor data is to Doc, and the people detector seems unable to track a single individual consistently.
So, a throwaway interface that doesn’t help much beyond looking gee-whiz(1989).
The Drones’ primary task is to patrol the surface for threats, then eliminate those threats. The drones are always on guard, responding swiftly and violently against anything they do perceive as a threat.
During his day-to-day maintenance, Jack often encounters active drones. Initially, the drones always regard him as a threat, and offer him a brief window of time speak his name and tech number (for example, “Jack, Tech 49”) to authenticate. The drone then compares this speech against some database, shown on their HUD as a zoomed-in image of Jack’s mouth and a vocal frequency.
Occasionally, we see that Jack’s identification doesn’t immediately work. In those cases, he’s given a second chance by the drone to confirm his identity.
Although never shown, it is almost certain that failing to properly identify himself would get Jack immediately killed. We never see any backup mechanism, and when Jack’s response doesn’t immediately work, we see him get very worried. He knows what happens when the drone detects a threat.
Zero Error Tolerance
This pattern is deadly because it offers very little tolerance for error. The Drone does show some desire to give Jack a second chance on his vocal pattern, but it is unclear how many total chances he gets.
On a website, if I enter my password wrong too many times it will lock me out. With this system, the wrong password too many times will get Jack killed.
There are many situations where Jack may not be able to immediately respond:
Falling off his bike and knocking himself out
Focus on repairing a drone, when a second drone swoops in to check the situation out
Severe shock after breaking a limb
etc…
As we see in the crashed shuttle scene, the Drones have no hesitation in killing unconscious targets. This means that Jack has a strong chance of being killed by his Drone protector in some of the situations where he needs help the most.
A more effective method could be a passive recognition system. We already know that the drone can remotely detect Jack’s biosignature, and that the Tet has full access to the Drone’s HUD feed.
The Drone then could be automatically set to not attack Jack unless the Tet gives a very specific override. Or, alternatively, the Drone could be hard-wired to never attack Jack at all (though this would complicate the movie’s plot). In any situation where it looks like the Drone might attack anyways, the remote software Vika uses could act as a secondary switch, providing a backup confirmation message.
That said, we must acknowledge that this system excels at is keeping Jack nervous and afraid of active drones. While they help him, he knows that they can turn on him at any moment. This serves the TET by keeping Jack cowed, obedient, and always looking over his shoulder.
Ethical Ramifications
The Drones are built as autonomous sentries, able to protect extraordinarily expensive infrastructure against attack. They need to be able to eliminate that threat, quickly and efficiently. Current militaries are facing the exact same issues. Even though they have pledged (for now) to not build autonomous kill systems, modern military planners may find value in having a robot perform a drudging, dangerous task like patrolling remote infrastructure.
The question asked best in Oblivion is “What should constitute a threat?”
Drones fire mercilessly on unarmed civilians and armed enemy militia, but do not attack armed friendly soldiers (Jack). This already implies some level of advanced threat analysis, even if we abhor the choices the Drone makes.
The Future
Military Planners will need to answer the same question: How does the algorithm determine a threat? With human labor becoming more and more expensive both monetarily and emotionally, the push for autonomous drone systems will become even stronger for future conflicts.
There is still enough time to research and test potential concepts before we have to make a decision on autonomous drones.
Interaction Design Lessons:
Don’t threaten civilians and non-combatants.
Give clear feedback of limits and consequences if a deadly pattern is about to be activated.
When students want to know the results of their tests, they do so by a public interface. A large, tiled screen is mounted to a recessed section of wall in a courtyard. The display is divided into a grid of five columns and three rows. Each cell contains one student’s results for one test, as a percentage. One cell displays an ad for military service. Another provides a reminder for the upcoming sports game. Four keyboards are situated below the screens at waist level.
To find her score, Carmen approaches one of the keyboards and enters some identifying data. In response, the column above the screen displays her score and moves the data in the other cells up. There is no way to learn of one’s test scores privately. This hits Johnny particularly hard when he checks his scores to find he has earned 35% on his Math Final, a failing grade.
Worse, his friend Carl is able to walk up to the keyboard and with a few key presses, interrupt every other student looking at the grades, and fill the entire screen with Johnny’s score for all to see, with the failing number blinking red and white, ridiculing him before his peers. After a reprimand from Johnny, Carl returns the display to normal with the press of a button.
Is ANSI the right input?
The keyboard would be a pain to keep clean, and you’d figure that a student ID would be a unique-and-memorable enough token. Does an entire ANSI keyboard need to be there? Wouldn’t a number pad be enough? But why a manual input at all? Nowadays you’d expect some near-field communication, or biometric token, which would obviate the keyboard entirely.
Are publicizing grades OK?
So there are input and interaction improvements to be made, for sure. But there’s more important issues to talk about here. Yes, students can accomplish one task with the interface well enough: Checking grades. But what about the giant, public output?
It’s fullfilling one of the dystopian goals of the fascist society in which the story takes place, which is that might makes right. Carl is a bully (even if Jonny’s friend) and in the culture of Starship Troopers, if he wants to increase Johnny’s public humiliation, why not? Johnny needs to study harder, take it on the chin, or make Carl stop. In this regard, the interface satisfies both the students’ task and the culture’s…um…values.
I originally wanted to counter that with a strong statement that, “But that’s not us.” After all, modern federal privacy laws in the United States forbid this public display as a violation of students’ privacy. (See FERPA laws.) But apparently not everyone believes this. A look on debate.org (at the time of writing) shows that opinion is perfectly split on the topic. I could lay out my thoughts on which side is better for learning, but it’s really beyond the scope of this blog to build a case for either side of Lakoff’s Moral Politics.
You’re Doing More Than You Think You’re Doing
But it’s worth noting the scope of these issues at hand. This seems at first to be an interface just about checking grades, but when you look at the ecosystem in which it operates, it actually illustrates and reinforce a culture’s core virtues. The interface is sometimes not just the interface. Its designers are more than flowchart monkeys.
Sandmen surrender any physical objects recovered from the bodies of runners to the Übercomputer for evaluation via a strange device I’m calling The Evidence Tray.
As a Sandman enters the large interrogation chamber, a transparent cylinder lowers from the ceiling. At the top of this cylinder an arm continuously rotates bearing four pin lights. A chrome cone sits in the center of the base. The Sandman can access the interior of the cylinder through a large oblong opening in the side the top of which is just taller than Sandmen (who seem to be a near-uniform height).
The Sandman puts any evidence he has found into the bottom of this cylinder. (What if the evidence was too large to fit? What if the critical evidence is not physical, or ephemeral? But I digress.) In response to his placing the objects, lights on the rotating arm illuminate, scanning them. The voice of the Übercomputer prompts the Sandman to “identify,” a request that is repeated on a large screen mounted on the wall in view through the transparent backing of the Evidence Tray.
The Sandman identifies himself by placing his palm on a cone in the cylinder’s center, positioning his lifeclock in the small indention in its tip. The base section of the cylinder illuminates, and after a pause, the voice and screen confirm that his identity has been “affirmed.” Logan removes his hand, and in a flash of blue light the objects in the tray disappear. The film gives no clue as to whether the objects are teleported somewhere or disintegrated into thin air.
Objections
There are of course the usual objections to the authentication. The lifeclock check is really a biometric check, something that Logan “is” (since he can’t remove the lifeclock) and—per the principles of multifactor authentication—should need to provide an additional factor, such as something he has (like a key) and something he knows (like a password).
There’s another objection there to the fact that the authentication requires that his hand be put into a teleport/distingration chamber. Perhaps narratively this shows the audence the insane levels of trust citizens have in their Nanny Program, but for the real world let’s just say it’s best that you don’t require police to submit to a Flash Gordon Wood Beast just to hand over exhibit A.
There’s a nice touch to the transparent walls allowing him to see the computer screen through it, to get the visual confirmation of what he’s hearing. But I suspect the curved surface also adds a bit of distortion to his view that doesn’t help readability. So the industrial design aspects of the interface sort of even out. Unless I’m missing something. Any industrial designers want to weigh in?
A final objection is the unnecessarily vast architecture that is part of the workflow. Why this giant room with a thin cylinder in the middle of it? Sure there are narrative reasons for it (welcome to this digital heart of darkness) but it seems like something that Sandmen would be doing routinely, and this giant ritual just makes a creepy, big deal about it.
Better
Better might be a wide, waist-high cubby off to the side of their offices, whatever those are, with a wide tray and computer screen. Sandmen could drop the evidence into the tray and place their hands into an authenticator outside the tray, initiating the scan. This would save them the awkward time of waiting for the computer to order them to authenticate, and tightly couple the objects with their identity. The improved semiotics say, “I, Logan, found these and am surrendering them to you.” Then if the computer needed to speak more about it, it could summon them to an interlocution room, or something with a similarly awkward 70s name.
At dispatch for the central computer, Sandmen monitor a large screen that displays a wireframe plan of the city, including architectural detail and even plants, all color coded using saturated reds, greens, and blues. When a Sandman has accepted the case of a runner, he appears as a yellow dot on the screen. The runner appears as a red dot. Weapons fire can even be seen as a bright flash of blue. The red dots of terminated runners fades from view.
Using the small screens and unlabeled arrays of red and yellow lit buttons situated on an angled panel in front of them, the seated Sandman can send a call out to catch runners, listen to any spoken communications, and respond with text and images.
*UXsigh* What are we going to do with this thing? With an artificial intelligence literally steps behind them, why rely on a slow bunch of humans at all for answering questions and transmitting data? It might be better to just let the Sandmen do what they’re good at, and let the AI handle what it’s good at.
But OK, if it’s really that limited of an Übercomputer and can only focus on whatever is occupying it at the moment, at least make the controls usable by people. Let’s do the hard work of reducing the total number of controls, so they can be clustered all within easy reach rather than spread out so you have to move around just to operate them all. Or use your feet or whatever. Differentiate the controls so they are easy to tell apart by sight and touch rather than this undifferentiated mess. Let’s take out a paint pen and actually label the buttons. Do…do something.
This display could use some rethinking as well. It’s nice that it’s overhead, so that dispatch can be thinking about field strategy rather than ground tactics. But if that’s the case, it could use some design help and some strategic information. How about downplaying the saturation on the things that don’t matter that much, like walls and plants? Then the Sandmen can focus more on the interplay of the Runner and his assailants. Next you could augment the display with information about the runner, and perhaps a best-guess prediction of where they’re likely to run, maybe the health of individuals, or the amount of ammunitition they have.
Which makes me realize that more than anything, this screen could use the hand of a real-time strategy game user interface designer, because that’s what they’re doing. The Sandmen are playing a deadly, deadly video game right here in this room, and they’re using a crappy interface to try and win it.
Not everyone is comfortable giving over to the flimsy promise of Carrousel [sic]. Some citizens run, and Sandmen find and terminate these cultural heretics.
Sandmen carry a device with them that has many different uses. It goes unnamed in the movie, so let’s just call it the SandPhone. It is a thick black rectangle about 20cm at its long edge, about the size of a very large cell phone. Near the earpiece on one broad side is a small screen for displaying text and images. Below that is a white line. The lower half of this face is metallic grill that covers a microphone. On the left edge is a momentary button that allows talking. Just above this is a small red button. When not in use, the device is holstered on the sandman’s belt.
The SandPhone lets the Sandman receive information through a display that can show both image and text. The Sandman sends back information and requests by voice in a CB radio metaphor.
Notifications
The first time we see the device is when Logan and Francis are attending Carrousel. Somehow, on his belt it catches his attention. With the crowd too loud for sound, and no evidence it’s light, my bet’s on haptics. Realizing he’s got a message, he picks it up, presses the edge button and the screen displays two lines of text:
RUNNER: GREAT HALL ENTRANCE WEST.
He then puts the device to his face as we would a cell phone and shouts, “Affirmative!” as loud as he can.
Perp wayfinding
Running with the device outside the Great Hall, Logan uses the SandPhone as a detector. By holding it flat out in front of him he hears a rhythmic pulse. Turning it this way and that, he listens for the change in pitch. It rises when he is pointing towards the targeted runner.
Bio identification
When he and Francis have terminated the runner, he snaps the device off his belt, and pressing the edge button, he reports back to dispatch, “Runner terminated, 0.31. Ready for cleanup.” Then by placing the device near the head of the dead runner, the device displays on the screen the last photographic image of him on file. Since the face on the SandPhone screen does not match the face he sees before him, Logan lifts the device to his face and, holding the edge button, requests an identity check of dispatch. Instantly he pulls the device away from his face to show the text:
IDENT. AFFIRM NEW YOU #483 FACE CHANGE.
Send backup
Much later in the film we see Logan alert dispatch to the location of the underground hideout by reaching down to the holstered device and pressing the white line button on its face. Its screen pulses green, and his position is highlight on the runner board (see below) at dispatch. Minutes later the location is raided by Sandmen.
Analysis
The first thing to note is that this is pretty close to a modern smart phone. He receives images and text messages, can talk to dispatch, and it has a biometric capability for identifying citizens. It’s tempting to paint this as visionary, but keep in mind that the first mobile phone was demonstrated in 1973, three years earlier, so it’s likely that the film makers were riffing off of the demo technology they’d heard about or maybe even seen in person.
We evaluate an interface’s design by how well it helps its user achieves his goals. (Even if those goals are anethma. That’s how we judge an interface.) In this case, the SandPhone helps Logan get the information he needs, when he needs it, across multiple channels. It doesn’t distract him with other functions. It’s context aware and doesn’t apparently have battery issues.
There are improvements of course.
We should make sure his hands are free by making the information available as an augmented reality display instead of a handheld device. This would also give him the information privately rather than display it for anyone (notably members of the resistance) to see it. Wayfinding would be more sensible as an overlay to his vision through this device.
Some surface tweaks might also be made, such as giving him a means of text input so he wouldn’t have to shout above the roar of Carrousel. Some silent means of input would help for when he needs to provide silent input as well. First I thought optical inputs might be ideal, given the augmented reality, but we don’t want his eyes distracted like that, even for the duration of glances. Instead some other gestural input—perhaps a face twitch or subvocal input—that lets him keep the rest of his body tense and ready for action.
Citizen biometrics should be a background fact, given the penopticon of Dome City. The information would come to him when he gets his assignement. But turn those same biometrics around on Logan, and his body could request reinforcements before he even thought to do so manually. When his heart rate elevates and galvanic skin response lowers, dispatch would know something was up, and route backup immediately.
A strategic interaction designer would even ask why he has to chase runners at all, when predictive algorithms could guess which citizens were likely to run and take action to forestall their rebellion. But then we’re into Minority Report, and this needs to stay Logan’s Run.
The central technological conceit of the movie is the lifeclock, a rosette crystal that is implanted in each citizens left palm at birth. This clock changes color in stages over the course of the individuals lifetime.
Though the information in the movie is somewhat contradictory as to the actual stages, the DVD has an easter egg that explains the stages as follows.
White
Birth to 8 years
Yellow
9 to 15 years
Green
16 to 23 years
Red
24 years to 10 days before Lastday (30 years)
Blinking Red
from 10 days before Lastday to Lastday
Black
End of Lastday (Carousel/death)
Lifeclocks derive their signal and possibly power from a local-area broadcast in the city. When Logan and Jessica leave the city their lifeclocks turn clear.
The signal of the lifeclock is so central to life that most citizens dress exclusively in colors that match their lifeclock color. Only certain professions, such as Sandmen and the New You doctor, are seen to wear clothing that lacks clear reference to a lifeclock color, even though the individuals in these professions have lifeclocks and are still subject to carousel at Lastday. We can presume, though are not shown explicitly, that certain rights and responsibilities are conferred on citizens in different stages, such as legal age of sexual consent and access to intoxicants, so the clothing acts as a social signal of status.
As an interface the lifeclock is largely passive, and can be discussed for its usability in two main ways.
Color
The first is the color. Are the stages easily discernable by people? The main problem would be between the red and green stages since the forms of red-green color blindness affects around 4% of the population. To accommodate for this, reds are made more discernable with a brighter glow than the green. As a wavelength, red carries the farthest, and blinking is of course a highly visible and attention-getting signal, which makes it difficult for an individual to socially hide that his or her time for carousel has come.
Black is a questionable signal since this indicates actual violation of the law but does not draw any attention to itself. Casual observation of a relaxed hand with a black lifeclock might even be mistaken for a colored lifeclock in shadow, but as the citizenry has complete faith in the system and a number of countermeasures in place to ensure that everyone either attends carousel or is terminated, perhaps this is not a concern.
But if we’re just going on human signal processing, the red should be reserved for LastWeek, and a blinking red for after LastDay. That leaves a color gap between 24 and 30. I’d make this phase blue, since it looks so clearly different from red. The new colors would be as follows.
White
Birth to 8 years
Yellow
9 to 15 years
Green
16 to 23 years
Blue
24 years to 10 days before Lastday (30 years)
Red
from 10 days before Lastday to Lastday
Blinking Red
End of Lastday (Carousel/death)
Location on the body
The second question is the location of the lifeclock. Where should it be placed? It is a social signal, and as such needs to be visible. The parts of the body that are most often seen uncovered in the film are the hand, the neck, and the head. The neck and head are problematic since these are not visible to the citizen himself, useful for reinforcing compliance with the system. This leaves the hand.
Given the hand, the palm seems an odd choice since in a relaxed position or when the hand is in use, the palm is often hidden from view of other people. The colored clothing seen in the film show that a citizens life stage is not really considered a private matter, so a location on the back of the hand would have made more sense. To keep it in view of its owner, a location on the fleshy pad between the thumb and the forefinger would have made a better, if less cinematic, choice.
The multipass is the all-purpose card of 2263. It’s a driver’s license, work authorization record, proof of identity, emergency medical information, phone card, plus all your credit cards in one. There is a white rectangle and yellowish, rounded-bevel shape on the lower left, each of which may be a button, but that we don’t see in use.
Often just showing it is enough for a human’s satisfaction, but sometimes it must be read by a machine. To do this, the holder inserts it into a slot, where the machine verifies its authenticity and registers the user locally. In Korben’s taxi, he has to leave it in as he operates the vehicle. At the Fhloston Paradise check-in booth, travelers dip it in and out of the reader.
The act of inserting the card to authenticate may seem a bit old-fashioned in the days of RFID and read-at-a-distance technology, but it’s also nice to see that whatever agency was able to get the various corporations and government agencies to cooperate has also got privacy in mind. If it needs to be dipped to be read, maybe it can’t be read at a distance. That means the holder has more control over when and how it’s accessed.
As far as convenience, hot damn. It’s practically a wallet in and of itself. But there are security concerns to having all of this in one place. There are many cards that work like this in the world. Bus passes, skeeball tickets, gift cards. They’re generally low-cost. If you steal or forge Korben Dallas’ multipass, though, do you suddenly have his charge accounts, his taxi, and his phone card all at once? Seems high-cost, especially since the one forgery we see in the movie actually works.
This returns us, as so many things do, to multifactor authentication. This security philosophy requires that the user presents three factors: something they have, something they are, and something they know. The multipass covers only the first two.
The multipass itself is the thing they have.
The picture is something they are, i.e., what they look like.
It could be improved by requiring something they know, like a PIN or a password.
We don’t know what kind of power Cornelius’ order wielded in the world, but since it wasn’t enough to sway the president or purchase tickets to Paradise, let’s presume it wouldn’t have been enough to uncover Korben’s password, and in that case, the PIN would have foiled the attempted forgery.
