John Harris

James Young
email: young@cs.umanitoba.ca

Nicole Sultanum

Paul Lapides

Ehud Sharlin

Mario Costa Sousa

Designing Snakey: A Tangible User Interface Supporting Well Path Planning

Keywords: Well path planning, Tangible user interfaces (TUIs), physical interaction, real-time 3D curve manipulation, interactive visualization techniques, reservoir and geosciences engineering

We present our ongoing design of Snakey, a tangible user interface (TUI) dedicated to the field of reservoir geosciences and engineering. Our design of Snakey emphasizes intuitive manipulation and interaction with 3D curves, common to underground well path exploration and planning. Snakey is not designed to replace the traditional CAD reservoir well path planning tools, but rather to augment them with tangible and collaborative interaction, facilitating spatial exploration during the multi-stage planning processes involved in well path design. Our short paper presents design goals and prototyping solutions relating to Snakey's physicality, sensing technology, input/output mapping, and multi-modal feedback, as well as our findings from a preliminary evaluation of the latest Snakey prototype in a design critique session by experienced reservoir engineers.

Introduction

The petroleum industry has been exploring and proposing different solutions for well planning tasks [START_REF] Lidal | A Decade of Increased Oil Recovery in Virtual Reality[END_REF]. Well planning is a fundamental task present in different stages of oil/gas field development from early exploration to production. Traditionally, well planning is an iterative process, involving teams of multi-disciplinary experts with specific constraints and goals. The 3D well trajectory is often laid out only in 2D maps and cross sections, making it difficult to understand the exact spatial relationships between the 3D reservoir model (synthesized from geological survey data) and the planned well-bore. Desktop-based solutions for well planning have been adopted by the industry, typically with WIMP interfaces, with wells trajectories being represented on the screen as 3D curves located inside a 3D digital model of the reservoir geology and its flow properties. The task of positioning well trajectories using the current WIMP interfaces involves a large number of control-point manipulations applied along each curve representing the well, leading to a time consuming and non-intuitive operation.

Well planning tasks have benefited from the use of various virtual reality (VR) interaction systems which allowed designers increased immersion in the path exploration task [START_REF] Lidal | A Decade of Increased Oil Recovery in Virtual Reality[END_REF][START_REF] Loftin | Advanced Visualization Techniques for Exploration and Production[END_REF]. However, these VR solutions are not physical and do not provide tangible affordances. Snakey (Fig. 1) is being designed in order to match some of the unique properties of tangible user interfaces (TUIs) to the inherent physical and collaborative nature of 3D well-path planning in reservoir geosciences and engineering (G&E). The Snakey interface consists of 1) a graspable, semi-rigid physical device (similar to a long plastic "snake") which mirrors the shape of an underground well path, 2) a visual display directly behind the hanging physical device which reflects the users' physical manipulations onto a virtual model of a well path and its surrounding geological survey data, and 3) output elements (LED lights and vibration motors) embedded in the physical device that provide direct haptic and visual feedback to the user.

The Snakey TUI attempts to leverage users' natural spatial perception and manipulation skills, mapping the task of virtual 3D well path onto a meaningful physical representation [START_REF] Ullmer | Emerging Frameworks for Tangible User Interfaces[END_REF]. Snakey directly couples the 3D well path perception and action spaces into a single physical object, lowering the cognitive load required for interaction and improving the spatial mapping and ease of use [START_REF] Sharlin | On Tangible User Interfaces, Humans, and Spatiality[END_REF]. Snakey is not designed to replace traditional CAD well path planning tools, but is an exploratory application of the tangible, collaborative, and immediate nature of TUIs to the complex, multi-stage planning processes involved in well path design. It is aimed at the reservoir engineering stage, when fluid flow simulations are performed and wells are manipulated to allow for different simulation runs and better understanding on the flow behavior across the reservoir.

Related Work

Physical manipulation of 3D curves was one of the early focuses of TUI research. In 1999, Balakrishnan et al. [START_REF] Balakrishnan | Exploring Interactive Curve and Surface Manipulationg Using a Bend and Twist Sensitive Input Strip[END_REF] presented their work on using Measurand's ShapeTape TM , an input device that can sense its 3D bend and twist, for interactive manipulation of 3D curves and surfaces. ShapeTape is a rubber ribbon which integrates internal tracking via embedded fiber optic bend and twist sensors. Balakrishnan et al. mentioned attaching spring steel to ShapeTape to provide more physical constraints to the rubber core [START_REF] Balakrishnan | Exploring Interactive Curve and Surface Manipulationg Using a Bend and Twist Sensitive Input Strip[END_REF], however to our knowledge there is no published work on integrating ShapeTape into an interface that can physically hold its shape consistently in a manner required by our design goals.

AR-Jig [START_REF] Anabuki | AR-Jig: A Handheld Tangible User Interface for Modification of 3D Digital Form via 2D Physical Curve[END_REF] provides interactive physical mapping to 2D curves using a handheld pin-array, which can be used to control 3D surfaces. However, the pins provide a relatively small, and physically discrete spatial control area that we believe would be difficult to meaningfully map to direct interaction with large 3D curves.

Closer to our applied domain of reservoir G&E, GeoTUI [START_REF] Couture | GeoTUI: a tangible user interface for geosciences[END_REF] provides a tabletop TUI for interaction with geological data, however the interface does not support 3D physical interaction and spatial manipulation of the 3D curves of well paths. Tateosian et al. [START_REF] Tateosian | TanGeoMS: Tangible geospatial modeling system[END_REF] allow users to manipulate and explore detailed geological tasks using physical 3D surface sculpting, however their interface does not allow physical interaction with a consistent, shape holding 3D curve that can be mapped to spatial explorations of wells in reservoir G&E.

Like others [START_REF] Couture | GeoTUI: a tangible user interface for geosciences[END_REF], we believe that the reservoir G&E domain can benefit from the exploration of new physical interfaces that will afford a more intuitive and natural interaction with the well path planning task.

Snakey's Design Goals and Implementation

The primary design goal of Snakey was selecting the TUI's properties to create a valid interaction metaphor for the design and planning of 3D well paths in reservoir G&E visualization tasks. Derived from this goal, the device should afford simple and intuitive physical manipulation of 3D curves in real time while maintaining its 3D shape throughout the interaction session, unless directly manipulated by the user. We envisioned reservoir engineers, a single user or a collaborative group, being able to relate to the 3D physical Snakey as a constant and consistent representation of the virtual well path. Devising a means for Snakey to persistently represent the well, while at the same time allowing users to manipulate and interact with its curve, was our main design challenge.

Another design goal was to allow flexible and easy view and physical access to Snakey, enabling reservoir engineers to visualize the overall 3D trajectory of the well from different viewpoints in relation to the reservoir model. We also wanted to support modularity, reconfigurability and branching, as wells are often planned with junctions and forks, establishing multilateral 3D configurations (Fig. 3).

Furthermore we investigated the integration of other physical modalities and properties, beyond the spatial, into Snakey. Embedded lighting indicators could highlight sections of the well path that needed further attention. Embedding haptic feedback could allow users to have direct insight relating to some of the well properties, such as fluid flow through the well path or its vicinity, or providing indications of having reached one of the well's or the reservoir's physical constraints.

Early in our implementation we chose the Vicon TM 3D motion capture camera system [START_REF]Vicon Motion Capture System[END_REF] for tracking the 3D spatial layout of Snakey. With this system a number of retro-reflective markers are placed within a given tracking volume and an encompassing array of infrared emitters and cameras detect their 3D positions. The system uses triangulation algorithms to collectively reconstruct the positions of the markers in 3D space and in real-time. For the Snakey TUI, the discreet 3D positions of the tracking markers were then interpolated to yield the continuous 3D curve path.

The Vicon 3D camera system provided a large interaction volume for the Snakey device, adaptability (e.g. multi-prong curves), and practically unlimited curve lengths within our task by adding more markers. The visual tracking system introduced the problem of temporary occlusions such as when users cover a marker with their hands during manual manipulation, a problem we partly solved through the use of smoothing and interpolation algorithms. However, occlusions remain one of the Snakey prototype's reoccurring problems.

The TUI is based on Joby's GorillaPod TM [10]: flexible camera tripods which consist of a set of modular interlocking plastic orbs (a series of ball and socket joints) which are exceptionally light weight and are both easily manipulated and able to hold rigid shapes even when under significant loads. The Snakey prototype, using the midrange GorillaPod SLR-Zoom model, can form curves with a minimum bend radius of 3.5cm and when used to form a single, continuous chain it can support the weight of approximately 25 additional orbs arranged in a horizontal line. (Fig. 2)

In terms of modularity, sections of the orb links can be manually pulled apart with sufficient force and then easily popped/pushed back together. Combined with special branching nodes, this provided a quick and easy "building blocks" style method of creating multi-lateral/branching well path formations; an important component of most reservoir drilling operations. (Fig. 3) While the GorillaPod links were physically capable of forming "loops" and other more complex formations, our applied task of well path exploration precludes our need to consider them (as they do not make practical sense for the current Snakey task) and as such were not explored in detail.

Figure 2 -

The "GorillaPod" rigidity, even when heavily cantilevered (top), and its ability to be easily manipulated into complex shapes (bottom).

Additional visual and haptic interactive modalities (in parallel with the on-screen display) were also directly integrated into the physical Snakey device. Visual feedback was provided by a set of programmable tri-colour, wide-angle LED lights. Outputting approximately 8000 millicandelas of light intensity (sufficiently bright that they can be painful to look at directly at full power), the LEDs could each be individually programmed to take on a range of colours and intensities using a daisychained, two-wire communication bus. Haptic feedback was provided by a set of 10mm diameter, button-style vibration motors, each controlled in parallel (along with the LED lights) by a central microcontroller. Both the LED lights and vibration motors were small enough to be mounted directly onto individual GorillaPod orbs without interfering with Snakey's flexibility of motion. (Fig. 1)

Snakey was mounted to a rigid, reconfigurable aluminum frame allowing the "fixed end" of the Snakey chain to be position above, below, or to the side of the working volume, as necessary. (Fig. 1) This approach provides a fixed 3D position in space by which to correlate the physical object with its virtual, on-screen counterpart. It also helps create an open workspace around the physical object wherein multiple collaborating users can interact with, and manipulate the Snakey device simultaneously. Snakey's mounting frame was positioned directly in front of a large, high resolution display which, with the help of the 3D position data provided by the Vicon tracking system, superimposes the reconstructed virtual 3D curve onto the 3D reservoir model (Fig. 1). The displayed virtual model describes both the geology and flow behavior as simulated by high-end systems used in industry, e.g. [11]. As the user manipulates the Snakey device in the physical space, its virtual representation updates within the reservoir model in real time. This facilitates a direct input/output mapping between the Snakey object's physical shape and its virtual representation. Users can explore the virtual reservoir model immediately and easily by grasping and manipulating the physical Snakey device. The interface's physical constraints are expected to translate directly into similar constraints for the virtual model: for example, limited bend radius and avoidance of self-intersection are inherent restrictions both in real-world well paths scenarios, as well as in the Snakey TUI.

During interaction the Snakey TUI can augment the visual display with further real-time feedback which is physically embedded into the interface. For example by indicating through the rumble intensity of the attached vibration motors the different fluid flow rates in different sections of the well, or by indicating that the well path intersects with a dangerous terrain volume using glow of a section of the integrated LED lights.

Preliminary Evaluation of Snakey

The design of the Snakey prototype was participatory, with close involvement of reservoir engineers and domain experts in all the design iterations. In this section we include the findings, criticism and limitations of Snakey, as reflected via a design critique session which was conducted with the help of two experienced reservoir engineers. Our preliminary evaluation revealed that the experts were inspired by the concept of having a graspable physical manifestation of their three-dimensional well path plan. They highlighted that Snakey, once we tackle some of its current limitations, can signify a major step forward in terms of usability and interaction with 3D well paths. Below, we provide a collection of important observations gathered from our users. Additionally, we feel that the abundance of ideas and enthusiasm which our users provided reflects the impact that a more refined interface could have on the well path planning process.

While the users were able to easily view the physical Snakey device from any angle simply by walking around it, they were unhappy with the current need to rotate and move the geological data on the visual display using a desktop mouse and keyboard, taking attention away from the TUI and introducing a critical disconnect between the mental models of the physical device and the on-screen representation of the virtual data. In order to mitigate the physical inconvenience of having to shift between the Snakey device and a desktop mouse, it was proposed that a viewpoint controller would be mounted to the frame holding the Snakey device.

Our expert users also asked for added functionality that would allow them to control interface attributes beyond the 3D well curvature and path. For example, indicating where a specific operation takes place along the 3D well by physically squeezing a region of the Snakey chain, or sliding one's hand along a region of the TUI to mark an area in the geological data.

Another major design feature that was requested is the ability to store the shape of the physical device and to facilitate comparison of stored alternative well paths. Once the shape had been stored, users would have liked to physically "load" the well shape back onto Snakey. Supporting such a task may be accomplished if a future Snakey becomes mechanically actuated, in essence turning it into a robotic interface capable of taking on its own formation (e.g. [START_REF] Ota | A Highly Articulated Robotic Surgical System for Minimally Invasive Surgery[END_REF]). Simpler physical synchronization schemes were proposed, requiring the user to be actively involved in the physical well "loading" operation, for example by providing indications of when the physical device has approximately matched its digital parallel by showing green (match) or varying shades of yellow-orange-red (no match) using Snakey's sectional LED lights.

Another finding relates to Snakey's physical scale limitation. In practice, wells can be many hundreds of meters long, with each and every part of their huge extent often being carefully designed. Currently, the physical Snakey affords only a one-to-one mapping to the entire length of the well. However, because the distance between adjacent GorillaPod orb joints is fixed (i.e. each link is a solid piece of plastic), users cannot specify curves any smaller than a single link. A possible solution is to support the design of wells in various stages of scale and granularity. The first stage would map the interface to the well as a whole singular entity; establishing the well's basic position and shape. The next stage would map Snakey to only a portion of the complete well path, allowing a subsection of the well to be designed with higher precision. This "zooming in and out" approach revisits the aforementioned need for the physical interface to match previous, stored curves.

The experts were very positive regarding the inclusion of the LED lights and vibration motors as additional multimodal feedback integrated into Snakey. They considered scenarios such as having the visual display show pipeline curvature tolerances while the vibration motors indicate fluid flow and the LED lights display rock densities. Following, Snakey could arguably allow the user to perceive a fusion of properties that are interrelated, and would have been difficult to visualize simultaneously using a single, traditional display.

The reservoir engineers were also particularly enthused about the inherently collaborative nature of Snakey. Any user within a team, regardless of professional training or project role, could instantly step in and manipulate the physical curve, provide meaningful input, and have the result be immediately visible and apparent to everyone involved.

The experts also proposed additions to the capabilities of the virtual screen model that took advantage of the unique Snakey interface characteristics but would otherwise be difficult to control/express using a traditional WIMP interface. For example, while the resulting 3D curve can show one-dimensional geological information along its length (both virtually on-screen and physically using the attached LED lights), it was proposed that a 2D cross-section view of the virtual data would also reveal more information. This could be accomplished by treating the planar projection of the Snakey chain's 3D form as a curtain that would "cut" the reservoir voxel data at the location of the curve, providing a richer visualization that shows the internal, "under the surface" data to the user. Alternative visualization schemes might include a translucent "tunnel" of surrounding voxel information that is shown within a set radius of the 3D curve.

Finally, the experts saw the immediacy and intuitiveness of the Snakey interface as an opportunity to employ more scalable reservoir simulation solutions and provide much faster design feedback than is currently found industry. For example, instead of using traditional CAD software to simulate a complete well path using extremely detail physical parameters and finite-element methods (a process which can take days to compute), a proposed Snakey well path could be simulated at a more general level with fewer parameters, having results quickly visualized and reviewed by the design group and allowing Snakey TUI to be immediately adjusted for another simulation cycle. With this, engineers can interactively "zero in" on better well path designs in a matter of seconds before investing the time to run a traditional full-scale simulation.

We presented Snakey, a tangible user interface supporting physical manipulation and planning of 3D well paths. Our current Snakey prototype allows users to interact with and manipulate a physical curve-like artifact which is tracked in real-time and spatially mapped to a virtual 3D curve. In turn, this allows users to intuitively explore complex 3D geological data and collaborate in well path planning tasks with a multidisciplinary team. Snakey affords flexible physical manipulation and its main advantage is its ability to maintain its shape even when not being held by a user. Other features explored in the Snakey TUI are integrated haptic feedback and dynamic visual cues within the physical interface itself, as well as dynamically changing Snakey's topology as afforded by its modular nature. Preliminary evaluation emphasized many of the prototype's limitations, outlined some short-term goals for improvement and also highlighted the promise Snakey-like TUIs hold for the domain of reservoir geosciences and engineering, and the task of 3D well path planning.

Figure 1 -

 1 Figure 1 -The Snakey interface, visual display, and Vicon mocap camera array

Figure 3 -

 3 Figure 3 -(Left) A branched configuration of the Snakey object. (Right) Common multilateral well path configurations (a) Multibranched, (b) Forked, (c) Laterals into horizontal hole; (d) Laterals into vertical hole; (e) Stacked laterals; (f) Dual-opposing laterals.

Acknowledgements

We would like to thank our colleagues and anonymous reviewers for their valuable input. This research was supported by the Alberta Innovates Academy (AITF) / Foundation CMG Industrial Research Chair in Scalable Reservoir Visualization.


Andrea Rosales

Ernesto Arroyo
email: ernesto.arroyo@upf.edu

Josep Blat
email: josep.blat@upf.edu

FeetUp: a playful accessory to practice social skills through free-play experiences

Keywords: free-play, children, playful, augmented technologies, social interaction, wearable

In this paper we describe the design process of an interactive accessory to play anywhere and anytime while encouraging free-play and practice social skills. We explain the design process, the resulting conceptual design of FeetUp and the preliminary user's evaluation. FeetUp is a playful accessory that takes advantage of children's interest to jump, or perform body stunts. These activities generally include lifting both feet, and FeetUp gives audiovisual feedback whenever this happens to encourage free-play related with jump activities. Preliminary user's experience shows how FeetUp, encourages freeplay.

Introduction

Children are in continuous training and their way of being will be strongly influenced by all their current experiences [START_REF] Piaget | Science of education and the psychology of the child[END_REF] [START_REF] Ginsburg | The Importance of Play in Promoting Healthy Child Development and Maintaining Strong Parent-Child Bonds[END_REF]. By playing children mimic other's experiences and learn about it [START_REF] Nachmanovitch | Free Play:Improvisation in Life and Art[END_REF], this way they build their own values and develop new skills.

Many authors have discussed the correlation in children's life between their increased interest on screens (either television, videogames, computer, mobile phone, or others) and their lower physical activity and/or social interaction [START_REF] Bekker | Designing playful interactions for social interaction and physical play[END_REF], [START_REF] Leal Penados | Get up and move: an interactive cuddly toy that stimulates physical activity[END_REF], [START_REF] Seitinger | An ecological approach to children's playground props[END_REF]. More interest on screens prevents them from experiencing valuable face-to-face interaction important for practicing social skills, which could be developed through free-play. Free-play can be open-ended, spontaneous, physical, collaborative, engaging, fun, pleasurable, and usually involves a pretend element [START_REF] Rosales | Collective creation of games using free-play technologies[END_REF].

Several projects have explored the use of objects to encourage free-play [START_REF] Bekker | Designing playful interactions for social interaction and physical play[END_REF], [START_REF] Iguchi | Conference on Advances in Computer Entertainment Technology[END_REF], [START_REF] Creighton | jogo An Explorative Design for Free Play[END_REF], [START_REF] Ridén | UbiComp and Toys The Difficulties of Integrating Technology into the Everyday Object[END_REF]). Some of these objects are designed to stimulate physical play, and regard social activity as a, secondary goal. Other objects have been designed to stimulate social interaction by providing open-ended scenarios [START_REF] Iguchi | Conference on Advances in Computer Entertainment Technology[END_REF], [START_REF] Ferris | a load of ould boxology! In: 4th Conference on Designing Interactive Systems[END_REF]. However, in most cases the object to be augmented lacks well-defined selection criteria, or its interaction affordances does not add value to free-play. E.g., the interaction design proposed by Ridén for an augmented rubber ball was not useful [START_REF] Ridén | UbiComp and Toys The Difficulties of Integrating Technology into the Everyday Object[END_REF]. The authors noticed that "the interaction enabled by its flashing lights was not used at all" and they concluded "the force of affordance of balls is very strong for children".

Our approach focuses on understanding children's interest, habits and routines related to evocative objects and free-play activities. We use this knowledge as initial requirements to design and create evocative objects that encourage social interaction through free-play. In this paper we present FeepUp, an evocative object designed to encourage children's to play using their bodies to jump, roll, perform handstands or any other stunts collaboratively with their friends. We describe the design process, the resulting conceptual design of FeetUp, including the object design, its interaction rules, and the physical setup. Finally we present preliminary results indicating that FeetUp encourages free-play and discuss opportunities for future work.

DESIGN PROCESS

The design process started by two ethnographic studies aimed at understanding, the relationship between free-play and children's routines, in order to identify the implications for design [START_REF] Dourish | Implications for design[END_REF]. This sets the framework for designing playful objects to promote free-play by involving children in the design process [START_REF] Druin | The Role of Children in the Design of New Technology[END_REF] through brainstorming, iterative prototyping and evaluation.

Children and free-play

In a preliminary ethnographic study, we used traditional methodologies, such as observing children in their natural play settings as observer-participants note taking, and then categorizing the collected information [START_REF] Blomberg | An ethnographic approach to design, The Human-computer interaction handbook[END_REF].

We followed children's between 6-9 years old while playing in Barcelona during 24 sessions in parks, school patios, and their homes. We documented children's relation with free-play, what they do, and what objects they use during free-play sessions. We registered our observations in a notebook, and then we categorized the observations, to extract relations between objects, activities, games and social interaction related with free-play.

From this process emerged that the most common object in children's activities or games is their own body. They naturally played games related with physical challenges with their body. We identified several free play challenges they typically find in their body, such as playing against gravity, aim, coordination or visibility, attention, strength, etc. Each challenge is related to many activities or games. For example, while playing with gravity, they enjoy handstands, handholding, hanging, hand walking, somersaults, tumbles, or carrying each other.

Children's routines

A second ethnographic study identified opportunities on children's routines for freeplay. We documented the routines of 8, 2 to 4 members families, all of them with at least one kid aged between 6 and 9, as participant-observers [START_REF] Blomberg | An ethnographic approach to design, The Human-computer interaction handbook[END_REF]. We immersed in their spare time activities and conducted unstructured interviews [START_REF] Blomberg | An ethnographic approach to design, The Human-computer interaction handbook[END_REF] with parents.

The study indicated that children's routines lack spare time or free time. Family routines are full of duties, and children's time has to be planned according to them. In addition to attending school, practicing sports, and doing extracurricular activities, children are also participants in many of their family's tasks, like going to the supermarket or visiting their aunt's house or following their brother's activities. However, free-play can also happen in parallel to other activities, like playing while shopping, during a family visit, or on the road.

Objects designed to stimulate free-play should be small enough to be taken along while going out, and practical enough so that children can always carry them. Objects could also be embedded into smart clothes and offer additional value as suggested by Steffen [START_REF] Steffen | Smart Semantics Product Semantics of Smart Clothes[END_REF]. As children wear clothes all the time, they can act as playful objects to allow children to play whenever they have an opportunity, whereas at on the road, on a waiting room, or at the store.

Brainstorming with children

The Current design trends suggest that children should be part of the design team in order to voice their opinions and inform the design with their own interest, emotions and feelings [START_REF] Druin | The Role of Children in the Design of New Technology[END_REF]. For the design of FeetUp, children collaborated with researchers, providing ideas for interaction and providing useful information about adequate ways to stimulate free-play. At the beginning of the process we presented children with sketches of 5 imaginary powerful accessories. (See Figure 1). We explained to children that these objects were powerful ("magical", and "limitless"). In order to evoke children's imagination, we asked them to describe and explain the sketches: what the pictured kids where doing, and how the pictured devices would work. This process provided many interaction design ideas for many playful accessories, and also provided valuable insights to identify the most adequate accessories to stimulate body challenges in diverse playful situations. For the final selection, we considered only playful accessories that could be developed with existing hardware. We selected three playful accessories that elicit numerous opportunities to practice social skills and allow them to imagine several situations and evoke possibilities for play making use of body challenges. The selected projects include FeetUp, Statue, and Gloves The two other projects were developed at later time.

Wizard-of-Oz and Imaginary Experience

We started the iterative design process with early prototypes, to validate the concept, and verify if the prototype could be for what it was designed for. Several sessions allowed children to test every new improvement, and re-arrange the pieces to fit their bodies and interests. The first iterations demonstrated the ideas with a combination of wizard-of-oz and partially functional prototypes to test and validate the initial concepts. At the beginning, part of the functionality was implemented and the rest was operated manually activated sensors. This method was used to illustrate how some of the accessories would work, facilitating the user to imagine experiencing and playing with each accessory. This gave us important insights to evolve the design according to how users imagine this will be working and what for.

Iterative Prototyping

We improved the original design according to users' feedback and introduced several new functionalities that emerged from interacting with the objects themselves. For every test we invited a new user to a playground to play with the prototypical accessories and drew conclusions about how to improve the design, considering how users spontaneously used the device? What for? And how users expected the device to work? The results of every new test guided the following iteration in the design. This process finished when the prototype was fully implemented and the concept was validated with individual users. Trough validation, users confirmed that they managed to practice diverse activities with the accessory and imagined games where they could use it. Important improvements emerged from user's ideas about how to arrange sensor to properly detect jumping, how to arrange the actuators for visibility, or the kind of feedback they expect to have in the games they where imaginary playing.

CONCEPTUAL DESIGN

FeetUp is a playful accessory embedded in a pair of children's shoes that provides audiovisual feedback whenever the user jumps or is off the ground. (See Figure 2). FeetUp is similar to popular shoes that light while walking, but FeetUp demands additional effort as kids have to jump to get the feedback. Since games and playful activities have to have some degree of challenge [3] [13], increasing the difficulty to get the feedback opens a gap to make more interesting plays around it.

Fig. 2. FeetUp

FeetUp stimulates children to play against gravity, one of their most frequent activities related to free-play. Giving feedback while jumping lets each child share his jumping achievements with his colleagues, and when several children have the same accessory, they have the same interest in common and they can have shared goals. While sharing goals they must explain ideas, argue, negotiate, and make agreements, thus they are practicing quite important social skills.

There is no digital network between users, but the common interest is the excuse for them to create a network of shared goals, represented as simple activities or more complex games. They have to propose how to use this shared feedback to play together with this new shoes. The system incorporates a simple rules system so that children have the opportunity to create their own system of rules, challenges and goals based on the basic, but consistent information they receive.

Object Design

For the object design we considered the use of an existing object children already wear and have with them all the time. Thus we choose a pair of shoes that can be used anywhere, and offer limitless opportunities to play. The audiovisual feedback is directly embedded in the shoes themselves to maximize its visibility.

Interaction rules

The interaction system reacts to only one factor; children jumping. The shoes rules give feedback when children are jumping; they blink and play sounds when both feet are not touching any surface.

Physical Setup

The setup includes 4 touch sensors, 2 microcontrollers, and 2 emitter and receiver radios, 2 LED arrays, and 2 piezo speakers. The setup includes two pressure sensors placed on the insole inside each shoe (one in the base of the heel and another on the sole), thus allowing us to detect when each foot had been completely lifted from the floor. A microcontroller in each foot reads sensor data, validates that both sensors have been de-activated, and sends a radio frequency signal read by the other device. When both microcontrollers confirm that all pressure sensors have been de-activated, they trigger the LEDs in the surface of the shoe and make a sound alert with a piezo speaker.

EVALUATION

A pair of children tested the final prototypes playing with the shoes in a playground during 30 minutes, in a preliminary evaluation of the project. Researchers did structured observations, to identify how the FeetUp accessory yielded the characteristics commonly present in free-play. Observers took notes during the session, and at the end of it, answered some open questions.

Observers described 7 concepts related with free-play behavior [START_REF] Rosales | Collective creation of games using free-play technologies[END_REF], including spontaneous, voluntary, collaborative, open-ended and engaging play, being physically active and with a pretended element. Some observations are described in the following list:

• They enjoyed discovering the accessory and understanding how it worked; they discovered that it blinked when jumping. They spontaneously started to play challenges related on how to cheat the shoes and discovered how to cheat it by making it blink without jumping; moving their feet while sitting, or tiptoeing. • They exchanged their discoveries, and motivated each other to start new challenges. They paid attention to their partner activities and made comments about them, while collaboratively helping each other. • They were free to do whatever they wanted in the park. However, they voluntarily moved-on to other jump related activities, and got involved in making the lights blink by dancing, hanging, sliding, or jumping. • They played games using simple goals, games they were used to. Later they started to adapt the activities to better see the lights of the shoes, to keep the lights blinking longer, or to make the activity more and more difficult in an open-ended encouraging game. • They engaged in the experience, preferring to play with the accessory rather than playing with games in the park where the testing took place, and the activity occupied all the time they usually spend in the park. • They were active and had continuous physical activity during the test.

• They described the accessory as "magical shoes" and they imagined that the shoes could give the super-powers and allow them to control others shoes, or other people. However, the accessory was no used as a pretend element.

Fun and pleasure values, also fundamental in free-play [START_REF] Rosales | Collective creation of games using free-play technologies[END_REF] were not considered, as they will be observed using an extended framework in future work.

Children used verbal and non-verbal communication while discovering the accessory, while imagine what they could do with the powerful shoes, and finally while playing. With verbal communication they described their hypothesis about the shoes, described their achievements, express satisfaction or frustration, and give support to his friend. Non-verbal communication challenged them to imitate each other, or establish new challenges. This indicates that they where practicing social skills.

Some inadequate ergonomics of the design generated frustration and disappointing experiences in children. This was due to the size and intrusiveness of the devices' hardware, as is also mentioned by Steffen [START_REF] Steffen | Smart Semantics Product Semantics of Smart Clothes[END_REF].

CONCLUSIONS AND FUTURE WORK

We have presented the design process of a playful accessory to practice social skills through free-play. FeetUp is a playful accessory to play against gravity; it encourages children to perform jumping challenges.

The ethnographic studies gave us important insights to create a conceptual framework which argued that children could benefit with playful clothes, playful bags or playful accessories and that these objects can support their innate need for playing.

The participatory design process, and the activities proposed to involve children in the design process, allow us to involve children's insights, during the entire process and make informed design decisions to fit their interest and preferences.

Future work includes, testing the prototypes with larger groups of children, and evaluating the accessory using a specific framework to identify how FeetUp encourage fun and pleasure. Future work will also consider 1) Developing conceptual designs and prototypes for other physical activities often performed by children in their games. 2) Comparing the results of the evaluation of each design. 3) Define guidelines to design objects to stimulate practicing social skill.

Fig. 1 .

 1 Fig. 1. Children were presented with 5 inspiring sketches of imaginary powerful accessories: a fanny pack, a belt, a brooch, gloves and shoes.

Acknowledgments

This work has been partially funded by the Learn 3 project, (TIN2008-05163/TSI). The authors would like to thank the cultural and technical partners of the C3I2 workgroup for their support and ideas.


Patrick Gage

Robin Brewer
email: rbrewer@umd.edu

Yael Mayer
email: yael_mayer@hmc.edu

Lorrie Faith Cranor
email: lorrie@cs.cmu.edu

Norman Sadeh
email: sadeh@cs.cmu.edu

An Investigation into Facebook Friend Grouping

Keywords: grouping, online social networks, privacy, access control

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Media organizations present Facebook privacy as a pervasive problem, with Internet shopping behavior disclosed, employees fired for behavior in tagged photographs, locations being shared, and the frequently changing settings described as a -bewildering tangle of options,‖ the situation seems bleak [START_REF] Berteau | Facebook's Misrepresentation of Beacon's Threat to Privacy: Tracking users who opt out or are not logged in[END_REF][START_REF] Ostrow | FACEBOOK FIRED: 8% of US Companies Have Sacked Social Media Miscreants[END_REF][START_REF] Marsden | Facebook unveils its latest trick but the implications are worrying[END_REF][START_REF] Gates | Facebook Privacy: A Bewildering Tangle of Options[END_REF].

A May 2010 New York Times infographic detailed more than 170 privacy options that Facebook users could then manipulate. To restrict access to any group more selective than all of one's Facebook friends, the -Customize‖ option must be chosen, at which point pre-specified friend lists or individual friends can be explicitly granted or blocked from that type of content. When Facebook released a new privacy interface in summer 2010 they simplified privacy controls; however, the new controls still rely on the Customize option for selective access control.

While the friend list interface and privacy settings continue to change, as of April 2011 Facebook users continue to have the option to control their privacy using friend lists. In order to use this option, users must first create one or more groups of their friends using the Facebook friend list interface. They can then control access to specific posts or to general categories of content by designating specific friend lists to which access should be granted or denied. We seek hereto examine how users categorize their Facebook friends into lists and whether they tend to do so in a way that supports using friend lists for access control. In addition, we seek to understand the impact of grouping mechanism on the types of lists users create. We conducted 46 semi-structured interviews with Facebook users, investigating how participants group their friends using four different friend-grouping mechanisms.

We found that when presented with the task of grouping their friends, nearly all users relied on similar attributes such as place, time, and context to form initial groups. However, we also found that the different grouping mechanisms we tested affected the strategies users employed. More importantly we found that these mechanisms impacted qualities that one would expect to remain consistent, such as size of groups, number of groups, and overlap. This implies that while it remains possible there could be an internal -ground truth,‖ defined as a user's set of ideal groups, the grouping mechanism can be used to-and necessarily does-influence the resultant groups. We also found that one-time grouping is not sufficient for privacy control, even in the small number of possible scenarios we focused on. And finally, we found that Facebook users tend to refrain from posting certain sensitive information on the site rather than posting it and using Facebook privacy controls to restrict access. These findings lead to a number of recommendations for designing group-based privacy controls for social networks.

Related Work

Social psychologists and cognitive anthropologists have studied how people categorize objects, concepts, and people for decades. Mervis and Rosch provide a summary of studies regarding the categorization of objects, specifically looking at what categories people define, the fuzziness of categorical boundaries, and the human process of classification [START_REF] Mervis | Categorization of natural objects[END_REF]. Stangor et al. provide an explanation of how people categorize others, specifically people they do not know, based on simple physical attributes (sex, race) [START_REF] Stangor | Categorization of individuals on the basis of multiple social features[END_REF]. Categorization has also been looked at within the HCI community, where Malone's early work explored how people categorize the (paper) files at their desks [START_REF] Malone | How do people organize their desks?: Implications for the design of office information systems[END_REF]. Malone recognized, and then studied, the pilers, whose apparently-messy desks do have a physical organizational structure. Kwasnik, commenting on her own investigation of categorization of files adds, -The research indicates that we choose categories, at least for concrete objects, that have the most usefulness for the least cognitive effort‖ [START_REF] Kwasnik | How a personal document's intended use or purpose affects its classification in an office[END_REF]. While these foundational studies provide a holistic picture of how humans group, we seek to understand the grouping task specifically in the context of social networks.

Friend networks are composed of people that users meet in distinct contexts and at different life stages. Facebook and most other social network sites combine all of these people into a single group of -friends,‖ even though in real life users may have different sharing expectations for different friends and groups [START_REF] Adams | The real life social network v2[END_REF]. Additionally, sharing across the entire network may not be expected, and one study demonstrated that people having misconceptions about the size and extent of the network they are sharing their information with [START_REF] Acquisti | Imagined communities: Awareness, information sharing, and privacy on the facebook[END_REF].

In a 232-participant survey, Binder et al. found that as networks continue to grow, broadcasting information across different social groups increases -tension‖ [START_REF] Binder | Conflicting social spheres and experienced tension in social networking sites[END_REF]. In a 20-participant online observation study, Lampinen et al. investigated how people currently managed -group co-presence‖ on Facebook. Their results showed that participants managed the differences in their groups by dividing the platform into separate spaces such as closed Facebook groups and by -using suitable channels of communication,‖ i.e. directed messages, private pages, and off-Facebook space. They also relied on self-censorship and trusting their friends to be responsible and not share inappropriate data [START_REF] Lampinen | All my people right here, right now: Management of group co-presence on a social networking site[END_REF].

The Facebook privacy controls allow users to use their friend lists to customize their sharing preferences according to their groups of friends. However, creating friend groups is a secondary task completed by few Facebook users. In a small thesis study, Smart found that none of his 10 participants used friend lists to control their privacy settings [START_REF] Smart | How do people limit their behaviour in response to their perception of potential social tension? A study of Facebook[END_REF]. Facebook founder Mark Zuckerberg stated in October 2010 that approximately 5% of Facebook's users have created even a single friend list [START_REF] Carr | Facebook's New Groups, Dashboards, and Downloads Explained[END_REF].

While, most work in interfaces for privacy has not looked directly at online contact management, many of the same general principles, such as those catalogued by Lederer et al. apply [START_REF] Lederer | Personal privacy through understanding and action: five pitfalls for designers[END_REF], for example they specifically call out excessive configuration over action, a common issue in contact management. In Davis and Gutwin's research on awareness servers, they found that some types and fidelities of information will be more public than others, yet for more sensitive information the specific recipient will greatly impact the disclosure decision [START_REF] Davis | Using relationship to control disclosure in awareness servers[END_REF].

In a recent experiment, Jones and O'Neill created an automatic method to group Facebook users' friends. They downloaded 15 participants' entire friend networksthat is, their friends and their friends' connections-and used a clustering algorithm to group them. Participants also grouped their friends separately using the card sorting software xSort11 -as if they were grouping them for controlling their privacy on Facebook.‖ The xSort software displays the names, but not the photos, of each friend. The participant-created groups were used as ground truth to test against the automatically-generated groups. Jones' results showed that the automaticallygenerated groups were at best around 70% accurate in comparison to the groups made by the participants [START_REF] Jones | Feasibility of structural network clustering for group-based privacy control in social networks[END_REF].

In the final phase of this study, Jones and O'Neill asked participants to select a privacy-sensitive item from their profile and indicate their -willingness to share‖ this item with each of 100 contacts. These contacts were a stratified sample of the groups they had made earlier. The researchers found that using the human-generated groups 77.8%-90.8% of contacts were correctly granted or denied access to a privacysensitive item. This shows even groups created by participants with privacy in mind may not be adequate for access control [START_REF] Jones | Feasibility of structural network clustering for group-based privacy control in social networks[END_REF]. Our research goes beyond the study by Jones and O'Neill to explore how grouping mechanisms impact the groups users create and their suitability for access control.

Methodology

To understand how Facebook users group their online contacts, we performed semistructured interviews with 46 participants in our lab. We view this as an exploratory study, consisting of a pre-survey, an open-ended grouping task, an interview exploring a series of common social network sharing behaviors, and a short postsurvey. While we gave each participant one of four different mechanisms to group his or her contacts, we did not set out to test whether one was superior to the others; our goal was to illuminate the effect each interface had on grouping behavior, exploring participants' overall opinions and attitudes toward group-based access controls in social networks.

We recruited participants through a university research pool website, flyers around the city, and local Craigslist postings. Participants completed pre-surveys online before coming to our lab. Upon arrival at our lab, they signed consent forms allowing us to audio and video record (through video cameras or screen capture). For each interview, one member of our research team recorded the time and observations throughout the grouping task, including: size and labels of groups, grouping strategies, participant questions, hesitation, group rearranging, and additional notes. Quotes used in the following sections, from both the grouping task and subsequent privacy scenarios were transcribed from recordings after the interview. The postsurvey was completed on paper, immediately after the main interview. Participants were paid $15 for successful completion of the entire task.

Grouping Mechanisms

Our participants were each assigned to one of four grouping mechanisms:

-Card sorting (CS). Participants were provided with a set of physical paper cards, each with the name and profile picture of one of their Facebook friends. The participants sorted the cards into piles during the grouping process as shown on the left in Figure 1.

-Grid tagging (GT). Participants were provided the names and profile pictures of each of their friends arranged across several sheets of paper in a grid. Participants -grouped‖ their friends by tagging the pictures with different colored markers as shown on the right in Figure 1. The participants indicated what group they were creating with each new color used. Participants tagged pictures with multiple colors to place people in multiple groups.

-File hierarchy (FH). Participants were provided a folder on a computer containing profile picture files of each of their friends. The picture files were named with the corresponding friend's name as shown in Figure 2. To group their friends, participants were instructed to create labeled folders and put the appropriate pictures in the folders. By default, friends were displayed as large icons so pictures were visible. Participants could choose whether to use a Mac or Windows computer for this task.

-Facebook friend lists interface (FB). Participants were asked to log in to their Facebook account and categorize their friends by creating standard Facebook friend lists. We directed participants to the -Account -Edit Friends -Friends‖ screen (see Figure 2, right) that, while unfamiliar to most users, allows users to see if each of their friends had been placed into a friend list. (By default the edit friends view also includes Facebook -Pages‖ that a user might also have -liked‖ and can also be placed into friend lists, which is why we directed users to click the Friends tab on the left).

We did not explicitly tell participants that placing participants in multiple groups was something they could do, so as to not bias them towards doing so. However, we provided a way for this to occur in each mechanism, and did affirmatively answer questions regarding grouping when asked.

Through several early pilot tests we explored other interfaces and variations of those above. The xSort tool mentioned above, used by Jones [START_REF] Jones | Feasibility of structural network clustering for group-based privacy control in social networks[END_REF], was eliminated because it cannot display pictures and it has no provision for allowing a friend to be placed in multiple groups. While we could have implemented our own digital card sorting application that met these requirements, we would then have had a condition fundamentally similar to physical card sorting.

We also tested several variations of our two physical methods, including using post-it notes, allowing for a drawable landscape underneath the card piles (for labels, subgroups, and group relationships), and starting with the cards spread on a table instead of beginning in a stack. Ultimately, these variations introduced more problems than they solved and were thus discarded. For example, beginning with the cards spread across a large surface caused a cognitively troubling and unfamiliar search problem for one pilot participant.

For the final study we chose the four mechanisms described above, representing a diverse set of alternatives, each with their own benefits and challenges. Card sorting was the initial motivation for the study, and remained the most intuitive to sort a set of objects. Grid tagging allowed for a folksonomy tagging structure of friends, where the groups were not central, but the contacts were. The file hierarchy was added to most easily allow for subgroups, encouraging nested folders and simple duplication. Finally, the Facebook friend list interface was used as the status quo, a common baseline and the interface participants have most likely previously used.

Survey & Interview

Potential participants were directed to an online survey as well as a custom Facebook app, that accessed a list of their Facebook friends. We used the survey and friend data to prepare the grouping task before the participant arrived at our lab. Our pre-survey included basic demographics questions, two questions about general Facebook usage, five questions about trust and privacy concerns on Facebook, four questions about current privacy controls, and six questions about Facebook's privacy settings changes. Participants completed this survey on their own computer when scheduling an appointment to come to our lab.

At their appointment, participants began with the open-ended grouping task. Next we walked participants through a number of specific scenarios. First, we discussed sharing certain pieces of information, including cell phone number, email address, political and religious views, relationship status, and sexual orientation. We also walked participants through a number of thought experiments to consider who they would share content with if they were posting pictures, sharing their location, 2inviting friends to a party, or posting a status update. We also explored some privacysensitive scenarios, including asking about vacation photos, gossiping about a superior, untagging a photograph, and removing a post from a participant's wall.

At the conclusion of the interview task, we had participants fill out a short paper survey that asked about their use and frequency of updating friend lists, their use of Facebook's -limited profile‖ feature, if they accept friend requests to -just be nice,‖ and if they enjoyed the grouping task.

Demographics and Survey Responses

64 participants took our online pre-survey. Of those, 46 participants came to our lab and completed the interview and grouping tasks. For the remainder of the paper we will focus on these 46 participants. For the purposes of the paper we will refer to each participant who completed the study by condition/number (for example, Participant GT2 is the second participant in the grid tagging condition). For a summary of basic demographics see Figure 3. Our study included 27 male participants (59%) and 19 female participants. The average age was 25.6 years, younger than the national population, common among Facebook's population. 13 participants (28%) self reported that they studied or were employed in a technology-related field.

Our participants also closely align with usage patterns of active Facebook users, with all but 2% of participants reporting they log in at least several times per week, and 69% reporting they use Facebook multiple times per day. Facebook reports that 50% of its active users log in on any given day. When asked how frequently users -update your status or post content on Facebook,‖ 63% of users reported that they contribute information (not just consume) at least once per week. Facebook reports an overall average of 130 friends across all users. Our users have an average of 280 friends (median 222.5 friends).

35% of participants agreed with the statement -I trust Facebook with my personal information‖ and 43% disagreed (22% neutral). As a possible compensation for users' distrust in Facebook, 41% of our participants agreed that -I don't worry about Facebook privacy because I have a strong set of privacy rules‖ (39% neutral, 19% disagree). A striking 87% of users reported agreement with -Once I put information on Facebook, it's not truly ‗private' anymore.‖ 32% of participants agreed that -Facebook changes privacy controls too frequently.‖ However, 71% of participants believed -Facebook should ask for user input before making changes,‖ and 96% agreed that -Facebook should announce any planned changes in advance.‖ Nonetheless, 83% of participants agreed that they did not read Facebook's new privacy policy in detail.

From our post-survey at the end of the study we found that, while many might assume the task of sorting all of one's Facebook friends to be a daunting one, 76% of participants agreed or strongly agreed that they enjoyed the study, with the rest expressing neutrality. Many participants with several hundred friends stated they enjoyed the study, suggesting people may be willing to group their friends, if the correct incentives are in place.

Of the 46 participants, 17 participants (37%) reported using friend lists in their Facebook accounts. However, only 8 of these people stated that they used these lists to control their privacy settings. In addition, only 9 participants (20%) stated that they try to do monthly maintenance of their friend lists. While these numbers seem to suggest our participants are biased to be more concerned about privacy, these numbers are self reported (we did not check for list usage nor maintenance) we also note that while Facebook normally gives figures distinguishing between active and all users, the 5% figure for friend list usage was not clearly associated with either group, and may have been taken from total usage to make friend lists seem less popular (as this quote is taken from an event with a product intended to replace friend lists as antiquated and useless).

Common grouping strategies

Many of our participants when tasked with the intentionally open-ended prompt -using (the cards/the markers/interface), categorize your friends into different groups and tell us what you're thinking as you do so,‖ began instinctively and immediately sorting through and categorizing their friends, while others spent time looking at their friends before deciding how to proceed. FB10 began the task stating: -There are all sorts of different ways to categorize the people you know.‖ GT3 said -Oh gosh, like I kind of have to look at all of them before I start a group.‖ Some wanted further details. GT10 asked, -Is this open-ended?‖ FH2 asked, -By different characteristics, or by female, male?‖ FB1, at a loss for what to do, asked if we had any recommendations for groups he could make.

We observed two common strategies for performing the original grouping task. The first, which we refer to as -by friend,‖ consists of a participant examining a single friend and placing him/her into a group, creating new groups as needed, and continuing until all friends had been grouped. The second, which we refer to as -by group,‖ consisted of participants creating a group, and then searching for friends or systematically looking through their list/stack of friends and placing them in that group if applicable. They continued this for each group they could come up with, until they decided they had finished. The strategy each participant used is displayed in Table 1. These strategies are similar to those used by Malone's file organizing participants [START_REF] Malone | How do people organize their desks?: Implications for the design of office information systems[END_REF].

Participants grouped their friends largely based on when or where they met them, or some specific context. Each of the groups was given a label during the grouping task (the interviewer prompted the participant for a group label or description if it was not provided). Each of these labels was coded into general groups, summarized in Table 2. The most used type of label was a description of friends from school/college, which 41 participants (89%) had. Of these, 35 participants (76%) specifically referred to a group of university friends. Family-related labels were also widely used with 29 participants (63%) creating one or more family groups. 14 (30%) participants created a group that specifically referred to a location other than a school or university, such as ‖Met in New York.‖ Groups of people the participants could not identify, didn't know, or described as random were created by 14 participants, with an additional 10 participants creating groups called -other‖ or -miscellaneous.‖ Jones and O'Neill do not give a full breakdown of the labeled clusters in their paper, however they also reported commonly-created groups of close or best friends, groups of weak ties such as acquaintances, -people I hardly know,‖ or again -random‖ people. They continue to describe groups based on organizational boundaries (work, school) and specific times and places in their participants lives, all of which we also saw [START_REF] Jones | Feasibility of structural network clustering for group-based privacy control in social networks[END_REF]. When comparing our clusters to those typically found in the social sciences research, for example [START_REF] Mccarty | Structure in personal networks[END_REF], we see fewer family groups, which are almost mandatory, but we hypothesize that due to not everyone having family members present on Facebook, we do not see the same prevalence in our results. We do see that many of the common expected clusters are present, including work, religious affiliations, hobbies, school, childhood friends, and groups of friends met through other friends or relatives.

Our 46 participants created 287 groups (6.5 on average), ranging from four participants who made only 2 groups, up to GT3 who made 30 groups. The groups ranged in size from several single-member groups, to FB12's group of 394 high school friends. As expected, the more friends a participant had, the longer it took for them to group their friends.

We observed that the mechanism that a user was given to group their friends impacted the resultant groups. While there were some expected differences (such as time taken to group), we also observed differences in the composition of the groups, specifically with friends who belonged to multiple groups, and also in the strategies used to create the groups.

Mechanisms

We briefly describe the trends we saw in each of the four mechanisms.

Card sorting. All participants in the card-sorting group used an identical strategy of beginning at the top of the pile of cards and working their way through it in the order it was given to them (random). For each friend, they decided on a group to place them into, placed the card on the table in the area they had designated for that group, and continued. They created new groups only when they got to a card for a person who didn't fit into the groups that had already been created. Each card-sorting participant used the by-friend approach.

All twelve card-sorting participants placed each of their friends into exactly one group. One-third of our card sorting participants created single-person groups when there was not a better fitting group. Many participants seemed to hesitate with certain people, in some cases because they admitted they could not figure out who that person was, in other cases because they had a person who crossed multiple places, times, and contexts in their life. CS1, when asked if there was overlap between her high school and college groups said: -Yeah, a number of them. I put them in the high school group, because that is where I first met them.‖ None of the participants in this condition placed similar people between two groups, or -duplicated‖ the card, although there were blank cards and pens within sight.

Grid tagging. The grid-tagging condition did not lead to a common grouping strategy among participants. Some participants followed an approach similar to that used in the card-sorting condition, where each person was assigned a group before moving on to the next. Others attempted to list all of the groups they believed they would need before placing any friends, and others completed a page at a time, scanning the 20 friends per page before moving on, an artificial limit that our mechanism imposed.

Many participants did not place some of their friends into any group. 4 of our 11 participants in the grid-tagging condition had multiple friends who received more than one tag. While overlap did occur, many participants questioned if it was permissible. GT10 specifically asked, -Can you put someone into more than one category?‖ File hierarchy. While the main intent of the file-hierarchy condition was to provide participants with an easy and familiar method to create subgroups and organize friends into a hierarchical structure, we found participants did not take advantage of this. We did not explicitly say or demonstrate that subgoups were possible, as with all the other conditions. In some of the follow-up privacy scenarios participants did create subgroups, but even these events were extremely infrequent. More commonly participants would navigate into the groups, select or point at the users that were relevant to the given privacy scenario, and then navigate away. We did have some participants in the other conditions also try to use -subgroups‖ by creating groups that they later combined in response to certain scenarios.

Facebook friend list interface. The Facebook friend list interface was flexible enough that our participants used multiple strategies. Some participants created each of their ideal lists first before placing participants, others created lists as they went. Participants grouped both by group or by friend.

The edit friends page, where we had users begin, was not necessarily their preferred interface on Facebook. FB8 used the standard interface instead of the edit friends page, requiring her to recall and then search for friends, instead of paging through her entire network on the edit friends page (50 friends per page).

FB11 asked if duplicating members was allowed, and then added he had -probably accidentally done that,‖ as if it were a mistake (or possibly was prohibited in the study). Sometimes users were aware that there were overlapping groups. The number of friends placed in multiple groups may be particularly high for the Facebook interface because when adding a friend to a list, that friend's current memberships are not shown, and a user may not remember where a given friend has been placed.

Although the Facebook interface was generally faster, some users spent considerable time with it. For example, FB12, with 889 friends, spent time reviewing many of his contacts' profile pages to determine who they were. The Facebook interface was the only mechanism we tested that allowed participants to click through to view full profile pages, a frequently requested feature across the other conditions as many participants were unable to identify friends by just photograph and name.

Mechanism comparisons

In general, the participants using the card-sorting method were much faster than the grid-tagging and file-hierarchy methods (average times in seconds per friend, cardsorting: 2.52, grid-tagging: 5.79, file-hierarchy: 5.32). The Facebook interface seems to be approximately as fast as card-sorting (average 3.11 seconds per friend), but many participants were not thorough and left many friends unplaced. Additionally, verifying all Facebook friends have all been placed is considerably more difficult using this mechanism than with the other three. Participants took on average 16.8 minutes to group their friends, yet, ranged in time from 9 seconds for CS11 to group her 6 friends into 3 groups, to the 89 minutes FB12 took to group his 889 friends. While these times give us an estimate of how long grouping takes, our participants were also told to think aloud, which can dramatically affect times. For statistical comparisons between mechanisms, non-think-aloud, larger-scale tests would need to be conducted.

Just under half of the participants in the grid tagging and the Facebook interfaces placed at least one friend in multiple groups, while only one file hierarchy participant duplicated a friend, and no one in the card sorting method did. Multiple placement, if used in future interfaces, may create rule conflicts, but it may remove decisions such as whether a friend really belongs in a high school or college group. To create an interface that aligns well with people's internal feelings about their friends, allowing multiple groups seems natural. However, even for the methods where group overlapping occurred, participants often asked the researchers if they could place friends into more than one group before they did it. So, although users may think of their friends as occurring in multiple groups, the interface must make it obvious that this is possible and encouraged.

One-time grouping is insufficient for privacy

Immediately after the completion of the grouping task, we walked our participants through a series of Facebook information-sharing and related scenarios. We found that the groups that they had just created were wholly ineffective for meeting participants' privacy expectations in these scenarios. Many participants avoided using the groups they had created until prompted by the interviewer. Often when participants tried to use these groups they found them insufficient Even though participants had just spent an average of 17 minutes grouping their friends, nearly all of our participants attempted to work through the privacy scenarios without the use of the groups on the table or screen in front of them, opting instead to describe how an item of information would be shared with everyone or not placed on Facebook at all. Interviewer prompting was required to have the participants think in terms of the groups, and additional encouragement was needed to have the participants select certain groups they would or would not share items with.

For specific scenarios, such as hosting a party or event, many participants felt they would need to invite people on a case-by-case basis, and often did not consider the groups they created as a helpful starting point. CS4, when considering who to invite to a party said, -I would want a selective way of doing that, not just a group message.‖ After CS4 eventually suggested a group that might work and the interviewer asked if everyone from that group could come, he added -No, no, not all of them.‖ On the other hand, in some scenarios participants stated they would provide the same access to multiple groups. FH2 responded to one question by allowing full access to four separate groups: -These four folders are OK, I have met them, talked with them.‖ Additionally, for certain types of content sharing, such as religious and political views, participants needed to create completely new groups or tags to correctly identify a set of friends that they would share these more specific types of information with.

We set up the grouping task, as mentioned earlier, without explicitly mentioning privacy or sharing, just as Facebook's friend lists currently are: under a vague Edit Friends settings page, without any explicit reason for their existence. However even doing this, we saw what we believe are the types of groups people will make even if prompted for privacy (Jones prompted users for privacy and the groups users created share many similarities to the groups in our study [START_REF] Jones | Feasibility of structural network clustering for group-based privacy control in social networks[END_REF]). Until we have more information on what an ideal privacy/sharing solution is on Facebook, and a realworld study testing dissemination through groups over time, it is difficult to say which grouping-mechanism is the best, and therefore we attempted to gain an understanding of the difference between mechanisms, while also investigating how people already deal with privacy management on Facebook (without skewing the grouping task).

When participants did decide to indulge the interviewer and think about our specific privacy questions in terms of groups, the groups quickly proved insufficient. When a participant thoroughly reviewed a group, the group was frequently cleaved in two, or often required a few special cases to be removed before it would be suitable to share a specific photo gallery or vacation information with. When asked who GT4 would not have wanted to share her vacation information with she said, -Oh, my cousins.‖ When we asked if this was all or some of her cousins, she stated, -just a few‖ and proceeded to highlight which cousins should not have access to this information. A family group alone, which many users commonly create, could never have captured this specific event.

Additionally, participants often had difficulty relocating a particular participant, occasionally not being sure which group they placed them into a few minutes earlier. FH9 described not being able to locate a friend she had just placed: -This Teresa, oh wait, she might be in classmates. Or did I put her in acquaintances, maybe I put her in acquaintances....That's weird. I don't see her name.... I can't find Teresa, this is so weird, it is like she disappeared.‖

Privacy-related observations

Many participants appear to have developed strategies for protecting their privacy on Facebook without using groups.

For example, many of our participants seem to believe that regardless of the Facebook privacy settings, things they are putting on Facebook may be seen by anyone, and will thus only post information they consider public. People believed that they were able to use their discretion and not post any compromising pieces of information or anything that could be misconstrued as being compromising. When asked about possibly sensitive topics such as political and religious views, some participants stated that it didn't matter who saw these, and thus they were suitable for Facebook, while others said they would never put these topics on Facebook. This furthers the argument that users are unable or unwilling to utilize the full extent of Facebook's privacy settings.

Similar to previous studies [START_REF] Preibusch | W3c workshop on privacy for advanced web apis[END_REF], our participants varied in what they were comfortable posting. FH2 said of her vacation photographs: -Those pictures, they are just pictures, there is nothing about privacy.‖ CS12 said of her cell phone number: -I let all my friends have it... if I am friends with them on Facebook I feel like they can talk to me anytime.‖ This is further evidence that controls must be flexible enough to allow for users to specify desires that match their own personal preferences.

GT11 created two groups she explicitly had specific sharing requirements for, a group called -ex-boyfriends‖ and another created for a past stalker. Many other participants created groups of friends with whom they were not close, with labels such as -don't know very well‖ or -people I've grown apart from.‖ In total, 11 of our participants made a group that we coded as -distant friends.‖ Even less closely related than distant friends, groups of people our participants could not identify, didn't know, or were described as -random people‖ were created by 14 of our subjects. As we discussed earlier, profile photographs significantly benefited users (names alone were often not enough). However, Facebook profile links were also desired (and used in the Facebook friend list condition), and without them some users admitted to being unable to identify a small percentage of their friends. GT10 said, -I don't know who this woman is-she just friended me, I replied. I can't remember who she was.‖ FH2 stated of one friend: -I don't even know this person.‖ GT4 said of her -random‖ group: -The random people I don't even remember where and who they are.‖ CS1 had a group she described as: -These are people I cannot remember for the life of me.‖ Many participants simply believed they had too many friends. FB10 expressed this best, just a few minutes into the original grouping saying, -I should have cleaned out my friends list before I came here.‖ GT3's comments were similar: -Wow I wish I didn't have so many friends.‖ In general, participants had friends they didn't recognize, didn't know, and didn't want to expend the effort into grouping. Based on the post-survey 19 (41%) of our participants said they sometimes, often, or very often accept friend requests, -just to be nice.‖

In addition, participants were asked if they had any friends who sent too many application invites. If they answered yes, they were asked if they would consider placing these friends in a group to block them from sending application invites. What we found was that most would not do this and would continue to block the applications themselves. They didn't want to censor their friends in any way, as one user put it. This shows that users find applications themselves to be annoying, rather than the people who use the applications.

We also asked participants whether they had untagged themselves from photos. Most often, participants would tell us they did so because the picture was unflattering or perhaps inappropriate. This begs the question, what do people consider inappropriate enough that they would restrict others from seeing it? And more importantly, are there still people they would like to grant permission to see that content through privacy settings?

Recommendations

Our finding suggest some recommendations for designers of contact-grouping mechanisms in online social networks. These recommendations are not to be taken as a hard and fast list of requirements, but rather to provide a direction for improving interfaces to address real-world access-control needs. Our analysis has focused on privacy and security decisions and the actual content and sharing decisions that our participants make on Facebook.

Provide ad-hoc grouping. One of our key findings above was that a priori usercreated groups do not meet users' needs for use as access-control groups. While these groups provide a starting point for users to rationalize about their sharing decisions and understand the space of their online friend network, without allowing ad-hoc modifications they fail. We recommend that contact-grouping interfaces allow for usable, in-situ, temporary group modifications. This would allow a user preparing to post content they are aware is privacy-sensitive to select some number of pre-created groups, briefly review the summed memberships, and remove or add misaligned contacts.

Tagging and filtering. In addition to ad-hoc grouping controls, it seems that because many groups are based on specific contexts, contacts overlapping between groups could be common. For example, Family, Church, and Hometown might all share certain members. To allow for this model without requiring the user to necessarily construct groups, the interface could allow searching based on information Facebook already has, such as friends with a similar current city, or contacts with the same high school or university listed. These filters could then be constructed into permanent groups (with user modifications made).

Additionally, we recommend that users be able to tag their friends with other freeform terms that could be further filtered or searched across. These tags could be similar in nature to Facebook's own friend relationships once requested upon friending; however, they should be private and not require external approval. Ideally these could also not only be added through a privacy/friends management interface, but also directly through a drop-down while viewing a friend's profile. Assistance through automation. Automated approaches for helping users create and modify groups could be enormously useful. In addition, approaches that would suggest access-control settings or remind users that they might want to restrict access to sensitive information could be helpful. These are areas where additional research is needed.

Holistic view. Previous work has suggested that access-control interfaces should contain a -holistic view‖ that allows a high-level, single-screen look at the entire policy [START_REF] Reeder | Expandable grids for visualizing and authoring computer security policies[END_REF]. Currently, the closest Facebook comes to that is the previously mentioned edit friends screen, which is still paginated and therefore does not actually provide a single complete view (nor does it scale particularly well). This is one of the greatest strengths of the physical card sorting mechanism: every participant was able to know that they had placed each of their friends, while understanding the relative sizes and relations of each group to the others. At the end of the grouping task, the table became their holistic grouping policy, which they could easily point to, gesture at, and modify throughout the privacy scenarios.

Iterative management tools. While our grouping task occurred for participants in a single session in our laboratory, the makeup of online social networks, and members' relations, change over time. While we have little understanding how users would like to and should modify their groups over time, we do know that the current interfaces do not assist this process. Indeed, nearly all (80%) of our subjects reported that they have either never or only once updated their friend lists.

Grouping is not the primary task. While we believe all of these recommendations will lead toward better interface design, we want to emphasize that the act of friend grouping is not a primary task. Friend groups should be defined to assist users in managing their communications, content sharing, and general privacy on social networks. If the groups do not accomplish this task, then the privacy they seem to create is simply an illusion.

http://www.xsortapp.com/

This study was conducted before the release of Facebook Places, so in the study it was posed as a theoretical feature that offered real-time location sharing.