Célestin Matte

Mathieu Cunche

Overview of real-world deployment of physical analytics systems

Keywords: public acceptance, and engineering aspects Wi-Fi, tracking, privacy Aperçu Wi-Fi, traçage, vie privée

This document studies the real-world deployment of physical analytics systems.

Starting with a few real-world examples, it then discusses various aspects of such systems: privacy implication, regulation, consent,

1 Introduction

The recent wide-scale spread of Wi-Fi-enabled mobile devices came with a privacy threat to their owner. In order to discover surrounding networks, these devices continuously emit signals.

These signals contain a number uniquely identifying the emitting device: the MAC address. As a consequence, emitted signals may be collected by a passive attacker, which can then obtain sensitive information such as the presence of the device along time. Such a design aw is exploited by real-world actors to perform physical tracking.

Radio-based physical tracking relies on sniers that collect identiers contained in messages emitted by radio-enabled devices [START_REF] Freudiger | How talkative is your mobile device? An experimental study of Wi-Fi probe requests[END_REF]. These identiers are used to detect users' presence and estimate their mobility. Because Wi-Fi is included in many portable devices and relatively easy to sni, it is the main radio technology used in the physical tracking industry. Closely related, Bluetooth is another wide-spread option for device tracking.

Deploying passive sensors, one is able to collect frames of all nearby activated devices. These sensors can be cheap, as many commercial o-the-shelf Wi-Fi cards can be turned into socalled monitor mode, which allows them to collect frames even if they are not addressed to them 1 . Because Wi-Fi-enabled devices permanently perform active scanning, most of them can be detected by a passive tracking system (see discussion in the introduction). Figure 1 schematizes such a Wi-Fi tracking system.

Such physical analytics systems are booming in various places of the world. Due to the recent proliferation of Wi-Fi-enabled mobile devices (detailed in section 2), many companies have seen this as an opportunity to gather statistics about clients, populations or vehicles and developed systems for that matter.

We give an overview of the current deployment of Wi-Fi and Bluetooth physical analytics systems in its various forms throughout the world. We do not mean to be exhaustive, as we primarily focus on French and English-speaking resources (thus excluding many local press articles). We start by discussing the recent evolution of trackable devices in section 2. Then, we list some installations in section 3. In section 4, we discuss their actual privacy guarantees.

Section 5 lists details of regulations and their applications in various countries. Section 6 talks about consent and its possible implementations. Finally, in section 7, we give evidences of the generally negative acceptance of tracking systems in public opinion.

Due to the close proximity of Bluetooth and Wi-Fi analytics systems, we group both of these technologies in this document.

1 To be precise, the monitor mode prevents the card from dropping frames whose destination address is not either their own MAC address, a broadcast or a multicast address.

RR n°9143 2 Evolution of the wireless landscape

First, let's study the evolution of the number of everyday-carried Wi-Fi-enabled mobile devices to justify the wide-scale privacy threat of tracking. Adoption of Wi-Fi-enabled mobile devices has developed rapidly in the last few years. For instance, in the U.S., the rate of adults owning a smartphone skyrocketed from 35% in 2011 to 68% in 2015 [START_REF] Anderson | Technology device ownership[END_REF], reaching 77% in latest surveys [START_REF]Mobile fact sheet[END_REF]. Similarly, tablet computer ownership rose from 3% in 2010 to 51% in 2016. France exhibits a similar trend: smartphone ownership rate rose from 29% in 2012 to 65% in 2016 [START_REF]L'État d'internet en france[END_REF].

Number of devices

Detection possibilities

Despite their wide spread, are these devices good candidates for tracking? In this section, we will discuss the number of devices which satisfy the conditions to be detectable: carried by their owner, active, possessing a functioning Wi-Fi interface, and actively sending frames.

A study in the U.S. shows that 94% of smartphone owners carry their phone frequently, and 82% turn them o either rarely or never [START_REF] Rainie | Americans' views on mobile etiquette[END_REF]. However, all of these devices are not detectable at all times: all devices do not send Wi-Fi frame periodically, or the Wi-Fi interface can be temporarily deactivated or malfunctioning. In 2017, penetration rate of mobile telephony is greater than 100% in many parts of the world [START_REF] Insee | Tableaux de l'économie française[END_REF].

Estimating how many of these devices are trackable is an unanswered question. To our knowledge, no public study of Wi-Fi activation rate on mobile devices exists. Besides, we showed that devices whose Wi-Fi switch is o can still be lead to emit Wi-Fi signals [START_REF] Matte | Does disabling Wi-Fi prevent my Android phone from sending Wi-Fi frames?[END_REF].

Estimating the ratio of devices over the number of people in a population is a tough question.

A number of biases exist, i.e. depending on the country [24,[START_REF] Insee | Tableaux de l'économie française[END_REF], the population's distribution of ages [START_REF] Rainie | Americans' views on mobile etiquette[END_REF], education [START_REF]Mobile fact sheet[END_REF], developed environment [START_REF]Mobile fact sheet[END_REF], income [START_REF]Share of adults in the united states who owned a smartphone from 2011 to 2013, by household income[END_REF] or socio-professional category [START_REF] Insee | Tableaux de l'économie française[END_REF], etc [START_REF]New york city mobile services study: Research brief[END_REF]. Dierent gures have been presented regarding the number of trackable devices. In 2013, a Wi-Fi tracking company put forward the gure of 40% to 60% of a mall's visitors, depending on the location (city) [START_REF] Hardy | Technology turns to tracking people oine[END_REF]. In [START_REF] Weppner | Monitoring crowd condition in public spaces by tracking mobile consumer devices with wi interface[END_REF], authors calculate the ratio of devices over population size in a car manufacturer exhibition, using a ground-truth obtained via camera detection. Their results indicate that the targeted population is on average 1.5 times more numerous than the number of devices, this factor varying from 1.0 to 2.6. Experimental results indicate potential large dierences in this factor in similar events. Performing captures in 10 security conferences around the world in 2012-2013, Wilkinson recorded factor ranging from 0.44 to 3.75 between the number of devices and the number of conference attendees 4 [START_REF] Wilkinson | Digital terrestrial tracking: The future of surveillance[END_REF]. A study in 2015 in Manhattan [START_REF] Constantine | Urban phenology: Toward a real-time census of the city using Wi-Fi data[END_REF] using census and administrative data from several sources as groundtruth values found results within ±15% of these census data. Their estimate is even between 2 to 5% of the counts of the most reliable sources, according to them. As they do not adapt the count of Wi-Fi-enabled devices to the estimated population count, this suggests a close one-toone correspondence between population count and Wi-Fi-enabled devices count. This result is quite surprising, considering a survey in the same city in the same year which found that only 79% of the population owned a smartphone [START_REF]New york city mobile services study: Research brief[END_REF]. This rate lower than 1 may be compensated by people carrying more than one device. It must be noted that this study gathers all conditions for statistics using Wi-Fi-enabled devices counting to give reliable results: number of passers-by is always great enough for results not to be aected by an important standard variation. Moreover, smartphone ownership in this city is high even among groups usually aected with a low ownership rate, such as low-income or old people [START_REF]New york city mobile services study: Research brief[END_REF]. According to a presentation slide for the tracking installation in the Railway museum of London (see link below), this installation reaches a 96% correlation between the number of visitors (for which they have ground truth) and the Wi-Fi-based counts, despite the fact that only 53% of visitors carry a Wi-Fi-enabled device.

Abedi et al. compared Wi-Fi and Bluetooth regarding the ability to monitor people. Their conclusion is that, due to dierences in transmission range, popularity, probing rate and default conguration in popular devices, Wi-Fi is more suitable for this application. In their experiment, among around a thousand detected MAC address from both protocols, more than 90% of them are Wi-Fi addresses [START_REF] Abedi | Bluetooth and Wi-Fi MAC address based crowd data collection and monitoring: benets, challenges and enhancement[END_REF]. On a dataset of more than 6 000 addresses, Shauer et al. obtained a similar ratio of 94% in favor of Wi-Fi addresses [START_REF] Schauer | Estimating crowd densities and pedestrian ows using Wi-Fi and bluetooth[END_REF].

All these numbers show that the possibility of tracking individuals on a massive scale has recently become a very real possibility, and therefore an issue.

Fields of application

Despite strong regulations in many countries (detailed in section 5), Wi-Fi and Bluetooth analytics installations slowly develop in many infrastructures. This section lists a few evidences of real-world analytics solutions.

Road trac analytics:

A Bluetooth-based vehicle tracking system in Houston provides real-time trac information to the general public 5 .

A tracking system based on both Bluetooth and Wi-Fi is installed on Lyon's ring road [START_REF] Grolleau | La captation bluetooth au service des aménagements urbains[END_REF].

A Bluetooth-based trac detector is installed in Maryland [START_REF] Young | Bluetooth trac detectors for use as permanently installed travel time instruments[END_REF].

Retail analytics:

In May 2017, CB Insights identied several dozens of start-ups working on location analytics for retailers [START_REF]The store of the future: 150+ startups transforming brick-and-mortar retail in one infographic[END_REF]. See also the article by Demir et al. listing analytics companies [START_REF] Demir | Analysing the privacy policies of Wi-Fi trackers[END_REF].

4 Average: 1.58; Standard deviation: 1.11 5 http://www.houstontranstar.org/faq/traffictech.aspx, consulted on 2017.06.06

RR n°9143

In La Défense in Paris, a shopping mall recently installed a Wi-Fi analytics system without prior notice 6 .

In A Wi-Fi and Bluetooth-based tracking system is operational in Amsterdam's airport since mid-2017 7 .

Apart from retail stores, Wi-Fi tracking is also used in other closed places. For instance, two museums in London now have permanent Wi-Fi tracking installations to get information such as the most visited rooms, or for security concerns 8 .

Crowd analytics / population statistics:

In the U.K., the Transport for London corporation tracked subway commuters for one month in the end of 2016 [START_REF] James | Here's what t learned from tracking your phone on the tube[END_REF].

Similarly, a wide 6-month experiment was performed in New York, using 53 APs to collect Wi-Fi information, in order to know more about population dynamics [START_REF] Constantine | Urban phenology: Toward a real-time census of the city using Wi-Fi data[END_REF].

Several Wi-Fi tracking systems are installed in various French cities: Niort since March 2017 9 , Rennes since February 2017 10 . In these hybrid cases, crowd analytics is used for retail analytics, on a larger scale.

The Chinese government made an announcement in 2011 about the installation of a tracking system in Beijing, targeting no less than 17 millions cellphones [START_REF] Kang | China plans to track cellphone users, sparking human rights concerns[END_REF]. This raised international concern about the surveillance capabilities and other possible abuse of such a system [START_REF] Rainey Reitman | China deputizes smart phones to spy on beijing residents' real-time location[END_REF]. We're not sure about the technology used in this case.

In Singapore, a company is using drones to perform wardriving with the intent to create user prole to serve advertisements. In 2015, they claimed they had no less than 530 millions user proles 11 . 6 http://tempsreel.nouvelobs.com/rue89/rue89-nos-vies-connectees/20170711.OBS1939/vous-etesreste-22-minutes-chez-l-opticien-jeudi-et-le-centre-commercial-le-sait.html, consulted on 2017.07.14 7 Evidences exist that mobile phones tracking is performed by states-sponsored agencies to retrieve stolen phones 12 , journalists [START_REF] Huang | Against the law: Countering lawful abuses of digital surveillance[END_REF] or war opponents 13 . The NSA 14 is suspected of performing cellphone tracking using a wide range of methods, including Wi-Fi-based tracking using pods mounted on drone to monitor data from both routers and mobile devices on a city scale (i.e., wardriving) [START_REF] Gellman | NSA tracking cellphone locations worldwide, Snowden documents show[END_REF][START_REF] Scahill | The NSA's secret role in the U.S. assassination program[END_REF]. They're even suspected of using tracking for assassination by drones [START_REF] Scahill | The NSA's secret role in the U.S. assassination program[END_REF]. [START_REF] Berendt | Privacy in e-commerce: stated preferences vs. actual behavior[END_REF] Privacy aspect in real-world installations

A general claim for these installations is that they are actually more privacy-preserving that other systems, such as licence plate or face recognition because of the encryption used before storing data. However, this encryption is usually weak, taking the form of the creation of a single pseudonym which can be as weak as a salt-less hashing [13]. Demir et al showed how risky this approach is. Salt-less hashing of MAC addresses can be reversed within seconds using a modern GPU, because of the small address space of used MAC addresses, mainly if the reversal attack is limited to allocated OUIs. Hashing using a salt may not be a better-suited solution, as the salt needs to be stored by the system to hash addresses on-the-y. As a consequence, compromise of a system usually includes the compromise of the salt [START_REF] Demir | Analysing the privacy policies of Wi-Fi trackers[END_REF]. Kumar when further in this analysis, taking into account the OUI semantics: OUIs registered by vendors not producing mobile devices can be ignored as well [START_REF] Kumar | Security and Privacy of Hash-Based Software Applications[END_REF].

Besides, data is often stored for long periods of time for debugging or analysis purposes. For instance, unlike originally planned, the Maryland installation ended up keeping perpetual online archives [START_REF] Young | Bluetooth trac detectors for use as permanently installed travel time instruments[END_REF]. The Lyon installation stores identiers for more than 1 month [START_REF] Grolleau | La captation bluetooth au service des aménagements urbains[END_REF], and the one in la Défense for 6 months.

A 2014 analysis by Demir et al. showed how insucient the privacy policies applied by Wi-Fi tracking companies were at that time. For many of them, they found a combination of long retention periods, data storage delegated to third-parties, weak hashing and absence of opt-out system [START_REF] Demir | Analysing the privacy policies of Wi-Fi trackers[END_REF].

Even more questionably, Wi-Fi tracking is performed by some public Wi-Fi providers. Some of them exploit their man-in-the-middle position to collect information of questionable interest such as age, gender, and photo on social media [START_REF] Krowdthink | They know where you are -an investigation into the contracts, policies and practices of mobile and Wi-Fi service providers in relation to location tracking[END_REF].

Despite their sensitive operations, some tracking systems eventually turn out to be poorly secured, exposing users to potential privacy breaches. Cerrudo reversed-engineered wireless sensors used worldwide for vehicle counting and found alarming vulnerabilities: lack of encryption and authentication, unencrypted and unsigned rmware updates [START_REF] Cerrudo | Hacking us trac control systems[END_REF].

User notications aren't always correctly done. For instance, this was one of the topics of an administrative complaint by the FTC towards the Nomi company in 2015 [13].

Some Wi-Fi analytics systems go further into tracking by combining multiple technologies to track consumers, a technique sometimes labeled convergence [START_REF] Soltani | Technological overview[END_REF]. For instance, one company goes as far as crossing at least 8 sources of information, from video camera footage to payment card data 15 . This is highly troublesome in terms of privacy, because a lot of privacy-sensitive information can be gathered from these multiple sources. Crossing them together bring even more meaningful information.

12 https://www.cnet.com/news/russian-police-spy-on-peoples-mobile-data-to-catch-thieves/, consulted on 2017.07.21

13 https://www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artilleryunits/, consulted on 2017.07. [START_REF] Huang | Against the law: Countering lawful abuses of digital surveillance[END_REF] 14 National Security Agency 15 https://retailnext.net/en/how-it-works/, consulted on 2017.07. [START_REF] Gellman | NSA tracking cellphone locations worldwide, Snowden documents show[END_REF]

RR n°9143

Privacy guarantees in these systems are complicated to enforce, and weaken their usefulness for advertisers. For instance, calculating the revisit rate of customers implies that visitors' information is kept for an extended period of time using pseudonyms, at best. While pretending to anonymize collected data, the Niort system (see above) is able to calculate this revisit rate.

Regulation

Due to these privacy issues, Wi-Fi tracking and analytics is often limited by regulation entities.

In France, the CNIL published detailed rules that retail Wi-Fi tracking installations must respect to be authorized [START_REF]Mesure de fréquentation et analyse du comportement des consommateurs dans les magasins[END_REF]:

data must be deleted when the device owner leaves the shop (it can be aggregated), or a strong collision rate must be ensured, i.e. recorded identiers must correspond to several devices (without precise numbers about this minimum collision rate).

Companies not respecting these rules can be ned or have their installations rejected or forbidden.

For instance, the CNIL rejected in July 2015 a proposition of an installation in la Défense in Paris 16 , on the basis that pseudonymization is not sucient to provide anonymity. To be more precise, they noted that MAC addresses hashing with a salt does not prevent the processing manager to cross recordings with other sources of information, or to infer other information about users. Despite the fact that a counter-procedure by the company was rejected 17 , an installation is present as of July 2017 (see section 3).

In Sweden, the Swedish Data Protection Authority amended a company to modify or cease a Wi-Fi tracking installation in the city center of Västerås because MAC addresses were stored in cleartext 18 . The installation was later accepted in exchange of modications in the systems:

MAC addresses are deleted after a few seconds, and information about the system is displayed on boards in the city and on the company's website 19 .

In the United States, the Federal Trade Commission (FTC), while not as strict as in other countries, is also careful about the privacy aspect of tracking installations [START_REF] Geuss | Creepy but legal phone-tracking company gets wrist slap for empty privacy promise[END_REF]. The Electronic Frontier Foundation (EFF), an international non-prot digital rights group, also reminded that it might be illegal to capture MAC addresses [START_REF] Higgins | Mobile tracking code of conduct falls short of protecting consumers[END_REF].

In the U.K., Wi-Fi tracking bins were removed due to privacy concern after an order from the City of London Corporation [START_REF] Guardian | City of london corporation wants 'spy bins' ditched[END_REF].

Consent in physical tracking

Consent is an important aspect for privacy protection. It basically states that users give their agreement to share information about them. As we dene privacy as the ability to choose which personal information someone shares with whom, there cannot be privacy without consent.

Two approaches exist for a user to indicate whether they want to be part of a system: 16 https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&id=CNILTEXT000031159401, consulted on 2017.07.14

Opt-in: the users explicitly announce that they want to be part of the system (and are therefore not part of the system by default).

Opt-out: the users are considered part of the system by default, and can indicate that they do not want to.

To prevent oneself from being tracked, real-world installations oer either an opt-out system, or nothing at all. For instance, we did not nd any possibility to opt out of the existing vehicle tracking systems listed above. When existing, the opt-out system is sometimes poorly advertised [START_REF] Geuss | Creepy but legal phone-tracking company gets wrist slap for empty privacy promise[END_REF]. In the Nomi-FTC case, one of the complaints was that the opt-out was global to all installations of Nomi's system, and not store-relative, and not possible inside stores. We found no evidence of existing systems using an opt-in method. When tracking is performed by Wi-Fi providers, information of the fact that users will be tracked may be hidden in the contract's details, sometimes even erroneously pretending that keeping location information is a legal requirement [START_REF] Krowdthink | They know where you are -an investigation into the contracts, policies and practices of mobile and Wi-Fi service providers in relation to location tracking[END_REF]. While this can be considered as a form of opt-in, one must remember that these terms are almost never read entirely (if at all) by users [START_REF] Obar | The biggest lie on the internet: Ignoring the privacy policies and terms of service policies of social networking services[END_REF].

Opt-out mechanisms typically involve a webpage on which the user needs to enter their device address 20 (see Figure 2). In the Niort installation, users can opt out by scanning a QR code 21 .

In La Défense, users have to send an email to oppose tracking. A problem with all of these systems is that it requires the user to be able to access its MAC address. While this is already a complex operation for a non-tech-savvy user, it is (almost) impossible for devices such as tness trackers, which do not provide easy access to this piece of information. In a shopping center in Paris, it's even been reported that customers are invited to turn Wi-Fi o altogether so as not to be tracked 22 . This is also written in the privacy policies of Amsterdam's airport's system (see link above). This method is not sucient: we showed that Android devices having the always allow scanning option activated will keep sending probe requests even if Wi-Fi is deactivated.

Moreover, we have observed a device not proposing any way to deactivate this option [START_REF] Matte | Does disabling Wi-Fi prevent my Android phone from sending Wi-Fi frames?[END_REF].

One of the problems in Wi-Fi analytics is that Wi-Fi frames are not stopped by walls. A tracking system will then record information on people not entering the place (e.g. walking in nearby streets). This is problematic when entering a place is considered a form of consent (which justies the opt-out strategy) 23 .

Tracking using other technologies than Wi-Fi or Bluetooth may be even more problematic regarding the consent question. Soltani made a summary of consent and notice in various technologies [START_REF] Soltani | Privacy trade-os in retail tracking[END_REF].

Possible improvements to opt-out mechanisms are discussed in my thesis [START_REF] Matte | Wi-Fi Tracking: Fingerprinting Attacks and Counter-Measures[END_REF].

Public acceptance

Wi-Fi tracking systems are generally not accepted by the population. A 2014 survey by Opin-ionLab on 1000 customers found a rejection rate of tracking in retail stores of 80% [START_REF] Opinionlab | New study: consumers overwhelmingly reject in-store tracking by retailers[END_REF]. Primary cited concerns are data security and spying. Fawaz et al. found a similar result of 70% of rejection in a survey on 200 Amazon Mechanical Turk participants [START_REF] Fawaz | Privacy vs. reward in indoor locationbased services[END_REF]. The latter study found that only 10% of participants accepted full gathering of their Wi-Fi broadcast information. While 20 https://smart-places.org/, http://flux-data-vision.com/optout.html for the Niort installation, both consulted on 2017.06.06 [START_REF] Huang | Against the law: Countering lawful abuses of digital surveillance[END_REF] We assume this QR code redirects to the related opt-out webpage. 22 http://www.lefigaro.fr/secteur/high-tech/2017/08/02/32001-20170802ARTFIG00264-le-bhv-aspireles-donnees-de-ses-clients-mais-il-est-loin-d-etre-le-seul.php, consulted on 2017.08.04 23 Some companies actually advertise this issue as a feature: http://www.libelium.com/products/meshlium/ smartphone-detection/, consulted on 2017.07.27 modifying the question to state that the store explicitly asks user consent for tracking, these numbers moved to respectively 61% and 15%, which suggest that consent plays a key role regarding user acceptance of tracking.

When the public is aware about existing Wi-Fi tracking installations, strong concern often rises from local association or political parties, as shown in the Niort case 24 or for an installation in Rennes 25 . The latter has lead to a suspension of the installation until the CNIL gives its opinion 26 . In the U.S., customers got unnerved about tracking in retail stores [START_REF] Cliord | Attention, Shoppers: Store Is Tracking Your Cell[END_REF]. Politician interventions against Wi-Fi analytics lead to the redaction of a code of conduct 27 for mobile location analytics [START_REF] Higgins | Mobile tracking code of conduct falls short of protecting consumers[END_REF][START_REF] Martinez | Franken still unsatised with Euclid's privacy practices[END_REF]. The latter advocates use of an opt-out system and explicit notice.

It can be noted that common users may have a bias towards accepting systems they do not understand, or if they do not understand the extent of leaked information. Kowitz and Cranor showed how users changed their attitude when shown some information leaked by their personal device on a local network [START_REF] Kowitz | Peripheral privacy notications for wireless networks[END_REF].

Acceptance of physical tracking is best understood when compared to the perception of other forms of tracking, notably online (web) tracking. Studies have shown that this form of tracking is widely rejected. A study found that 66% of adult Americans reject targeted advertisement, and would not allow advertisers to track them online if they had a choice. This number rises to 24 http://deuxsevres.eelv.fr/12/wifi-vip-un-dispositif-couteux-qui-porte-atteinte-a-la-vieprivee-des-niortais-e-s/, consulted on 2017.06.06 25 http://www.ouest-france.fr/bretagne/rennes-35000/commerce-rennes-dominique-fredj-demissionnedu-carre-rennais-4860890, consulted on 2017.06.07 26 http://www.20minutes.fr/rennes/2027787-20170309-rennes-commercants-reportent-mise-servicecapteurs-wifi-suivant-smartphones, consulted on 2017.07.14 27 https://fpf.org/wp-content/uploads/10.22.13-FINAL-MLA-Code.pdf, consulted on 2017.06.08 Inria 86% when they're explained how data is collected, and to 90% if targeting is the result of their oine activities [START_REF] Turow | Americans reject tailored advertising and three activities that enable it[END_REF]. Another study found a similar rejection rate of online tracking of 68% [START_REF] Purcell | Search engine use 2012[END_REF].

It can be noted, however, that users' behaviour often diers from their privacy statements [START_REF] Berendt | Privacy in e-commerce: stated preferences vs. actual behavior[END_REF],

and that they often have strong misconceptions about tracking [START_REF] Melicher | ) track me sometimes: Users' contextual preferences for web tracking[END_REF].

Conclusion

We saw in this document various real-world examples of Wi-Fi-based tracking systems. Most of them present shortcomings in terms of privacy, when it comes to gathering user consent, presenting an easy-to-use opt-out system, or simply following regulation guidelines.

We state that all these systems should be built following the privacy-by-design principle. The latter is a core concept when it comes to building privacy-preserving systems. It basically states that systems should integrate privacy mechanisms in their core structure, and not treat it as an optional feature. Basic concepts that ubiquitous computing-related systems must integrate are clear notices, explicit user consent, adequate security and anonymity [START_REF] Langheinrich | Privacy by designprinciples of privacy-aware ubiquitous systems[END_REF].

Some readers may be interested in the engineering aspect of physical tracking system. A part of Young's report on the Bluetooth-based trac detector in Maryland [START_REF] Young | Bluetooth trac detectors for use as permanently installed travel time instruments[END_REF] gives interesting insights about the problematics of a permanent deployment of such a system. The solutions to these issues chosen by this system's designers are the following. For the necessary resistance to temperature and humidity extremes, the sensors respect the NEMA TS2 standard, a standard for trac control assemblies. To get a sucient source of energy, each sensor is equipped with a 30 Watt solar panel. For data communication, cellular communication using a GDM modem is used. The nal cost of the installation is 7 200$ per sensor, including hardware, installation, and data cost. On the whole, the life-cycle of the system is 5 years. Additionally, Grolleau published a report discussing various aspects of Lyon's ring road's system. Similarly to the previous one, sensors are powered with 70 Watt solar panels [START_REF] Grolleau | La captation bluetooth au service des aménagements urbains[END_REF]. More information on this installation can be found in a presentation by Purson et al. [START_REF]Evaluations simultanées de diérentes technologies innovantes de recueil de données trac pour le calcul de temps de parcours en temps réel[END_REF].

Figure 1 :

 1 Figure 1: A Wi-Fi tracking system.

  the US, a company called Nomi sold Wi-Fi analytics systems to approximately 45 clients in 2013. Some clients deployed these systems in multiple locations. According to the FTC, these dierent installations collected information on no less than 9 millions of individual devices between January 2013 and September 2013 [13]. The Norwegian Data Protection Authority published a report in 2016 about tracking in public spaces, reminding concepts of consent, pseudonyms, etc. [9]. The report compares 4 tracking technologies: Wi-Fi tracking, Bluetooth tracking, beacons and Intelligent Video Analytics. The report gives two examples of Wi-Fi tracking installations in Norway: at Hamar's CC Stadion shopping center, at the Oslo airport, a Wi-Fi tracking system estimates waiting time to pass security check, using one AP before and after customs.

Figure 2 :

 2 Figure 2: Screenshot of the opt-out webpage set up by the Future of Privacy Forum: https:// optout.smart-places.org/. Users entering the address of their device opt out of Wi-Fi analytics systems deployed by most major Wi-Fi analytics companies in the US.

  https://www.schiphol.nl/en/privacy-policy/, consulted on 2017.09.13 8 http://www.gizmodo.co.uk/2017/04/exclusive-heres-what-museums-learn-by-tracking-your-phone/,

	Surveillance:
	consulted on 2017.09.08 9 http://www.lanouvellerepublique.fr/Deux-Sevres/Communes/Niort/n/Contenus/Articles/2017/03/17/
	Wifi-VIP-la-publicite-directe-sur-les-smartphones-3035563, consulted on 2017.06.06 10 http://www.20minutes.fr/rennes/2011831-20170210-rennes-capteurs-wifi-suivre-clients-centre-
	ville, consulted on 2017.08.26 11 https://venturebeat.com/2015/02/23/drones-over-head-in-las-valley-are-tracking-mobile-devices-
	locations/, consulted on 2017.07.27
	Inria

This encompasses all kinds of cellphones, not only (Wi-Fi-enabled) smartphones.

Broadband allows a fast Internet access. Inria

http://arianeinternet.conseil-etat.fr/arianeinternet/getdoc.asp?id=209297&fonds=DCE, consulted on 2017.07.14

http://www.datainspektionen.se/press/nyheter/2015/besoksflodena-i-vasteras-mats-for-noggrant-/, consulted on 2017.06.07 (in Swedish)

http://www.datainspektionen.se/press/nyheter/2015/gront-ljus-for-besoksmatning-i-vasteras/, consulted

on 2017.06.07 (in Swedish) Inria

RR n°9143

RESEARCH CENTRE GRENOBLE -RHÔNE-ALPES


Nathalie Bonneton

Daniel Mellier

The Isochronic Component of Pointing Movements in children aged from 26 to 40 months

Keywords: Motor representations, Movement, Space, Isochrony, Development

This study looks at the isochronic component of pointing movements. Eleven children between the ages of 26 and 36 months at the beginning of the study performed a pointing task twice, at a 4-month interval. The location of the target was defined by its distance from the child (13 or 20 cm) and its direction with respect to the child's mid-body line (5 positions, ranging from 90° to the right and 90° to the left). A kinetic analysis of movement time and mean speed showed that isochrony can account for the organization of movement during the third year: mean speed was increased when the distance to cover was longer, in such a way that movement time remained constant. This compensation mechanism was found already at 26 months, regardless of where the target was located.

Introduction

Studies on the planning and control of motor actions in adults have shown that movement parameters exhibit a number of systematic variations. The principle of isochrony accounts for one of these invariants. This control mechanism, which keeps movement time constant (i.e., the actual duration of the movement exclusive of response latency) no matter what distance must be covered, has been largely validated in modern-day research on the kinematics of writing [START_REF] Viviani | Space-time invariance in learned motor skills[END_REF] and on the control of other motor tasks such as pointing and reaching [START_REF] Jeannerod | The contribution of open-loop and closed-loop control modes in prehension movements[END_REF][START_REF] Ghez | Roles ofproprioceptive input in the programming of arm trajectories[END_REF]. Movement isochrony is a testimony to the motor system's ability to integrate distance into execution speed. This principle also governs the mental simulation of motor actions (Decety & Michel, 1989). In this respect many authors consider it like a motor rule used by motor representation.

The renewed interest of psychologists in the study of writing (for a review, see [START_REF] Zesiger | Ecrire, approches cognitive, neuropsychologique et développementale[END_REF] and the development of motor actions (for a review, see [START_REF] Mellier | Développement des actions motrices[END_REF]) brought together the neurobiological and psychocognitive approaches, with a new focus on how motor representations are built. In this joint approach, mental representations of motor activity are thought to act as "action simulators" that enable the subject to pre-program future actions, whether imagined or executed [START_REF] Jeannerod | The representing brain: neural correlates of motor intention and imagery[END_REF][START_REF] Jeannerod | To act or not to act: perspectives on the representation of actions[END_REF]. This view is based on the idea that there are mental links between the properties of the target,and the properties of the movement. Its proponents go along with [START_REF] Paillard | Cognitive versus sensori-motor encoding of spatial information[END_REF] in saying that a motor action is successful if the cognitive-motor system responds adequately to three types of questions: WHAT (identifying the target of the action), WHERE (locating the target of the action), and HOW (ordering and timing the action sequence).

In this "prescriptive" view, the perceptual localization stage precedes the encoding of spatial data into motor coordinates. As such, a motor representation contains information about how far away and in what direction the target is located. Abidance by the rule of isochrony for a class of movements implies that the distance parameter is encoded in the motor representation in terms of a variation in movement speed, but no variation in its duration.

The question raised here is whether this encoding rule also governs children's motor representations, and if so, at what age. The idea is to find out if the actions being acquired at all stages of development achieve perceptual-motor processing efficiency through reliance upon the movement-time constancy strategy. The present analysis will be limited to pointing and reaching tasks.

Research on children ages 4 to 8 years has shown that spatial information describing a target is not always handled in the same way by the cognitive-motor system. According to [START_REF] Hay | Etude ontogénétique du contrôle d'un mouvement: l'approche manuelle[END_REF][START_REF] Hay | Timing and accuracy of visually directed movements in children: control of direction and amplitude components[END_REF], for example, the mechanisms that control movement direction (as defined with respect to the subject's own body) are quite elementary and are operative early in life, whereas distance control mechanisms are not acquired until later. Thus, the processes responsible for controlling a movement's direction and amplitude are differentiated during the formation of pointing and reaching movements. Direction is already programmed by the time the hand starts to move, whereas distance is controlled as the action is taking place. In short, in the development of movement spatialization, amplitude is regarded as more complex than direction, and takes more time to define [START_REF] Hay | Timing and accuracy of visually directed movements in children: control of direction and amplitude components[END_REF].

The principle of isochrony in child movements was studied by [START_REF] Vinter | Isochrony and accuracy of drawing movements in children: effects of age and context[END_REF] in a circle drawing task performed in several contexts, with circles of different sizes. A comparison of the dynamic parameters of the drawing movements the children made to depict a bear, to produce a series of increasingly large circles, or to simply draw circles of different sizes without seriation, showed that the isochrony principle was more strictly obeyed when the goal was to make larger and larger circles. Thus, the planning process was based not only on the movement's amplitude, but also on the final task goal (seriation of amplitude). From a developmental standpoint, the results showed that the principle of isochrony is not applied in a steadily increasing way between the ages of 5 and 10. The authors found a U-shaped developmental curve with less compensation at about the age of 7.

These findings do not support [START_REF] Hay | Timing and accuracy of visually directed movements in children: control of direction and amplitude components[END_REF] conclusion that isochrony cannot be achieved for all actions in the motor repertoire. On a pointing task, this author has concluded that the isochrony mechanism is not in place until the age of 10.

To our knowledge, the issue of speed/amplitude compensation has never been documented for the age range between 26 and 40 months. Yet, if we see development as consisting of the successive "re-elaboration" [START_REF] Mounoud | L'évolution des conduits de préhension comme illustration d'un modèle du développement, in S. de Schonen[END_REF] or "redescription" (Karmiloff-Smith, 1992) of representations and thus of action programs, then the age range that ends with the sensorimotor stage [START_REF] Piaget | La naissance de l'intelligence chez l'enfant[END_REF] deserves particular attention because it marks the onset of access to new forms of intelligence. It would seem worthwhile to fill in the gaps in our knowledge of developmental patterns (1) by finding out if isochrony-based control is part of action planning before the age of 4 and (2) by determining whether the updating of this rule evolves in a non-monotonic fashion that reflects psychological reorganization during this period, or whether the repertoire of cognitive strategies evolves steadily.

The present study explores the way in which the cognitive-motor system of children between the ages of 26 and 40 months represents and integrates the distance parameter in a pointing task.

Method

Subjects

Eleven children (6 girls and 5 boys) were observed in two sessions held four months apart. They were 26 to 36 months old at the beginning of the study and 30 to 40 months at the end. The youngest ones were observed at their child-care center and the oldest ones, at their preschool. We made sure that the observation and data collection conditions were the same in all sessions.

It seemed like a good idea to examine the same population twice rather than setting up independent groups. Even this minimal amount of longitudinal observation, albeit on a small sample, would make us more confident about our conclusions regarding the development of motor actions.

Task and procedure

The child's task was to hold a 8-cm long stick (a "Q-tip"), dip it in a flat container of colored powder (facial makeup), and move it to a target (a piece of white paper measuring 1 sq. cm) located 13 or 20 cm from the (fixed) starting point. The container was placed on the table straight in front of the child. The direction of the target varied across trials. On each trial, the target was laid in one of five positions (0°, 45°, 90°, 135°, and 180°) marked off along one of two semi-circles (13 cm or 20 cm radius) drawn on the table but invisible to the child. The 90° mark was straight in front of the child. For all trials, the starting point and the target can be simultaneously perceived by the child.

Ten independent trials were run (5 directions x 2 distances). Testing was done in a constant random order.

The child was seated at a child-size table, and the task was performed on the horizontal plane.

The experimenter explained the task to the child as follows: "You have a small dish of colored powder in front of you. You're going to get a little bit of the powder on the stick and then put it on a little piece of paper that I'll set on the table." So as not to influence the child's choice of which hand to use, the experimenter laid the stick directly in front of the child before the task began. Eight children spontaneously chose their right hand. Two children worked with their left hand, and one child changed hands during the task.

After making sure the hand preference did not have a notable effect on the movement parameters, the data was divided up according to whether the action was carried out in the ipsilateral or contralateral field with respect to the executing hand. The 0° location was homolateral to the executing hand. All subjects were observed in two sessions held four months apart so we make sure that conditions for task and procedure was maintain constant.

Data collection and processing

The children were filmed full-face from above, at a fixed focal distance for all shots. The videotapes were analyzed using image processing software [START_REF] Cosserat | Logiciel d'analyse image par image[END_REF]) that supplied x-y coordinates for the various elements in the frames. The sampling rate was 10 images per second. The successive locations of the end of the stick relative to the movement's starting and ending points were used to reconstruct the movement's spatial and temporal organization. The measures chosen were movement time (actual duration of the movement between exit from of container and contact with the target) and mean speed.

The grasping and moving of the stick to the powder container were not included. These movements served to contextualize the task. The data analyzed only pertained to the movement of the stick from the container to the paper target.

Results

The measures (movement time, mean speed) were processed in an analysis of variance with repeated measurements. This analysis assessed the statistical effects of the following variables: observation session (2 categories) x distance (2 categories) x direction (5 categories).

Analysis of movement time

Table I gives the data (in seconds) as a function of target direction and distance, for each observation session. For all conditions taken together, we can see that movement time decreased significantly between the first and second sessions (F(1,5) = 6.52, p = .05). Comparisons among the various categories of the direction and distance variables indicated no statistically significant differences. This was true for both observation sessions.

Analysis of mean speed

For all conditions pooled, the comparison of the two observation sessions (Figure 1) yielded a significant rise in mean speed after four months (F(1,3) = 19.62, p = .02 ). In addition, mean speed increased significantly with the distance to the target (13 or 20 cm.) on both the first (F(1,5) = 60.68, p = .0006) and second (F(1,7) = 19.16, p = .003) sessions. There was no significant effect of the direction on the mean speed and no interaction was found between distance and direction on either session.

Discussion

Comparisons of the dynamic parameters (duration and speed) of a pointing task performed by children aged from 26 to 40 months showed firstly, that movement time decreased during the four months between the two observations of the same children. The mean speed increase during development is classically viewed like an improvement of the process responsible for feedback integration [START_REF] Hay | Etude ontogénétique du contrôle d'un mouvement: l'approche manuelle[END_REF]. However, an additional cross-section study will enable us to understand whether this evolution is linked to a developmental effect or to a learning effect. Moreover, target direction and distance did not have an impact on movement time at either age. These findings point to the conclusion that movement time varies little, if at all, and suggest that the principle of isochrony is being applied. Secondly, for all target directions, the mean speed of the children's movements increased with target distance, whereas movement time was the same in both observation sessions. This compensation mechanism is a testimony to the existence of an invariable temporal structure that becomes operative by the third year of life in spatially constraining tasks. At the age of 26 months, the target distance parameter is processed and integrated into the action planning process. The movement-time constancy strategy, governed by the principle of isochrony, appears to be in place by the child's second birthday and continues to be used until 40 months, with a rising curve for pointing movement speed during the four-month period studied here.

In conclusion, this study clearly showed that for pointing tasks, the duration-preference strategy (principle of isochrony) is in place by the age of 26 months and continues to take effect during the third year of life, without causing a developmental regression in the measures suggesting a non-monotonic evolution over this age range.

We are now in a position to state that at 26 months, an increase in the distance to be covered by a given movement is encoded by the cognitive-motor system as the necessity to increase the movement speed. Our conclusions disagree with those of [START_REF] Brown | The accuracy of aimed movements to visual targets during development: the role of visual information[END_REF]. In this study, a variation in target distance is not accompanied by a temporal invariance of the pointing movements executed by children aged from 1,5 to 8 years-old. However, these authors don't include the age in the movement time analysis. So, it seems difficult to make comparisons between their study and ours. Moreover, in our study, the subjects point to the target in a horizontal plane whereas it was vertical in Brown and Al 's task. This difference raises the problem of the execution constraint and a study should be undertaken in order to measure their influence on the actualization of the motor rule.

Our results support the idea that the mechanisms responsible for the parametrization of movement direction and amplitude [START_REF] Hauert | Les praxies chez l'enfant: évaluation, interprétation[END_REF][START_REF] Hay | Timing and accuracy of visually directed movements in children: control of direction and amplitude components[END_REF][START_REF] Hay | Aspects kinématiques du mouvement en fonction de l'amplitude et de la direction: étude développementale[END_REF] are independent, insofar as speed depends on distance and age, but not on target direction. Our conclusions are also in line with Vinter and Mounoud's work (1991), where variations in target direction did not change the meaning subjects gave to the task. An additional study

Table 1 .Figure 1 :

 11 Figure 1: Effect of distance to cover on mean speed

where we vary the motor intention while keeping the distance and direction constant is now underway and will serve to validate this conclusion.