Privacy by Design in Brain-Computer Interfaces

Brain-computer interfaces (BCIs) represent a direct communication link between the brain and an external device. By using the measured brain signals for communication, BCIs allow for non-verbal communication between a user and a device. In the last decade, BCIs have mostly been used in medical applications, typically to assist, augment or repair human cognitive or sensory-motor activities. In the recent years, however, BCIs have gained popularity in the gaming and entertainment industry. In this paper, we focus on privacy issues and legal implications arising from the use of BCI devices in medical, as well as in gaming, entertainment and marketing applications. Based on the observation that BCI devices provide an access to our unique brain wave patterns, which allow others to make inferences about our memory, intentions, conscious and unconscious interests, as well as about our emotional reactions, we conjecture the impact of exploiting, or even mishandling BCI devices will be severe and far-reaching. We thus believe that privacy issues arising from the use of BCI devices deserve immediate attention. The goal of this paper is to start the discussion about possible engineering and legal steps that can be made to prevent these emerging issues. Introduction Brain-computer interfaces (BCIs), also known as brain-machine interfaces, represent a direct communication link between the brain and an external device, such as a computer or a smart phone. By using the measured brain signals for communication, BCIs allow for non-verbal communication between a user and a device. In the last decades, BCIs have mostly been used in medical research, to assist, augment or repair human cognitive or sensory-motor capabilities. In the recent years, however, BCIs have gained popularity in f ction, gaming and the entertainment industry. There currently exist several low-cost consumer BCI devices, including Emotive System [1], NeuroSky [2] and Neural Impulse Actuator [3]. In this paper, motivated by the recent work of Martinovic et al. [11], we focus on privacy issues and legal implications arising from the use of BCI devices in medical, gaming, entertainment and marketing applications. BCI devices measure and record signals generated by neural activity. Since neurons in the brain are connected, these signals contain the wealth of information from different parts of the brain. With suff cient computational power and tools, in the era of Big Data, this extra information can allow others to make inferences about our memory, intentions, conscious and unconscious interests, as well as about our emotional reactions. The impact of exploiting or mishandling BCI devices is diff cult to estimate. It may be severe. Thus privacy issues arising form the use of BCI devices deserve immediate attention. We give a brief overview of BCIs and recent results. We then present possible privacy threats arising from an unauthorized or malicious use of BCI devices. The goal of this paper is to start the discussion about possible engineering and legal steps that can be made to prevent these issues. We discuss a possible approach and present some of the challenges in implementing it.