XR for All: Accessibility and Privacy for Disabled Users

XR for All: Accessibility and Privacy for Disabled Users

Speakers: Dylan Fox, Director of Operations, XR Access

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=LysMyDrOGn4

Overview

Dylan Fox, Director of Operations for XR Access, delivered a compelling talk at DEF CON 32 titled "XR for All: Accessibility and Privacy for Disabled Users." The presentation underscored the critical importance of integrating accessibility into Extended Reality (XR) technologies—encompassing Virtual Reality (VR), Augmented Reality (AR), and Mixed Reality (MR)—from their foundational design stages. Fox challenged the common misconception that accessibility is a mere compliance checklist for a minority, instead framing it as a universal design principle that benefits everyone, irrespective of their transient or permanent abilities.

The talk highlighted the transformative potential of XR to empower individuals with disabilities, offering new avenues for interaction, learning, and engagement that traditional technologies may not provide. However, it also critically acknowledged that these benefits are inextricably linked with significant privacy risks. The core agenda of the presentation, as outlined by Fox, was to explore these benefits, delineate the associated privacy challenges, and propose best practices for mitigating these risks, ultimately aiming for a future where XR can offer the best of both worlds: unparalleled accessibility coupled with robust privacy protections.

By bringing this topic to a security conference like DEF CON, Fox emphasized that privacy and security are not secondary considerations but integral components of truly accessible XR. The discussion served as a vital call to action for developers, designers, researchers, and policymakers to collaborate on building an inclusive XR ecosystem that respects user agency and protects sensitive personal data, especially for those who stand to gain the most from these emerging technologies.

Background

▶ Watch: Speaker introduction, topic, and agenda (0:00)

The genesis of the discussion on XR accessibility, as presented by Dylan Fox, lies within the XR Access initiative. Founded in 2019 and now a proud research initiative of Cornell Tech in New York, XR Access emerged from a community-driven desire to ensure that nascent XR technologies are accessible to people with disabilities. The organization's mission is multifaceted: to connect diverse communities—including technical platforms, content creators, researchers, government bodies, and disabled individuals—to collaboratively solve the "thorny problems" of accessibility; to conduct fundamental research on how to make XR technologies usable, particularly for blind and low-vision individuals; to develop and disseminate resources for designers and developers; and to advocate and educate on the pervasive importance of XR accessibility.

A central theme of Fox’s talk was the redefinition of accessibility itself. He vehemently dispelled the notion that accessibility is a "checklist" driven by bureaucratic mandates or a charitable act for a select few. Instead, Fox articulated a more expansive and inclusive understanding: accessibility is the ability to use something effectively, regardless of one's specific abilities. He posited that all individuals possess a spectrum of abilities—to see, hear, or touch—which can, at various times, become "hampered." This can be due to permanent conditions (e.g., genetic deafness), temporary impairments (e.g., an ear infection), or situational limitations (e.g., being in a loud environment like a concert or a bustling arcade).

This leads to a crucial philosophical shift: disability, in Fox's framework, is not an inherent characteristic of an individual but rather a mismatch between a person's abilities and the expectations or assumptions embedded within the technology or environment they interact with. A person using a wheelchair, for instance, is not "wheelchair-bound" but rather empowered by their mobility device; they become disabled only when confronted with an environment, such as a building accessible only by stairs, that fails to accommodate their mode of mobility. This perspective, championed by accessibility advocate Cindy Lee, suggests that "we're all just temporarily abled," implying that everyone, at some point in their lives, will experience some form of disability, whether due to aging, injury, or situational factors. Therefore, designing for accessibility is not a niche consideration but a universal benefit.

Within the context of XR, Fox identified two primary perspectives for approaching accessibility:

1. Core Platform Accessibility: This principle dictates that every XR application, from popular games like Beat Saber and Vacation Simulator to advanced simulations used in research and industry, should be inherently accessible to anyone who wishes to use them. This means building accessibility features directly into the foundational layers of XR platforms and applications.
2. XR as Assistive Technology: This perspective focuses on developing XR tools specifically designed to support people with disabilities in their daily lives. These technologies would leverage the unique capabilities of XR to overcome specific challenges, offering tailored solutions that enhance independence and quality of life.

These foundational concepts set the stage for understanding the intertwined benefits and risks of XR for disabled users, emphasizing that proactive, inclusive design is paramount for the ethical and effective deployment of these powerful new technologies.

Key Findings

▶ Watch: Debunking common accessibility misconceptions (2:20)

While the talk's outlined agenda promised a detailed exploration of the specific benefits, privacy risks, and mitigation strategies associated with accessible XR, the provided transcript primarily focused on establishing a robust foundational understanding of accessibility and the mission of XR Access. Therefore, the core "findings" presented were more conceptual and philosophical rather than concrete technical results or specific vulnerability disclosures.

The most significant finding articulated by Dylan Fox is the indispensable necessity of proactive, inclusive design in XR development. He asserted that accessibility is not a feature to be bolted on post-development, but a fundamental design principle that must inform every stage of creation. This perspective views accessibility as a universal benefit, dispelling the myth that it caters only to a small, specific demographic. By emphasizing that "accessibility affects all of us" and that "we're all just temporarily abled," Fox underscored that designing for diverse abilities inherently enhances usability and experience for everyone.

Furthermore, the talk implicitly highlighted the dual nature of XR's impact: its immense potential for empowerment and its inherent capacity for privacy infringement. Although specific benefits and risks were not detailed in the transcript, the speaker's agenda clearly positioned these as critical areas of discussion. The overarching finding is that XR, by its very immersive and data-rich nature, can either be a powerful equalizer and enabler for disabled individuals or a significant vector for new forms of discrimination and privacy violations, depending on how it is designed and implemented. The central message is that the XR community must actively engage with these complex trade-offs to ensure an equitable and secure future for all users.

Technical Deep Dive

▶ Watch: Redefining disability: abilities vs. environmental expectations (4:40)

The presentation by Dylan Fox at DEF CON 32 was primarily conceptual and philosophical, focusing on the overarching principles of accessibility and privacy within the context of Extended Reality (XR). As such, the talk did not delve into specific technical architectures, protocols, code examples, or detailed implementation strategies for making XR accessible or for mitigating privacy risks at a granular level. The speaker's emphasis was on the why and what of XR accessibility, rather than the how from a deeply technical standpoint.

Despite the absence of explicit technical details, the implications for technical design are profound. The speaker's call for core platform accessibility suggests that XR hardware and software developers must embed inclusive design principles into their fundamental frameworks. This would necessitate consideration of:

• Alternative Input Methods: Beyond standard hand controllers, accessible XR might require robust support for gaze tracking, voice commands, brain-computer interfaces (BCIs), haptic feedback systems, and adaptive physical controllers to accommodate users with varying motor skills or visual impairments.
• Sensory Modality Adaptations: For users with sensory disabilities, XR experiences would need to offer customizable visual settings (e.g., contrast, font size, colorblind modes), audio descriptions for visual elements, and visual representations for auditory cues (e.g., captions, spatial audio visualization). Haptic feedback could convey critical information for users with visual or auditory limitations.
• Cognitive Load Management: Designs should account for diverse cognitive abilities, offering adjustable complexity levels, clear navigation, and reduced cognitive load through intuitive interfaces.
• Spatial Awareness and Navigation Aids: For users with visual impairments, XR environments could incorporate advanced spatial audio cues, virtual guide systems, or haptic pathways to aid navigation and understanding of virtual spaces.

From a privacy perspective, while specific technical risks were not detailed, the very nature of XR implies the collection of highly sensitive data. XR systems typically track gaze direction, body movements, biometric data, physiological responses (e.g., heart rate, skin conductance), voice patterns, and environmental scans. These data streams, when combined, could create a highly detailed profile of an individual's physical and mental state, potentially revealing disabilities, emotional responses, or even health conditions. The technical challenge, therefore, lies in developing Privacy-Enhancing Technologies (PETs) that can process and utilize this data for accessibility features (e.g., eye-tracking for input) without compromising user privacy (e.g., selling gaze data for advertising). This would involve robust encryption, on-device processing, federated learning approaches, and granular user controls over data sharing.

In summary, while the talk did not provide a "technical deep dive" in the traditional sense of presenting code or system diagrams, it laid out a critical conceptual framework that demands significant technical innovation and ethical consideration from XR developers. The challenge is to translate these inclusive principles into robust, secure, and private technical implementations that truly make XR "for all."

Demo / Proof of Concept

▶ Watch: Cindy Lee's 'temporarily abled' perspective (5:58)

The transcript for Dylan Fox's talk indicates that no live demonstration or proof of concept was presented during the session. The speaker encountered technical difficulties at the outset, stating, "I didn't bring my laptop because, uh, I had been given many fearmongering tales... of Defcon and the vicious hackers within, as this is my first time at Defcon." He attempted to secure a laptop from the XR Village host but was unsuccessful, leading him to offer to present from his phone or resort to "theater of the mind." Given these circumstances, the presentation focused entirely on verbal communication of the concepts and the mission of XR Access, without any visual or interactive demonstrations of accessible XR technologies or privacy mitigation strategies.

Defensive Implications

▶ Watch: Core platform vs. assistive XR technology (7:00)

Although Dylan Fox's talk did not delve into specific technical vulnerabilities or detailed privacy breaches within XR, it critically highlighted the inherent privacy risks that accompany the immense benefits of accessible XR. The defensive implications, therefore, revolve around anticipating and proactively mitigating these risks, especially for disabled users who may share particularly sensitive data with these systems.

The very nature of XR technology necessitates the collection of an unprecedented volume and intimacy of personal data. XR devices track:

• Biometric and Physiological Data: Gaze patterns, pupil dilation, head and body movements, hand gestures, voice tone and content, and potentially even heart rate or brain activity.
• Environmental Data: Detailed scans of a user's physical surroundings, including home layouts, objects, and other people.
• Behavioral Data: How users interact with virtual objects, their reactions to stimuli, and their navigation patterns within virtual spaces.

For disabled users, XR applications designed as assistive technology might require access to even more specific and intimate data about their abilities, limitations, and compensatory strategies. This data, if misused or compromised, could lead to significant harm, including:

• Discrimination: Profiles detailing a user's disability could be used to deny services, employment, or insurance.
• Targeted Exploitation: Behavioral patterns or emotional responses revealed through XR data could be exploited for highly personalized and manipulative advertising or phishing schemes.
• Re-identification: Even anonymized data, when combined with other public datasets, could potentially re-identify individuals, exposing their disabilities or other sensitive attributes.
• Security Risks: Compromised XR devices could allow unauthorized access to private environments (via cameras and microphones) or enable manipulation of assistive features, potentially endangering users.

To defend against these profound privacy risks, a multi-faceted approach is essential for developers, platform providers, and users:

1. Privacy by Design: This principle must be embedded from the earliest stages of XR system and application development. Privacy considerations should inform architectural decisions, data flow, and user interface design.
2. Data Minimization: Collect only the data absolutely necessary for the intended purpose (e.g., enabling an accessibility feature). Avoid collecting ancillary data that could be inferred or is not directly required.
3. Transparency and User Control: Users must be provided with clear, understandable information about what data is being collected, how it is used, and with whom it is shared. They should have granular control over data permissions, with easy-to-access and revoke options.
4. Robust Security Measures: Implement strong encryption for data in transit and at rest, secure authentication mechanisms, and regular security audits. Protect XR devices and cloud infrastructure from unauthorized access and cyber threats.
5. On-Device Processing and Federated Learning: Where possible, process sensitive data directly on the XR device, minimizing the need to send raw data to cloud servers. For machine learning models that enhance accessibility, consider federated learning approaches that train models on decentralized data without centralizing raw user information.
6. Anonymization and Pseudonymization: Employ robust techniques to de-identify data when it must be shared or analyzed, ensuring that individual users cannot be easily identified. However, acknowledge the limitations of these methods, especially with rich XR data.
7. Ethical AI and Machine Learning: If AI is used to power accessibility features, ensure it is developed and deployed ethically, free from biases that could disadvantage disabled users, and with privacy safeguards built-in.
8. Industry Standards and Regulation: Collaboration among industry leaders, accessibility advocates (like XR Access), and regulatory bodies is crucial to establish and enforce best practices for XR privacy and accessibility.

In essence, the defensive implications of Fox's talk underscore that the promise of XR for disabled users can only be fully realized if privacy and security are treated as non-negotiable foundations, not optional add-ons. Proactive, ethical design is the strongest defense against the unique and significant risks posed by these immersive technologies.

Key Takeaways

• Accessibility is a Universal Design Principle: Contrary to being a niche concern or a compliance checklist, accessibility is fundamental and benefits all users, as everyone is "temporarily abled" and may experience situational or permanent limitations.
• Disability as a Mismatch: Disability is primarily defined by the mismatch between an individual's abilities and the design assumptions of technology or environments, rather than an inherent personal characteristic.
• XR's Dual Role in Accessibility: Extended Reality holds immense potential both as a platform where all applications should be accessible by design (Core Platform Accessibility) and as a dedicated toolset for empowering individuals with specific needs (XR as Assistive Technology).
• Proactive Integration is Crucial: To avoid excluding disabled users and mitigate future retrofitting challenges, accessibility must be integrated into XR development from its inception, guiding hardware, software, and content creation.
• Significant Privacy Implications: The immersive and data-rich nature of XR means it collects highly sensitive biometric, physiological, and environmental data, which, if mishandled, poses substantial privacy risks, particularly for disabled users whose intimate data could be exposed or exploited.
• Collaboration is Key: Organizations like XR Access play a vital role in fostering collaboration among diverse stakeholders—tech companies, researchers, government, and disabled advocates—to collectively address the complex challenges of making XR both accessible and private.

About the Speaker(s)

Dylan Fox is the Director of Operations for XR Access, a prominent initiative dedicated to ensuring that virtual, augmented, and mixed reality technologies are accessible for people with disabilities. XR Access was founded in 2019 and operates as a research initiative of Cornell Tech in New York. In his role, Fox is instrumental in connecting various communities, including major technical platforms, content creators, researchers, government officials, and disabled individuals and their advocates. He oversees efforts to research the fundamentals of accessibility in XR, develop resources for designers and developers, and actively advocates and educates on the importance of inclusive design within the burgeoning XR landscape. His work emphasizes a holistic approach to accessibility, viewing it not as a regulatory burden but as a fundamental aspect of human-centered technology design.