In this paper, we discuss possible risks posed by the application of tailorable context-aware systems in real-life practices. We use a tailorable context-aware system in the homecare domain as a case study to identify and analyse such risks. Next, we discuss which of these risks can be generalized to the use of tailorable context-aware system in other contexts than homecare. This would help the users of such systems to prevent the risks and guide the design and implementation of them.
A context-aware system adapts its behavior based on a model of the user's
current context [
The use of TC systems can bring important bene ts in many domains. Such bene ts include easier to use, more useful and personalized services, as a consequence of proper consideration of the user's context and preferences. However, TC systems can also introduce new or increased risks for the person or organization using these systems. Such risks arise from assumptions that are made during the design, and which are typical for this type of systems, namely: the context model properly re ects reality, the tailoring is done correctly, and the provided service (e.g., in the form of advice or instructions) is used as intended.
It is therefore important to do a risk assessment of a TC system in relation to
the environment in which it will be used. Such an assessment may deliver useful
results for the design of the system and its introduction in the environment. So
far, risk assessment of context-aware systems has mainly focused on privacy and
security aspects [
The goal of this paper is to make a rst step towards introducing risk assessment concerning the availability and accountability aspects, as part of a requirements engineering approach for TC systems. As a case study, we use the design of a TC system in the homecare domain, where the system aims at supporting independent living of elderly people in their private environment.
There is an emerging trend in industrialised countries for using IT-based
care services such as health monitoring and coaching and medication reminder
to support independent living of elderly [
The concept of risk has been de ned di erently in di erent domains [
The rest of the paper is structured as follows. In Section 2, we describe our research methodology and de ne the scope of the paper. In Section 3, we brie y describe the case study with a TC system applied in homecare. In Section 4, we present the results regarding the identi ed risk. Finally, in Section 5, we discuss the lessons learned and conclude the paper. 2
The purpose of risk assessment is to gather necessary information so that
subsequent risk treatment decisions can be taken that are both e ective and e cient.
According to the ISO framework (ISO-31000), risk assessment consists of risk
identi cation, analysis and evaluation [
An essential step in risk identi cation is the identi cation of all stakeholders, their goals and their interactions with the system. Any interaction (either tailoring or using the system) that may lead to undesirable consequences for that or another stakeholder will be listed as a risk. Thus, we execute the following to reach the goal of the paper: { Identifying all stakeholders that use and interact with the system; { Describing the goals of stakeholders and their interactions with the system; { Identifying possible undesirable outcomes (risks) of these interactions; { Draw lessons learned for the general case of TC systems.
One important assumption restricts the scope of the paper. We assume that
the TC system technically works as designed, i.e., risks due to malfunctioning
of internal components of the system (the risks caused by interactive
complexity [
We performed our case study in a care-institution in the Netherlands. This institution consists of residential blocks where elderly can live and receive care services. We developed a tailorable IT-based homecare service platform to be evaluated in this care institution. To analyse the existing situation, we interviewed professional nurses who provide care services in this institution. The purposes of the interviews was to gain insight in the commonly performed tasks and the possible risks associated with these tasks.
Providing Tailorable Context-Aware Homecare (TCH) services is one of the
required features of successful introduction of IT-based care services [
{ Care-receivers should be reminded to attach the blood pressure measurement tool and measure the blood pressure themselves. { If the care-receivers ignore the reminder for attaching the measurement tool, the second reminder should be sent after half an hour. { The message, number of its repetition and the modality can be personalized based on individual requirements.
{ If the measured value is high/low, the care-giver should be informed. 4
The type of the risks we are interested is caused by di erent stakeholders participating in the homecare domain. To analyse these risks, we begin with the identi cation of stakeholders in a homecare domain where care services are provided both with and without using the TCH system. Then we identify a list of possible risks in both situations, and their sources. 4.1
The homecare domain is complex and involves various stakeholders with diverse interests (e.g., insurance companies, government, etc.). Excluding the stakeholders that fall outside the scope of the TCH system, we identi ed care-givers, care-receivers and care centers as three main types of stakeholders.
Anyone involved in providing care to the elderly (care-receivers), is considered a care-giver. Those who can provide care or interact with elderly include: professional nurses, informal care-givers and physicians. In this work, we consider only professional nurses as the care-givers, because: a) care-receivers spend most of their time with processional nurses while receiving care services in comparison to other care-givers, and b) Professional nurses are the main care-givers who interact with the TCH system to de ne service plans for care-receivers.
Care centers are institutions who pay for the care-givers and provide facilities to take care of the care-receivers. Care centers de ne medical protocols providing guidelines for taking care of care-receivers, which should comply with the national medical protocols de ned by the government. When carrying out homecare tasks, care-givers must follow these medical protocols.
As shown in Fig. 2, after introduction of the TCH system, four new types of stakeholders appear in the homecare domain. These new types of stakeholders are IT specialists, third-party service providers, infrastructure providers and hackers.
An IT specialist is a person who can install, test, operate and maintain the TCH system. IT specialists are responsible for de ning the treatment patterns based on existing medical protocols and care-givers recommendations and re ning them based on operational experiences and test results. Third-party service providers own and manage services (such as blood pressure measurement, location determination and medication dispensing services) which can be used and composed by the TCH system to provide desired services to the care-receivers. These providers are located outside the care center and their services are accessible to other services through the Internet. Infrastructure providers are responsible for providing the necessary infra services to realise the TCH system such as the Internet and power supply. Hackers are individuals or organizations who break into the TCH system and its network and violate its function.
Pharmacy Physician Informal Care-giver
Professional
Nurses
Hackers
IT Specialists
TCH System
>
Third-party Service Providers
Care Centers
Interact Care-receivers Infrastructure
Providers One of the bene ts of a TCH system, compared to the current way of providing services, is the mitigation of existing risks that stakeholders, mainly carereceivers and care-givers, are already dealing with. We identify these existing risks and discuss whether the proposed TCH system can indeed mitigate them. We also identify new risks that might be introduced due to use of a TCH system. Existing Risks We interviewed care-givers to identify the common tasks generally performed in the homecare domain. Based on the result of these interviews, we identi ed the risks in the current situation and determined whether these can possibly be decreased using a TCH system.
{ Forgetting to Treat Patients: The care-givers usually follow a routine
schedule in providing care services based on the medical protocols and
doctors advice, for example measuring blood pressure every morning right after
the care-receiver wakes up. However, it is likely that a care-giver forgets to
measure blood pressure for a speci c care-receiver or measures it late which
might result in unreliable readings. A TCH system can be used to remind a
care-receiver to attach the measurement tool whenever it is required.
{ Observation Error: The care-givers give reports about the situation of
the care-receivers to the doctors, family members, pharmacy, etc., based on
which the authorised stakeholders take appropriate actions. For example,
a doctor can prescribe new medication based on the current situation of
the care-receivers, then the pharmacy can provide it, and the care-giver
can give the medicine to the care-receivers. However, while measuring the
care-receivers vital signs such as blood pressure, the care-givers can make
mistakes in reading/writing of values, which can a ect the diagnosis made
by the doctor. A TCH system can automatically create a correct report
based on the measured data which is accessible by a doctor.
{ Action Error: The care-givers can make a mistake in providing care services
to the care-receivers. For example, a care-giver can provide a wrong medicine
to a care-receiver. A TCH system can be used to provide medication through
a digital dispenser lled with medicine by a pharmacy based on doctor's
prescription. We should take to account that there is still the possibility of
the pharmacy making a mistake when lling the medicine dispenser.
{ Overlooking the Medical Protocols: Nurses should follow the medical
protocols in providing care services, and are examined yearly to prove that
they still recall them. However, a care-giver may overlook these protocols and
make a wrong decision. A TCH system ensures the conformance of medical
protocols, because those protocols are embodied in the treatment patterns.
{ Con ict in Medication/Treatment: Care-receivers typically use
multiple medications which are prescribed by di erent specialists. A doctor may
prescribe a medicine without considering other prescribed medications that
can have negative e ects at other diseases/medicines. It is also common that
for a speci c disease, a doctors prescribes a new medicine, which has better
e ect, but without stopping the previously prescribed medicines. It is also
possible to have con ict in treatment. For example, a care-receiver can use
advise or treatment from di erent professionals, such as a family doctor,
hospital doctor and physiotherapist, which may in itself be correct, but not
optimal if used in combination. This risk can be easily detected by a TCH
system, if there are prede ned rules for con icting medicines/treatments.
Risks of Using the TCH System One of the key motivations for replacing
manual activities with automatic IT-based systems is human error reduction.
However, many practical experiences shows that in reality, automation may
produce new sources and types of errors [
Wrong Con guration: Setting the wrong values for the con guration parameters, e.g., setting higher/lower values for the threshold of blood pressure. Con icting Service Plans: Creating con icting service plans. An elderly usually su er from a combination of diseases and hence, a care-giver may ignore the suggestion from the system and potentially create con icting service plans for the same care-receiver. For example, in a service plan a care-receiver is asked to take his blood pressure at 8:00 AM while in another service plan he is asked to take a walk at the same time. Missing Service Plan: Forgetting to create a service plan for a care-receiver. Too Little Information: The face-to-face communication will be decreased, so care-giver's knowledge about care-receivers' situation will be limited. { Care-receivers:
Cheating with the System: Lying to the system whenever a con rmation is needed, for example, a care-receiver may lie about taking the medicine. Increased Loneliness: Feeling lonely is a common issue among elderly people.
This could get worse by using a TCH system. { IT Specialists:
Inappropriate Treatment Patterns: Translating the medical protocols to treatment patterns incorrectly or providing incomplete patterns. The possibility of occurring this risk is very low, because this a one-time activity (with minor changes per year) and the incompleteness or incorrectness of the patterns can be detected easily during a testing phase. { Third-party Service Providers:
Service Failures: Services provided by the third-party service providers may not function or function improperly. These services such as the blood pressure measurement service are outside the control of TCH system. { Infrastructure Providers:
Data/Power Network Failures: The data/power network may go down. { Hackers:
Malicious Action: The care-receiver data or con gured service plans may be altered/stolen. In fact, we do not consider hackers as new source of risk, since thieves can do the similar damage in the existing situation. 5
Context-awareness is becoming an important aspect of any information system. We all can imagine what new features such a system can have: selection of tting services and adapting system behavior and providing services tailored to users' needs and preferences. However, such a context-aware system can raise new risks because of unpredictable behavior. To the best of our knowledge, there is a limited amount of research and information regarding what new risks and challenges such a system can pose to its users. In this paper, we assume that the context-aware system can perceive and process context information accurately and in-time. In other words, we are only interested in undesired outcomes arising from the interaction of the user/services with a context-aware system.
In order to discuss the risks of TC systems, we need to clarify our
understanding of context and context-awareness. In the literature, there are a number
of de nitions for context, however it is still di cult to say what information is
context information and what is not. In this paper, we do not provide a new
de nition of context-awareness, but analyse context-aware systems and identify
their potential risks. We consider context as any information that can be used
to adapt the response of a system and add value to provided services for target
users. A context-aware system mainly performs context-triggered actions in the
form of 'If-then' rules to specify how the system should be adapted [
Since we are interested only in risks arising from the interaction with the tailorable context-aware system, to be able to generalize the identi ed risks, rst we should identify the main type of stakeholders who interact with the system. We also discuss why they are the source of risks. Generalizing from our case study, four types of stakeholders interact with the tailorable context-aware systems: Developer (IT specialists in the case study): Designs and implements the system.
Because of lack of domain knowledge, the developer can be the source of risks. However, since a developer's action is not a frequent one, the impact of such a risk is relatively low. Once the risk is identi ed, it can be xed and the probability of occurring the same risk again remains low.
Con gurator (Care-givers in the case study): Has enough domain knowledge and con gures the system parameters and creates new services to satisfy individual needs. Because of lack of IT knowledge, the con gurator can be the source of risks. Since he uses the system frequently, the possibility of same risks occurring repetitively is high.
End-user (Care-receivers in the case study): Is a target user and bene ts from the output of the system. Because of the lack of knowledge or interest about the system, the end-user can be the source of risks. Even though an end-user has higher rate of interaction with the system, since he usually performs the same type of actions (such as con rmation of receiving a message/service), possibility of same risks occurring repetitively is relatively low.
Third-party Service Provider (Third-party providers in the case study): Provides third-party services (services outside of the control of the system). Because of the lack of amenability, the third-party service provider can be a source of risks. Since his services have a higher rate of interaction with the system, the possibility of same risks occurring repetitively is relatively high. Based on the fact that the con gurator and third-party service provider are the main sources of risks, we limit the types of risks which are caused by them. Looking at the list of risks we identi ed for the homecare domain, in the following we generalize risks which can occur in any tailorable context-aware systems. Wrong Con guration Values: This type of risks occurs due to the tailorability of the system. It is important to consider what can be tailored and what not. This risk happens when a user puts a con guration value which is not in the context model. For example, suppose that the location of a carereceiver is modeled as only inside home and outside home. A care-giver may insert a value at park as the location value. This type of risks can easily be prevented by limiting the possible con guration values, e.g., by checking the value against the model, decreasing the likelihood of this type of risk. Con ict in a Task with Multiple Context Information: This type of risks occurs due to bad reasoning of the system regarding a task with multiple context information. The system should decide what to do based on context information, however there will be a con ict if there are two di erent actions for di erent context information. For example, a reminder should be sent to a care-receiver mobile phone when he is outside home and based on another reasoning he should not receive any reminder message on his phone when he is with somebody. So if he is outside home and is accompanied by somebody, there will be a con ict on sending the reminder message. Since this con ict occurs in one task (for example sending a reminder), a context-aware system can be designed in a way to detect such a con icts and inform user in advance. This type of risks can be prevented by prioritizing the rules. Con ict of Di erent Tasks: This type of risks occur because of performing different tasks which are in con ict. For example, one task is to attach a blood pressure measurement tool and the other task is to take a walk outside. Since this risk occurs in di erent tasks, it is di cult to detect and prevent it. Third-parties Service Failure: Service Oriented Architecture (SOA) is becoming popular for designing IT-based systems. A SOA-based context-aware system may utilize services o ered by di erent providers. There are usually Service Level Agreements (SLAs) among the partners to assure the availability of the services. However, in some domains like homecare, which is a safety critical domain, relying on the SLAs may not fully compensate the risks that occur.
The accountability aspects are mainly concerned with identifying the source of the risks and ultimately making that source responsible. Unlike in existing de nitions, we treated the accountability as a means of identifying the source of risks (identifying where and how it can be xed). This treatment is realistic because in the homecare domain, regardless of who is making a mistake, the care center is accountable for any risks that arise to its customers.
The risks due to wrong con guration values may lead to unavailability of desired services because the wrong con guration values may cause the system to behave di erently. This kind of risk can also be classi ed as the accountability aspects, because the source of the risk can be traced back.
The risks due to con ict of di erent tasks and the con ict in a task with multiple context information may lead to providing undesired services, which can be considered as unavailability of the desired services. It might be di cult to exactly identify the source of risk and hence the accountability, because risk occurs when a newly created task con icts with the existing one which might have been con gured by a di erent con gurator.
The risk due to third-parties service failure will lead to unavailability of desired services. The source of the risk can be identi ed only in terms of service providers, and accountability aspect should be considered in SLAs. 5.2
We have performed a rst assessment of risks of TC systems in general, and of homecare systems in particular. This has led to a classi cation of availability and accountability risks. This is new regarding the current risk assessment literature of context-aware systems, which is mainly about security and privacy risks.
There are some limitations to this study. We have done only one case study and even in this study, we may not have found all available risks. We have interviewed the care-givers about the tasks they perform, and then identi ed the list of possible risks while they perform their tasks. However, there is a possibility that the interviewees have forgotten important tasks and accordingly important risks. Based on their explanation, we have listed possible risks and there is a possibility that those risks are not real risks. In other cases, other risks may exist too, that are not present in our investigated case. Despite these limitations, we can still claim that we have found a list of possible risks. We intend to do more case studies in the near future to identify the importance of the risks as well as the completeness and correctness of the list of identi ed risks.
Another aspect of future work is to further con rm and elaborate the risks that we found for homecare systems. In addition, we would like to extend this assessment towards requirements engineering, by incorporating the risk assessment as a rst step in a requirements engineering process for homecare systems.