Definitely Doug 5/7/21: Over the Top

Over the Top

Not too many sectors of hospitality technology are as much in flux as guest room entertainment. Conventional wisdom of just a few years ago is rapidly changing and will likely continue to do so. Many experts in the space hold zealous but contradictory opinions on which approaches to Over-the-Top (OTT, or streaming) content will dominate in years to come. Many of them will be wrong; a few of them might be right.

For hotels, this means risk. Many hotels need solutions now, but any decisions they make today will likely turn out to be partially or significantly wrong within just a few years. In the current environment, a reasonable payback period for an in-room entertainment (IRE) investment is perhaps as short as two years. My own crystal ball is very hazy; there are forces driving the streaming industry in different directions and no one really knows which ones will prevail. Studios, distributors, streaming networks, consumer and hospitality TV providers, mobile device manufacturers and consumers all have their own agendas, and many of these are mutually incompatible.

OTT content matters. A recent Hub Entertainment study commissioned by HTNG surveyed 1,200 U.S. consumers last fall and found that 18% watched only traditional (linear) content, 18% watched only OTT (streaming) content, and 64% watched both. Another study by Enseo comparing their own hotel installations from summer 2019 to summer 2020 showed a 49% increase in hours watched per hotel room night, but that whereas traditional TV was up 19% to 35% (depending on market segment), streaming was up 68% to 84%. Other IRE providers spoke of similar changes. Hotels that ignore this shift toward OTT do so at their peril.

OTT has been welcomed by many hotels because unlike traditional sources of entertainment, the content is generally cost-free to them as guests bring their own subscriptions from home. Many hotels, especially in some parts of the world, have dropped expensive interactive TV services and all or most premium channels, and now offer only a few linear channels and streaming. However, there is serious debate as to whether the current streaming economic model is sustainable for content providers. It would not surprise me to see streaming content providers find a way to charge hotels in the future, so this is a risk to bear in mind when signing contracts with IRE providers.

Today’s column will try to frame some of the issues around OTT content so that hotels can ask the right questions. As usual, I will not recommend any specific solution, both because there is no ‘one size fits all’ product on the market, and because of the uncertainty around the future consumer and technology trends and business strategies of key players. To be sure, there are dozens of options available in different markets around the world, most of using approaches similar to those discussed here. However, for this article I spoke with some of smartest technology leaders in the hotel IRE field, including senior product executives from Enseo, Hotel Internet Services (BeyondTV), InnSpire, Nevaya, Nonius, and Sonifi. All generously shared sharing their thoughts, identifying the questions that they think you should ask, and why.

Casting vs. Embedded Apps

A few years ago, most experts thought that casting would become the dominant delivery method for OTT content, whether in homes, hotels, or elsewhere. Today many still think so, but others are less confident or even dismissive. For readers unfamiliar with casting, this technology enables streaming content that has been sent to your mobile device to be redirected to a television screen. Major streaming apps, such as Netflix, can redirect content from mobile phones or tablets to any cast-capable device on the same network, such as Apple TV or Google Chromecast; these in turn can play them on the TV screens to which they are attached.

All of the IRE providers mentioned here, and most others, support casting with Chromecast; a few do so with Apple TV or with both. Chromecast is the more popular device because of its substantially lower cost and ability (with some limitations) to work with both Android and iOS devices. Apple TV is common in places like China (where Chromecast does not work natively), and as an option in some high-end hotels.

At home, embedded apps are increasingly popular. Many consumer-grade smart TVs ship with common streaming apps such as Netflix, YouTube, and Amazon Prime Video embedded. They can connect directly to the streaming provider, managed either by the TV remote control or by the content provider’s mobile app (or both). This works well on a home network, where you can enter your Netflix account credentials once and then watch it just as easily as traditional, linear channels. Because the content moves directly from the provider to the smart TV, there is less opportunity for signal degradation. If the guest mobile device is involved at all, it is simply sending commands to the network such as to select content, play, pause, stop, or rewind. As a result, it is not dependent on a robust, stable, high-bandwidth connection.

While smart TVs may seem an appealing way to provide guests with embedded apps, they face issues in hotel environments, and there are important questions hotels should ask if they are considering them.

• While set-top boxes and mobile casting apps can easily be updated without any action by the hotel, not all smart TVs can. This means that it may be very difficult to update to the inevitable release of new and updated streaming apps or security patches. It may mean sending an engineer to each guest room.

• Not all streaming apps are available on all smart TVs, and even if available, they may not be licensed for use in hotels (or only certain integrators may be licensed).

• Licensing for some streaming services may require dedicated bandwidth guarantees, often 3MB per room assuming 100% simultaneous usage. That is far beyond what most hotels would normally provide (or need to), and can be very costly.

• Security experts say that it is relatively easy to hack many smart TVs (especially those that do not support over-the-air updates) and steal user credentials that have been entered (try Googling “hack smart TV Netflix password” if you are curious).

• There may be no simple way to disable logged-in streaming accounts when a guest checks out, which is a licensing requirement of many streaming services.

Embedded apps are also baked into the latest version of Chromecast released last fall (Chromecast with Google TV) and into the set-top boxes of many hotel IRE providers. At least two of the IRE providers I spoke with believe there is either significant risk, or near-certainty, that casting will be replaced by embedded apps, whether on the TV, the Chromecast device, or a set-top box. This seems to be the direction that Google, TV manufacturers, and some major streaming providers are headed for the consumer market; if that continues, hotels may eventually have to adapt. “Eventually” could come quite soon, but others believe that Google will continue to support legacy Chromecast, or another solution that supports hotels’ needs, for the foreseeable future. Embedded apps will likely continue to be available on IRE providers’ set-top boxes, but if casting disappears, costs could easily increase.

Cost is one reason for the dominance of Chromecast in the solutions available to hotels. Basic Chromecast devices sell for as little as $30 at retail, and a typical fully loaded cost for a simple Chromecast-based solution is in the range of $50 to $100 per room (not counting any network upgrades that might be needed). Embedded solutions using set-top boxes typically cost two to three times more. I am not yet aware of any embedded hotel solutions using Chromecast with Google TV but should they emerge, I would expect them to be somewhere in between.

Do guests prefer casting or embedded apps? The evidence is unclear. Research is clouded by fuzzy definitions of casting and streaming, and provider-specific data can be biased by placement of preferred options and the ease of invoking them. Further, behind-the-scenes technical changes in some apps can lead to situations where guests think they are casting but they are actually using an embedded app. The research I have seen suggests that while people may not like having to enter the login credentials required for embedded apps, they know how to do it, whereas many people (particularly older consumers) have no idea how to cast. That is changing over time to be sure, but casting still does not meet most people’s “could my grandmother use it?” test.

Vendors who support both casting and embedded streaming solutions report diametrically opposed results. Enseo says that in installations where they offer both, 42 times as many guests enter their password to use the embedded app rather than using password-free casting. InnSpire, on the other hand, says that in its U.S. installations where they offer both, 35% more guests use casting than embedded apps. Factors such as interface design (potentially influenced by financial incentives) may well skew these numbers from provider to provider. InnSpire also noted that the challenge of entering a password via a remote caused 43% of guests who navigate to the Netflix, Hulu, or Amazon Prime app to never actually log in. But it is hard to know how much of this relates to the difficulty of password entry vs. not having a subscription and simply thinking that the hotel might be providing complimentary access.

Hotel Deployment Challenges

There are many challenges with deploying any consumer-grade product (such as smart TVs, Chromecast, or Apple TV) in hotels, which is why most hotels use IRE providers. It would be possible to write a book about all the challenges and solutions, but I will focus on a few key ones here.

With casting, the first major challenge is network isolation. Consumer devices are all designed to work on a home network, which typically belongs to a single home and uses a single network ID. In the home, mobile devices, TVs, Chromecast devices, Apple TVs, and other streaming devices are connected to the network when first deployed, and remain connected indefinitely. The user’s mobile phone will discover only those devices in their home (i.e. on the same network), and not in their neighbor’s. In hotels, however, guests typically share a single network. In order to avoid guests hijacking the TV from a nearby room, there needs to be a way to ensure that guests can only connect to TVs in their own room.  There are two primary approaches to doing this today (and variations of each). A third one uses Hotspot 2.0 (see this blog from 2019), but is still not yet feasible on the infrastructure available in most hotels.

Most commonly today, network isolation is achieved by running two internal networks, one (visible) for guests, and one (hidden) for casting devices, and using a casting controller or proxy server to securely route traffic from guest mobile devices to the paired TV. This can also be done through a cloud-controlled software-defined network with a local router to achieve a similar end result. Another approach, which Enseo first plans to deploy this summer and several other vendors are evaluating, is a personal area network, which effectively creates an isolated virtual network for each guest room (which can help manage not only TVs but other devices). In either case, not only must the network manage secure connections between the guest mobile device and the Chromecast or Apple TV, but it must also ensure that only streaming traffic, and not configuration commands, can be sent to the device. This prevents a malicious guest from hijacking and reprogramming the device.

The second major challenge for casting is the secure pairing of mobile devices with casting devices, or in other words ensuring that a guest can only pair with the device in their own room. Personal area networks and Hotspot 2.0 can both make this simple and automatic. But since they are not common yet (and may not be for some number of years), other approaches are required, often a combination of options that depending on factors such as whether the casting device is provided by the same company providing the network infrastructure, whether the infrastructure provider offers an API, and whether the guest has the hotel app on their mobile device.

What the different approaches have in common is the need to identify the device, to have a way to determine with certainty which room the device’s owner is staying in, and to know when they have checked out. In some cases, the infrastructure already knows the device and guest room (for example if the guest has connected to Wi-Fi with name and room number or checked in using the brand mobile app). In other cases, the pairing can be initiated by having the guest scan a unique QR code from the TV screen or navigate to a website and enter a code displayed on the screen, essentially proving that the device is in a specific guest room. Multifactor authentication of some sort is essential, and the providers I spoke with supported one or more ways to achieve this, but every environment is different, and hotels should consider carefully which combinations of factors will work best for different guest situations.

Making this process as seamless as possible for as many guests as possible is key. Equally important is making it secure, which means alphanumeric codes displayed on the TV screen should be sufficiently long and/or complex, and QR codes displayed there should be unique and use cryptographic keys. Many of the pairing approaches require knowledge of the guest room assignment from the hotel’s property management system, which means they may need both an interface and a backup approach when the system is offline. Apple’s recent move to MAC address randomization complicates the matter further, requiring a refresh (manual or automated) of the mobile device ID every 24 hours.

With embedded apps, the biggest challenges are password entry and security. With the notable exception of YouTube, most embedded streaming apps require the guest to enter their login credentials; with casting, this is handled on the guest’s mobile device. Passwords are typically entered using the remote control, usually by selecting characters one at a time from an on-screen display. None of the IRE providers I spoke to wants to risk storing passwords, but with embedded apps this can be necessary if a guest wants to resume a streaming session later in their stay. Hotels face regulatory risks when they store any such sensitive data, and additionally, content providers may not authorize content unless the security is sufficiently strong. Some of the major streaming providers do support a form of tokenization to avoid the need to store the password locally, but it can be complex and costly to for IRE providers implement, especially with multiple content providers.

Between the awkwardness of entering a password via a remote control and the security concerns, most IRE providers I spoke with preferred casting to embedded apps, since it does not require password entry at all, and thus avoids the necessary security protocols and risks. At the same time, content providers are moving towards direct connections with embedded apps, which mean passwords will never have to leave the guest’s mobile device in the first place; the mobile app will securely negotiate a connection with the embedded app. But for the time being, most embedded apps require passwords, meaning that hotels that use them should be concerned about how they are handled and secured.

• Monitoring services are essential with any solution, but particularly with Chromecast devices. For set-top box solutions, the IRE provider will typically provide monitoring, but with Chromecast the more common approach is to provides software for the hotel to do it. The software should notify engineering (or other hotel staff) by email, SMS, or through a work-order management system interface, whenever a device appears to be missing, powered off, or to have a poor Wi-Fi signal. Dashboards are useful but are unlikely to be checked often enough to catch problems before the next guest checks in.

• OTT requires sufficient bandwidth. Fortunately, most of the streaming apps today can adapt to a wide range of available bandwidth, with the minimum requirement generally around 1mbps, and recommendations usually in the range of 2mbps to 5mbps depending on the TV screen size and resolution. Lower bandwidth will result in a poorer picture, but within this range the difference will not be very noticeable to most guests. And because guests already use guest Wi-Fi to stream OTT services on their mobile devices at hotels that do not offer streaming options on the TV, the bandwidth increase from adding them is typically small, in the range of 10% to 20%.

• If streaming and linear TV use different input connections on the TV (as is common), the switching should be either automatic or intuitive. Providers may claim automatic switching, but this depends on the TV supporting the right protocols, which will not be the case with all TVs, so it is important to check. If automatic switching is not supported, buttons on the remote control should be clearly and intuitively labeled, such as “Cast” or “TV.” Expecting a guest to push the ‘input’ button on a standard remote and guess which connection does what, is not a good solution.

• Screen mirroring (where the mobile device screen is replicated on the TV) is inefficient and, fortunately, no longer commonly needed with streaming services. It can, however, be useful for certain applications, like displaying a presentation, a Safari window, or a Zoom session. Most midrange and higher Android devices can do this easily with Chromecast, but iOS devices can only do this with a third-party app that most guests will not have. If iOS mirroring is important, then an Apple TV solution is the only practical answer for a hotel.

• Suites can add complexity. The systems are designed know which devices are in each suite and to allow the guest to select the one they want to pair. But this should be carefully tested if the hotel has lock-off or other suites that can be configured and sold either as one or separately. Ideally the system should know how they are configured for the current guest and treat them as a single room; then any available devices in any room can be selected for pairing.

• Multi-zone audio systems may also be a consideration in higher end suites. The casting technologies support audio as well as video, but provider implementations will vary.

• Chromecast devices are typically attached to an HDMI port on the TV and without modification, can easily be removed if the HDMI port is accessible. Theft of Chromecast dongles is not common, but could be an issue in certain hotels. Various security solutions are supported by the providers; however, in most cases given the low cost of Chromecast devices it will be cheaper to simply stock a few extras.

• The systems involved require regular updates for both changing features and to address security vulnerabilities. Cloud-based systems such as Nevaya can perform most of these centrally. Other providers can generally push updates to connected devices. It is however important to make sure that you understand exactly how every device is updated: some vendors may, for example, require the hotel to perform firmware updates on one or more network appliances and/or TVs.

OTT content is unfortunately both important and complex, and will likely remain so for some time, with the specifics continuing to change frequently. The information here is intended to help you ask the right questions, but as you can see there are a lot of pitfalls. My best advice, beyond following the guidance here and asking a lot of questions, is to make sure that your provider acknowledges every aspect of your installation: TV make/model, infrastructure provider, integrations required (e.g. mobile app, captive portal); and that you have clear documentation of the guest journey for every guest and the things they are likely to want to do; that you have confirmation from any other providers that the necessary integrations to their software are available for the right version, that they have been tested and are deployable and supportable; and finally that you have agreements with all parties warranting the end result you need.

‍