Security and Privacy in the Underserved Majority World: Practices, Challenges, and Opportunities
Collins Munyendo presents studies from Kenya and across the majority world showing how economic pressure, shared computing resources, social dynamics, and language barriers challenge Western-centric security and privacy designs, and proposes privacy-by-design redesigns and privacy-enhancing technologies for data sharing developed with local communities.
Security and privacy research has increasingly recognized that human factors shape how protections work in practice, yet most of that work has been done with participants in the US, Canada, and Western Europe. Security and privacy perceptions and practices vary across countries and cultures, so designs that assume Western conditions can break down for users across the “majority world,” which accounts for most of the world’s population. Collins Munyendo draws on several years of studies in Kenya and beyond to show where these assumptions fail and what can be done about it.
Mobile Loan Applications and Privacy Trade-offs
Mobile loan apps have spread quickly in Kenya because many people lack a formal credit history. An app asks for access to phone data, computes creditworthiness, and can disburse a loan within minutes, a model made possible by mobile money services such as M-Pesa. Reports of aggressive repayment tactics, including public shaming, motivated a study that reviewed eight common apps. Every one requested access to contacts, SMS, location, and storage, and their privacy policies did not clearly explain how that data was used.
Participants were concerned about these permissions, particularly contact access. When borrowers defaulted, lenders reportedly contacted relatives and acquaintances, in one case going after a participant’s father-in-law to create embarrassment. Yet participants set privacy aside when they needed money, summed up by the observation that “desperate times really call for desperate measures.” The study concludes that transparency and user control alone will not protect people whose financial constraints make them willing to trade away privacy. Platforms and regulators have a role to play, and Google’s decision to block loan apps from accessing contacts is presented as a promising first step.
Shared Cybercafés and Authentication Practices
Cybercafés in Kenya have become essential because governments digitized services that require online applications and printed forms, while personal computer ownership remains low. Interviews with managers and customers revealed that shared machines create serious authentication and privacy problems.
Many customers struggle with basic computing. Account creation can fail when people do not know how to produce uppercase characters or meet password rules, and account recovery breaks down when customers cannot remember which email address or phone number they registered. Managers frequently choose passwords for customers, often selecting national ID numbers because they are memorable. Those numbers are already widely recorded at buildings and mobile money agents, which makes them poor secrets. Some customers and managers also saved passwords on public machines, and some managers reused a single password across many customers so they could recite it when asked. These practices expose a mismatch: password manager advice assumes personal devices that cybercafé users do not have.
Local Experts and Advice in the Majority World
The study then asks whether these problems are unique to Kenya. Local experts such as cybercafé managers, device and SIM sellers, and phone repair technicians often give security and privacy advice to their communities, sometimes with no formal computing training. A study of 70 experts across nine countries, including Mexico, Brazil, Ghana, Nigeria, Kenya, Turkey, China, India, and Pakistan, found that the advice largely matches Western guidance, though some of it is outdated. Recommendations such as using antivirus software and avoiding public Wi-Fi are less useful now that HTTPS is ubiquitous, and frequent password changes are burdensome.
Experts customize their guidance to local constraints. They may use complex passwords themselves but recommend memorable ones to clients, reasoning that a forgotten complex password makes the advice look bad. Barriers to following advice are social and economic. Updates require paying for data, so people skip them. Family members may read strong passwords on a device as a sign of hiding something. And English-language alerts are often dismissed because users cannot understand them. These findings point to the need to identify which advice matters most, to design with diverse social contexts in mind, and to improve translation of both interfaces and guidance. The study also involved local academic partners, some of whom had to be trained in research methods, and sought to make them co-authors so that benefits stay in the communities studied.
Privacy by Design in Mobile Money
Mobile money is a financial system tied to SIM cards and phone numbers, so a transaction can be made with basic phones over cell towers. Agents act as intermediaries for deposits and withdrawals. In the traditional process, a customer hands over an ID to the agent, who records the transaction details, including the customer’s name and phone number. These practices create real risks: a stolen ID can be used to register a SIM card, and agents have called customers after transactions.
The redesigned model has the customer authenticate directly with the provider, using a fingerprint or voice verification where a smartphone is unavailable. Both the customer and the agent receive the same one-time code, and the customer shows it to the agent to confirm identity. The agent never sees the customer’s name, phone number, or ID. Prototypes tested in Kenya through paper-based wizard-of-Oz sessions showed that users and agents preferred the new process. Users valued reduced exposure of personal information, the sense that biometrics made it more secure, and the convenience of not carrying an ID. Concerns included fingerprint reliability for workers such as construction laborers and agents’ doubts that users could complete self-authentication. The takeaway is that privacy-preserving protocols need piloting with local communities, since designing in the US and shipping to Kenya will not work. Mobile money scams are being studied as a related problem.
Privacy-Enhancing Technologies and Data Sharing
The future direction is to use privacy-enhancing technologies to enable data sharing in the majority world. Governments and national statistical offices hold valuable data, including mobile money records, health data, and census data, yet privacy concerns and institutional barriers often prevent it from being used. Even ministries sometimes cannot share data with one another. The planned work begins by identifying what governments actually need, then adapts or redesigns existing privacy-enhancing technologies to meet those needs, with the goal of producing a privacy playbook covering deployment challenges and design considerations in the majority world.
Across the studies, the recurring theme is that security and privacy solutions must account for economic constraints, social dynamics, language, and local expertise, and must be developed in partnership with the communities they are meant to serve.