Beyond the Mainstream World: Security and Privacy Struggles in Overlooked Regions

When Security Research Only Covers a Few

Over the past decade, human-centered security and privacy research has made considerable progress, but it has been almost entirely concentrated on Western populations. According to a study published at USENIX Security, the overwhelming majority of participants in relevant experiments come from the United States and Canada, followed by Western Europe. The consequence of this sampling bias is that security solutions designed and evaluated in the West often quickly fail once applied to the "Majority World" regions such as Kenya, Pakistan, and Nigeria.

Collins Minando, a PhD from George Washington University who will soon join the National University of Singapore, has been researching this problem for the past six years. In an academic talk, he shared a series of studies from Kenya and eight other Majority World countries, revealing how socioeconomic constraints, shared computing facilities, and cultural norms reshape people's security and privacy practices.

Kenya Case 1: When Borrowing Money Is More Urgent Than Privacy

Mobile loan apps are extremely widespread in Kenya. Because a large portion of the population lacks formal credit records, these apps obtain contacts, SMS, location, and other data from phones to complete credit assessment and disburse loans within minutes. The research team reviewed eight common apps and found that all of them, without exception, request access to contacts, SMS, location, and storage permissions, yet none transparently explain the purpose of data use in their privacy policies.

User research revealed a more complex reality: many people know these apps will misuse contact information—once a payment is overdue, debt collectors call the user's family and friends to apply pressure—but they still choose to use them. One interviewee said: "When you desperately need money, you don't care about privacy at all." Another said: "Desperate times call for desperate measures."

The policy implication Minando draws from this is rather counterintuitive: Western research often advocates "giving users more control and transparency," but in this scenario, the empowerment logic does not hold. When users actively give up privacy due to economic pressure, real protection must come from platforms and regulators. Notably, after the research was published, Google began prohibiting such apps from accessing user contacts.

Mobile Money is a system that provides basic financial services through mobile phone numbers, with Kenya's M-Pesa as a typical example. Users do not need a traditional bank account; they can deposit cash at agent outlets in exchange for electronic money and complete transfers, payments, and withdrawals via SMS or USSD menus. Because a large portion of the population in sub-Saharan Africa lacks formal bank accounts and credit records, mobile money has become a de facto infrastructure for financial inclusion. Transactions typically occur at agent outlets: users present identity documents to agents for real-name verification, and agents confirm transaction amounts and user information via SMS. While convenient, this process exposes users' identity information and phone numbers to agents, planting hidden risks for subsequent harassment or fraudulent registration. Understanding the agent network structure of mobile money is a prerequisite for understanding the privacy redesign scheme discussed later.

Kenya Case 2: The Shared Authentication Dilemma in Internet Cafés

The digitalization of Kenyan government services combined with low personal computer ownership has created a compounding effect, making internet cafés a necessary venue for many people to access the internet and complete government processes. But shared computing facilities pose systemic challenges to authentication security.

The research team conducted semi-structured interviews with internet café managers and customers, identifying several recurring problems:

• Account creation barriers: Many customers have never used a computer and even struggle to hold down the Shift key to type uppercase letters, while website password complexity requirements pose substantial obstacles for them.
• Account recovery failures: Some customers cannot even remember which email or phone number they used during registration, yet mainstream account recovery mechanisms assume users remember this information.
• Passwords set by managers on behalf of customers: Internet café managers often choose passwords for customers, and to remember them themselves, tend to recommend locally memorable information such as ID numbers—which are frequently presented and recorded in everyday scenarios in Kenya.
• Password reuse across users: In more extreme cases, managers use the same password for multiple customers so they can respond to customers' phone inquiries at any time.

These findings point to a neglected role: internet café managers are in fact "local experts" in the Majority World. Although they have no security training background, they bear a significant amount of digital security consulting functions. This also means that Western-recommended password manager solutions are nearly impossible to implement in such scenarios—they assume users can install the same tool on all devices.

Cross-Nine-Country Validation: Local Experts' Advice and Barriers

To test whether the above problems are specific to Kenya, the research team expanded to nine countries: Mexico, Brazil, Ghana, Nigeria, Kenya, Turkey, China, India, and Pakistan. Together these nine countries account for about half of the global population. The study recruited 70 local experts, including internet café managers, phone and SIM card sellers, and phone repair personnel.

In terms of methodology, the team deliberately collaborated with local researchers and involved them as co-authors, avoiding the extractive research model of "fly to Pakistan, do the research, take the paper, and leave."

The research found some common characteristics in local experts' advice:

Outdated but still circulating advice. Recommendations such as installing antivirus software, changing passwords regularly, and avoiding public Wi-Fi are no longer recommended in the security community due to limited effectiveness or the widespread adoption of HTTPS, but they are still widely transmitted in these regions.

Localized adaptations based on constraints. Experts themselves use complex passwords but advise customers to use easy-to-remember passwords—because if a customer forgets their password, they will think the expert gave bad advice. This is a pragmatic adaptation to real-world conditions.

Three barriers to following advice. The first is economic cost: experts in Turkey pointed out that most people are unwilling to install updates because data costs money. The second is social friction: experts in Pakistan mentioned that if you put passwords on all devices, family and friends will suspect you are hiding something. The third is language barriers: system errors and prompts are mostly in English, and users' instinctive reaction when they cannot understand is to simply close them.

According to Minando, these cross-regional commonalities indicate that cultural factors—such as trust pressure in social relationships—substantially affect people's behavior in protecting device access, something almost entirely unconsidered in Western-context security design.

"Majority World" is a term that has gradually gained popularity in HCI and development research in recent years, replacing value-laden expressions such as "developing countries" and "third world." It refers to the regions that constitute the majority of the global population but are often marginalized in academic research samples, including many countries in Africa, South Asia, Southeast Asia, and Latin America. The term emphasizes that these regions are not a "minority" or "exception" but the majority of the world's population. The article cites this concept to point out that human-centered security research has long defaulted to Western samples, causing design assumptions to diverge from the reality of most people. Similar to "Global South," the term Majority World carries both geographic and political-economic connotations, reminding researchers to pay attention to how resource constraints, infrastructure differences, and cultural norms affect technology adoption.

Wizard of Oz-style user testing is a user research method commonly used when a system prototype is not yet fully implemented. In the experiment, participants believe they are interacting with an automated system, but researchers manually simulate the system's responses behind the scenes. This method is suitable for testing users' perception and acceptance of interaction flows that have not yet been built, providing feedback close to real use at low cost. In the mobile money redesign described in this article, the team used paper prototypes combined with the Wizard of Oz method to let users and agents experience the process of "replacing ID presentation with one-time verification codes," thereby assessing preference and accessibility issues before technical implementation. This method is particularly suitable for early design validation in resource-constrained environments.

Redesign: Embedding Privacy into Mobile Money

After revealing the problems, Minando's team attempted constructive solutions. They chose the highly representative mobile money scenario in Kenya.

There are two privacy leakage points in the existing process: users must present identity documents to agents for verification, and ID numbers can be used for fraudulent SIM card registration and other purposes; after a successful transaction, the confirmation SMS received by the agent contains the user's name and phone number, and there have been cases of agents calling users after transactions.

The team redesigned the process: users complete biometric or voiceprint authentication directly with the mobile money provider, without presenting documents to agents; after the transaction is completed, the user and agent each receive the same one-time verification code, and the user only needs to show this code to the agent to complete verification. The user's name and phone number are no longer transmitted to the agent.

Through paper prototypes and Wizard of Oz-style user testing, the team found that both users and agents preferred the new process, mainly for reasons including: less exposure of personal identity information, perceived security of biometric authentication, and the convenience of not needing to carry identity documents.

But the research also exposed new accessibility issues: some users' worn fingerprints make biometric authentication difficult, and elderly users and those with lower technical literacy face operational obstacles with the new process. Agents reported that many elderly users would simply hand over their phones and ask them to operate it. In addition, female respondents expressed stronger concerns about agents obtaining their phone numbers, because there have been cases of agents sending harassing messages after transactions.

Minando emphasized that such solutions must undergo local pilot testing rather than assuming transferability after being designed in the United States.

Future Directions: Unlocking Data Value with Privacy-Enhancing Technologies

Minando is currently collaborating with colleagues at UC Berkeley to explore deployment pathways for privacy-enhancing technologies (PETs) in the Majority World. This region generates large amounts of valuable data—mobile money transaction records, health data, regularly collected sensor data—and sharing this data could drive research and innovation, but privacy concerns make sharing difficult.

The project's approach is reverse: first collaborate with governments and NGOs in the Majority World to understand their actual needs and barriers regarding data sharing (including the reality that even government departments struggle to share data among themselves), then customize or redesign PETs accordingly, ultimately producing a privacy deployment handbook for the Majority World.

Some Observations

The value of this research lies not only in revealing differences but also in challenging the default assumptions of the human-centered security field: transparency empowerment, password managers, complex password policies, regular updates—the effectiveness of these recommendations depends heavily on specific socioeconomic conditions. When users face data costs, shared devices, and trust pressures in acquaintance societies, security advice needs to be redesigned, not simply translated.

Minando is recruiting fully funded PhD students at the National University of Singapore to continue this direction; contact information can be found in his talk slides.

One-line Summary

Human-centered security research has long defaulted to Western samples and fails in the Majority World; a nine-country study reveals that economic constraints and cultural norms require redesigned security solutions.

Paragraph Summary

The article introduces human-centered security and privacy research conducted by Collins Minando, a PhD from George Washington University, in the Majority World. Existing research samples are heavily skewed toward the US, Canada, and Western Europe, causing Western-designed security solutions to fail in Kenya, Pakistan, and elsewhere. In Kenyan mobile loan apps, economic pressure leads borrowers to actively give up privacy, the transparency-empowerment logic does not hold, and platform and regulatory intervention are more effective. Shared facilities in internet cafés give rise to practices such as managers setting passwords on behalf of customers and reusing passwords across users, making advice like password managers unworkable. A nine-country study finds that local experts provide outdated but localized advice, with barriers to implementation including data costs, social friction, and language barriers. The team also attempted a mobile money privacy redesign, replacing ID presentation with one-time verification codes; both users and agents preferred the new process, but local pilot testing is needed for validation.