As more and more governments undergo digital transformation, more and more citizens are now required to share private data through digital platforms in order to access public services. That means data security is a non-negotiable global issue. But human-centered security and privacy researchers tend to draw their subjects solely from the world’s wealthiest minority—from populations sometimes referred to as Western, Educated, Industrialized, Rich and Democratic, or WEIRD. The architects who build privacy and security tools draw from this pool of research, meaning the majority of technology users are not considered when designing the tools intended to keep their data safe.
Collins Munyendo knows this firsthand. As a security consultant for a company in Nairobi, he saw the disconnect between user behavior and recommended security practices—like security managers who scrawled their passwords on sticky notes rather than utilizing the “more secure” password managers.
“It got me wondering why they were behaving this way, and how we could design security tools in such a way that people would actually use them,” Munyendo said.
Now a fifth-year Ph.D. student at the George Washington University School of Engineering and Applied Science (GW Engineering), Munyendo’s work on human-centered security and privacy has made him one of just two students in North America (and the first-ever GW student) to receive the 2024 Google Ph.D. Fellowship in security, privacy and abuse prevention. Awarded by the tech colossus to doctoral candidates in computer science and related fields whose work promises to shape the future of research in their fields, the fellowship includes full payment of tuition and fees for up to two years, a monetary stipend and partnership with a research mentor from Google.
For his fellowship project, Munyendo is qualitatively investigating computer security and privacy concerns and advice-giving practices in 10 countries: Kenya, Ghana, Nigeria, China, India, Pakistan, Brazil, Mexico, Iran and Turkey. The study is supported by additional funding from the Stanford Internet Observatory and the National Science Foundation.
Munyendo’s study and his published work on the cultural contexts of tech usage address “a significant blind spot” in existing research, said his adviser Adam Aviv, associate professor of computer science.
Assumptions and guidance from Western researchers and developers—such as the expectation that everyone owns a personal computer or that sensitive accounts should never be accessed on shared devices—often break down in international contexts. In some cultures, being online primarily means using a mobile device, with personal computers being uncommon. In others, societal norms may require women to share their devices with other household members, making it understandable why some might turn to unofficial, non-secured software to lock apps or hide app usage. When faced with the choice between maintaining digital privacy and ensuring physical safety, adhering to "best practices" for digital security may seem unimportant.
Discrepancies between expected and actual security practice occur “not because people have a lack of intelligence or a lack of ability or a lack of understanding of the internet,” Aviv said. “It's just that these are scenarios that aren't often addressed in the research.” So Munyendo’s work has already “made a big impact on the field,” he said.
Munyendo’s fellowship project also explores the impact of advice from local experts, who may not have a technical or academic background but are closer to the needs and expectations of their client base than are Western experts. In Kenya, for instance, where phone internet usage is high but personal computer ownership remains relatively low, local cybercafés are a necessity for unwieldy tasks like submitting job applications and filling government forms. Café owners, accordingly, assume the role of tech gurus. Munyendo’s work establishing who populations seek advice from, and what advice they’re receiving, gives researchers insight into their real behavior.
Aviv, who first worked with Munyendo as part of his NSF CAREER Award on mobile device authentication, said his student’s drive, insight, creativity and persistence made it “far from surprising that he won this award,” despite steep competition.
“Collins is an extremely strong, independent worker who has put in the legwork to find the right resources and the right collaborators to execute a compelling and viable project, and that’s not easy to do,” Aviv said. “This is an extremely competitive fellowship; it’s a truly international competition with thousands of applicants. The fact that he is one of just six winners in his category says a lot.”
Munyendo, on the other hand, was “extremely surprised.”
“I put so much work into preparing my application, but I didn’t expect to win,” he said.
