Tech Regulation Requires Balancing Security, Privacy, and Usability

In an era where technology is rapidly evolving, governments worldwide are faced with the daunting task of regulating complex systems, particularly in the financial services sector. The challenge lies not only in ensuring security but also in maintaining user privacy and usability. As policymakers navigate this intricate landscape, they must adopt a holistic approach akin to that of a product designer, balancing these critical elements to foster a secure and user-friendly environment.

The Case of M-PESA: A Cautionary Tale

Kenya’s M-PESA, launched in 2007, serves as a compelling case study in the intersection of technology regulation and user experience. This mobile money service revolutionized peer-to-peer transactions, amassing over fifteen million users within five years and facilitating nearly one billion dollars in deposits. However, as the service gained popularity, so did concerns over security. In response, the Kenyan government mandated that all citizens register their SIM cards using government-issued identification. This swift enforcement led to the freezing of millions of SIM cards, highlighting the potential pitfalls of regulatory measures that do not consider user realities.

The aftermath of this regulation revealed a troubling trend: the rise of third-party SIM registration, where individuals used someone else’s ID to register their SIM cards. Research from Carnegie Mellon University uncovered that many users faced systemic barriers in obtaining government IDs and harbored privacy concerns about sharing their personal information with mobile money agents. This workaround not only undermined the intended security measures but also introduced new vulnerabilities, complicating law enforcement efforts and leading to cases of wrongful arrests.

Unintended Consequences of Well-Intentioned Policies

The Kenyan experience is not an isolated incident. Across the globe, various regulatory initiatives have demonstrated how well-meaning policies can yield unintended consequences when usability, privacy, and security are not adequately balanced.

Uganda’s Biometric Digital Identity Program

In Uganda, a biometric digital identity program aimed at enhancing security has inadvertently excluded millions from accessing essential public services. The lack of access to a national digital identity card has marginalized vulnerable populations, highlighting the need for regulations that consider the diverse realities of citizens.

The European Union’s GDPR

The General Data Protection Regulation (GDPR) in the European Union has set a global benchmark for data protection. However, its implementation has led to unforeseen challenges, such as websites blocking EU users and usability issues that hinder the very privacy protections it aims to enforce. Users often find themselves waiving their privacy rights for the sake of convenience, undermining the regulation’s intent.

The U.S. Health Privacy Law (HIPAA)

In the United States, the Health Insurance Portability and Accountability Act (HIPAA) was designed to safeguard medical information. Yet, its cumbersome requirements, such as the continued reliance on ink signatures and fax machines, have created usability challenges for both patients and healthcare providers. This has resulted in inefficiencies that compromise the very privacy protections the law seeks to uphold.

Jamaica’s Digital ID Challenges

Jamaica’s attempts to implement a national digital ID system have also faced significant hurdles due to privacy and security concerns. The country has incurred substantial losses from fraud, underscoring the importance of addressing privacy issues before rolling out such initiatives.

The Need for a Product Design Mindset in Policy Making

To avoid the pitfalls observed in these case studies, policymakers must adopt a product design mindset. This approach emphasizes understanding user needs and experiences, ensuring that regulations are not only effective but also user-friendly.

Embracing User Studies

Policymakers should prioritize user studies to gain insights into how citizens interact with government programs. By conducting qualitative and quantitative research, they can identify behavioral drivers and systemic barriers that may hinder access. Engaging marginalized communities in focus groups can further illuminate the potential unintended consequences of tech policies.

Pilot Testing and Iterative Processes

Just as product designers conduct beta testing, policymakers can benefit from pilot programs that allow for early-stage feedback. This iterative process enables regulators to solicit input, implement changes, and refine policies based on real-world experiences, fostering continuous improvement.

Tabletop Exercises for Crisis Scenarios

Regular tabletop exercises can help policymakers anticipate how new regulations might perform in times of crisis. By simulating scenarios related to cybersecurity vulnerabilities or user responses, decision-makers can better understand the potential impacts of their policies before implementation.

Conclusion: Striving for Balance

The experiences from Kenya, Uganda, the EU, the U.S., and Jamaica collectively underscore the importance of balancing security, privacy, and usability in tech regulation. When policymakers fail to consider these elements in tandem, they risk undermining the very goals they seek to achieve, leading to erosion of public trust, increased costs, and missed opportunities for innovation.

By adopting a product design mindset, governments can create regulations that not only protect citizens but also empower them. In doing so, they can pave the way for a more secure, private, and user-friendly digital landscape that benefits everyone.

Authors:

• Karen Sowon: User experience researcher and postdoctoral research associate at Carnegie Mellon University.
• JP Schnapper-Casteras: Nonresident senior fellow at the Atlantic Council’s GeoEconomics Center and founder of Schnapper-Casteras, PLLC.
• Giulia Fanti: Nonresident senior fellow at the Atlantic Council’s GeoEconomics Center and assistant professor of electrical and computer engineering at Carnegie Mellon University.