When Goldman Sachs came under fire for offering women lower lines of credit than men on the now <a href="https://www.nytimes.com/2019/11/10/business/Apple-credit-card-investigation.html" target="_blank" rel="noopener noreferrer">infamous Apple Card</a>, they defended the product against charges of sexism by explaining that gender had not been an input to the credit scoring model. If an applicant’s gender was never fed into the algorithm, how did credit decisions end up discriminating against women who had similar credit histories as men?

Gender-blind credit scoring is an example of what many AI bias researchers call “fairness through unawareness,” an approach that intentionally excludes data on sensitive attributes like race, ethnicity, religion, or sex with the goal of reducing discriminatory outcomes. Behind this approach is the idea that eliminating markers of different group identities will prevent basing decisions on those characteristics. This has led to failures in the past, notably <a href="https://cpb-us-e1.wpmucdn.com/sites.suffolk.edu/dist/3/1172/files/2014/01/Rice-Swesnik_Lead.pdf" target="_blank" rel="noopener noreferrer">redlining</a>. Recent research has shown it can also make <a href="https://arxiv.org/abs/2009.06251" target="_blank" rel="noopener noreferrer">discrimination harder to detect and address</a> in the era of algorithmic decisions.
<blockquote class="pullquote--right">“Fairness through unawareness” intentionally excludes data on sensitive attributes like race, ethnicity, religion, or sex with the goal of reducing discriminatory outcomes.</blockquote>
As algorithms <a href="https://www.centerforfinancialinclusion.org/the-stories-algorithms-tell-bias-and-financial-inclusion-at-the-data-margins" target="_blank" rel="noopener noreferrer">transform the financial sector</a>, we need a better understanding of how to mitigate against discriminatory outcomes to ensure that those left out of the digital ecosystem today do not face further financial exclusion. Otherwise, we may not know how many Apple Card equivalents exist in inclusive finance.

This post explores the challenges and tradeoffs of using sensitive attribute data for detecting discrimination in the context of evolving data protection norms and regulations.
<h2>The Perils of Fairness through Unawareness</h2>
The idea may seem counterintuitive: if you remove gender from the data inputs of a credit model, how does the algorithm consistently assign a lower limit to women? The reason is that credit scoring algorithms are crunching larger amounts and new sources of data, which means that the model can inadvertently use proxies for sensitive attribute data in decisions, even if that was not the intention of the model developers. For instance, the <a href="https://journalofbigdata.springeropen.com/articles/10.1186/s40537-019-0180-9" target="_blank" rel="noopener noreferrer">type of phone</a> someone uses or the <a href="https://dl.acm.org/doi/10.1145/2721896.2721908" target="_blank" rel="noopener noreferrer">apps a person installs on their phone</a> can act as proxies for gender, age, or other characteristics.
<blockquote class="pullquote--left">Models can inadvertently use proxies for sensitive attribute data in decisions, even if that was not the intention.</blockquote>
A very simple method for testing algorithmic bias within a credit scoring model requires only a few variables like the actual default rate, the actual score of the individual when approved, and the variable you want to test with your algorithm, such as gender or race.
<h2>Data Tensions: Privacy vs. Anti-Discrimination</h2>
So, why isn’t this done? The answer lies in data limitations, sometimes based on very legitimate concerns about histories of injustice. It illustrates one of the challenges of detecting and monitoring for bias in algorithmic systems without infringing on privacy rights.

Many countries around the world prohibit collecting sensitive data or basing credit decisions on protected categories either under their banking regulations or under new data privacy legislation. In India, lenders are prohibited from discriminating on the <a href="https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?ID=764" target="_blank" rel="noopener noreferrer">grounds of sex, caste, or religion</a>. In the U.S., the Equal Credit Opportunity Act (ECOA) made it illegal for credit providers to discriminate based on sex, race, national origin, and other protected characteristics in response to widespread denials of credit to women and people of color. ECOA prohibits lenders from collecting this data in the first place, even for the purpose of detecting discrimination, because of fears it will be used improperly to further perpetuate bias in consumer lending. Research in the US shows that discriminatory trends have been <a href="https://arxiv.org/pdf/1912.06171.pdf" target="_blank" rel="noopener noreferrer">hard to detect in consumer lending</a> and that a lack of sensitive attribute data has also created enforcement challenges.

While not all lending regulations prohibit the collection of sensitive data, data privacy legislation introduces new limits on this data. The General Data Protection Regulation (GDPR), which has become the model for legislation in many developing markets, bars certain sensitive data from being collected or processed -- including data on race and ethnic origin, political opinions, philosophical beliefs, sexual orientation, and biometrics -- without individual consent.
<blockquote class="pullquote--right">Concerns about safely and properly using sensitive attribute data are valid given histories of discrimination and surveillance of minority groups in both wealthy and developing countries.</blockquote>
On top of GDPR, the European Commission has recently put forward <a href="https://digital-strategy.ec.europa.eu/en/library/proposal-regulation-laying-down-harmonised-rules-artificial-intelligence" target="_blank" rel="noopener noreferrer">draft legislation to regulate artificial intelligence</a>, with specific provisions for AI systems classified as high risk, which includes credit scoring. The draft legislation suggests that AI providers should process “special categories of personal data” to monitor and correct for bias in the public interest, but does not clarify collection practices or consent processes for such data. Concerns about safely and properly using sensitive attribute data are valid given histories of discrimination and surveillance of minority groups in both wealthy and developing countries. Changes in regulatory frameworks to allow for use of this data to mitigate against further discrimination require public trust bolstered by technical solutions that protect against misuse. Depending on a country’s history or in places experiencing active or simmering conflict, technical solutions may not be enough. For example, in a country like Rwanda where <a href="https://www.nytimes.com/2004/04/09/world/a-decade-after-massacres-rwanda-outlaws-ethnicity.html" target="_blank" rel="noopener noreferrer">ethnic distinctions are banned</a>, the tensions around sensitive identities make it difficult to fathom collecting and using such information, especially by the government.
<h2>Data Ecosystems in Emerging Markets: It’s Complicated</h2>
This tension between privacy and anti-discrimination may be exacerbated in developing markets by the <a href="https://centerforfinancialinclusion.org/rethinking-financial-inclusion-at-the-data-margins/" target="_blank" rel="noopener noreferrer">limited digital footprints</a> of customers at the data margins, as well as paltry knowledge on how data trails and protected groups intersect.

Sex-disaggregated data is still <a href="https://data2x.org/wp-content/uploads/2020/03/MappingGenderDataGaps_Economic.pdf" target="_blank" rel="noopener noreferrer">largely unavailable</a> in the financial sector and for many economic indicators in developing markets. Beyond availability, there is less understanding of how women’s lives and the barriers that shape their economic behaviors are reflected in data used for credit decisions. The reality is that gender, ethnic, or religious identities interact with other indicators (like income, asset accumulation, or technology use) and will impact individuals’ data trails in ways that may misrepresent individuals’ potential and result in disparate outcomes (i.e. access to a financial product). Fairness through unawareness approaches are blind to this intersectionality.
<h2>Where Do We Go From Here?</h2>
As an industry, we can do more to understand the data inputs for digital financial services and how socioeconomic realities present in these datasets, especially for traditionally excluded groups. There will still be tradeoffs between privacy and anti-discrimination, but managing those tradeoffs requires a conversation between providers, regulators, donors, and the public to identify what is possible and explore the right balance.

These conversations can start with the many open questions that exist from a technical perspective. For instance, can <a href="https://ieeexplore.ieee.org/document/8970908" target="_blank" rel="noopener noreferrer">third parties</a> play a role in securely storing sensitive data, or are there options to use <a href="http://proceedings.mlr.press/v80/kilbertus18a/kilbertus18a.pdf" target="_blank" rel="noopener noreferrer">encryption</a> or <a href="https://spectrum.ieee.org/artificial-intelligence/machine-learning/engineering-bias-out-of-ai" target="_blank" rel="noopener noreferrer">synthetic data</a> techniques? Can regulators develop tools that allow them to estimate the demographic characteristics of a dataset, like the <a href="https://www.consumerfinance.gov/data-research/research-reports/using-publicly-available-information-to-proxy-for-unidentified-race-and-ethnicity/" target="_blank" rel="noopener noreferrer">Consumer Financial Protection Bureau has done</a> in the U.S.? Can investors encourage investees to design monitoring and evaluation indicators to help answer questions about how their algorithms perform on inclusion?

While the road ahead may be complex, starting these conversations and bringing the public into them, especially those whose lives will be affected by algorithmic decisions, will be crucial for building trust. We need to engage with emerging research on possible solutions to see what might be appropriate in developing markets. At the very least, financial inclusion stakeholders should know enough to respond to any gender-blind or fairness through unawareness approaches in digital finance with healthy skepticism.
<blockquote>Starting these conversations and bringing the public into them, especially those whose lives will be affected by algorithmic decisions, will be crucial for building trust.</blockquote>

Reducing Bias in Algorithmic Decisions Cannot Rely on “Blind” Approaches

Financial Inclusion at the Data Margins

Alternative Data

Financial Technology

Consumer Protection

Credit

Credit Provision

Data Analytics

Digital Credit

Enabling Environment

Financial Service Providers

Fintechs

Policy, Regulation and Government Initiatives

Privacy

Responsible Digital Finance

Underwriting

Blog Post

This report, the third in a <a href="https://www.centerforfinancialinclusion.org/series/municipal-cash-transfer-programs-design-ids-and-data-protection">series</a> on municipal cash transfers in the U.S., focuses on data protection for undocumented or mixed-status beneficiary households. In the context of cash-based assistance (CBA) programs, poor data protection practices could add additional risks for low-risk individuals by providing data trails that could pave the way for unauthorized access to applicant or beneficiary data or leakage of personally identifiable information. These could leave a digital footprint that can make it easier for law enforcement to target undocumented individuals.

Considering these risks, we have identified and detailed approaches and strategies used to protect applicant and beneficiary data through four programmatic phases: targeting beneficiaries, outreach and onboarding, disbursement and distribution, and ongoing monitoring and data storage/retention. Insights in this report are gleaned from CFI interviews with cities, community-based organizations (CBOs), debit card providers, and privacy advocates.

This report and the others in this series are intended to guide municipal officials and CBOs considering or developing programs to support undocumented or mixed-status households. The insights may also be of interest to organizations advocating for and supporting the rights of undocumented populations, students and academics, and anyone <span data-contrast="auto">interested in </span><span data-contrast="auto">access to financial and</span> <span data-contrast="auto">public</span> <span data-contrast="auto">services</span><span data-contrast="auto"> for all members of U.S. communities. </span>

Protecting Beneficiary Data: Guidance for Municipal Cash Transfer Programs Responding to COVID-19

Open Society Foundations

North America

United States

Municipal Cash Transfer Programs: From Design to Data Protection

Appropriate Product Design and Delivery

Challenges and Crises

Credit/Debit Cards

Payments

Report

Though U.S. citizens and residents received economic support following passage of the CARES Act in spring of 2020, undocumented and mixed-status households were left behind. To bridge this assistance gap, state and local governments across the U.S. have partnered with community-based organizations (CBOs) to establish cash transfer programs to support these populations during the pandemic.

This report, part of a three-part <a href="https://www.centerforfinancialinclusion.org/series/municipal-cash-transfer-programs-design-ids-and-data-protection">series</a>, provides practical guidance to municipalities considering or currently operating direct cash assistance programs. It is based on insights from in-depth, semi-structured interviews conducted by CFI with 12 program administrators representing seven cash assistance programs.

We identify and detail practices for defining target beneficiaries, establishing eligibility criteria, conducting outreach, onboarding recipients, and disbursing funds. This report also highlights the relative advantages and disadvantages of different approaches at each step of the process.

The insights here may also be of interest to organizations advocating for and supporting the rights of undocumented populations, students and academics, and anyone <span data-contrast="auto">interested in </span><span data-contrast="auto">access to financial and</span> <span data-contrast="auto">public</span> <span data-contrast="auto">services</span><span data-contrast="auto"> for all members of U.S. communities. </span>

Designing Municipal Cash Transfer Programs to Mitigate the Economic Impact of COVID-19

Although the CARES (Coronavirus Aid, Relief, and Economic Security) Act has mobilized a whopping <a href="http://crfb.org/blogs/whats-2-trillion-coronavirus-relief-package">$293 billion</a> to provide one-time economic impact payments to American households, many are ineligible for this federal support due to <a href="https://www.nilc.org/resources-covid19-crisis-and-consequences/faq-eligibility-for-assistance-based-on-immigration-status/">their immigration</a> status or living in a <a href="https://www.nytimes.com/2020/04/28/us/coronavirus-undocumented-immigrants-stimulus.html">mixed-status household</a>. Cities, counties and states across the United States are stepping in for these residents by bridging the gap with cash transfer programs of their own.

Beyond the inherent complexity of quickly establishing a safe and efficient cash distribution program, serving this marginalized population presents specific challenges. First, local governments need to identify and enroll beneficiaries from a population that generally lacks official identity documentation and can be difficult to reach. Second, in addition to being undocumented, this population is often unbanked or underbanked, raising questions about how cities and counties can safely deliver financial stimulus in a cost-effective manner. Third, data protection is high stakes for this population, which tends to be at greater risk for financial fraud or exploitation, as well as targeting by Immigration and Customs Enforcement (ICE).

Given these challenges, how should US cities design cash transfer programs to serve undocumented communities?

With support from Open Society Foundations, CFI identified more than 70 examples of city- and county-led municipal identification initiatives (active, inactive, and proposed) that sought to address challenges residents face in obtaining government-issued forms of identification. For marginalized and vulnerable populations—such as the undocumented, those experiencing homelessness, and the elderly—a lack of official identification makes everyday tasks like accessing social services or opening a bank account difficult.

Cities that have established these programs, particularly those that have sought to leverage them to advance financial inclusion, provide several lessons to cities facing similar challenges while establishing cash assistance programs in response to COVID-19.

&nbsp;

&nbsp;

Municipal IDs Offer Cities Lessons for COVID-19 Cash Assistance Programs

Fraud

Brief

<a href="/about/what-we-do/the-smart-campaign/">The Smart Campaign</a> will participate in the AFI Consumer Empowerment &amp; Market Conduct (CEMC) &amp; Digital Financial Services (DFS) Working Group Meetings March 25-29 in the Bahamas. Elisabeth Rhyne will speak on a joint working group panel entitled “Data Protection and Privacy in the Age of Data Driven Financial Services.” This session will examine how innovations in technology that resulted in the proliferation of data and why consumers need to be more aware than ever about the risks of sharing personal details, and why financial institutions need to start thinking about data protection seriously. The Campaign will also present on the <a href="/help-us-shape-standards-for-responsible-digital-lending">draft Consumer Protection Standards for Digital Credit</a> and forthcoming updates to the Model Legal Framework for digital financial services.

Alliance for Financial Inclusion Working Group Meeting

The Smart Campaign

Event

Mobile phones and networks are transforming the world of finance, creating opportunities  for widespread financial inclusion, especially among neglected regions and groups. Security and privacy should be among the most important considerations when building digital finance systems.
Credit decisions are often based on sensitive information and online finance offerings are no exception. The sensitivity of this information gives rise to a series of critical questions for customers:
<ul>
 	<li>To whom am I giving my data? And who else do they allow to access it? For what purposes?</li>
 	<li>How do the companies protect data so that people who do not have legitimate access cannot use or steal it?</li>
 	<li>What rights and options do I have if something does go wrong?</li>
</ul>
The goal of this research, conducted by CFI Fellow Patrick Traynor, is to examine how well digital lenders are responding to these questions.

&nbsp;

&nbsp;

&nbsp;

Digital Finance and Data Security

CFI Research Fellows Program

Consumer Credit

Nano Loans

The Smart Campaign conducted a study on the client protection practices of 12 microfinance institutions in Latin America and the Caribbean (LAC). This study looked at an assortment of organizations such as NGOs, banks, and credit unions in different countries, analyzing their client protection performance from the point of view of practitioners, offering recommendations to improve their client protection practices. The findings in this Study of Practices in LAC are intended to help stakeholders reflect on the current state of practice among microfinance institutions in LAC and how performance gaps can be addressed.

Overall, the MFIs studied in the report performed well in the principles of Preventing Over-Indebtedness, Responsible Pricing, and Ethical Staff Behavior, but there is (sometimes significant) room for improvement in the principles of Transparency, Appropriate Collections, and Mechanisms for Complaint Resolution. This report revealed that client protection performance is not easily generalized and improvement in certain principles is needed to meet the standards laid out.

We believe that reaching the Campaign’s standards of care in client protection across all seven principles is a possible objective for most organizations to achieve, provided enough time and dedication. Ultimately implementing the principles will strengthen institutions and improve client well-being.

&nbsp;

&nbsp;

&nbsp;

Study of Client Protection Practices in Latin America and the Caribbean (Spanish)

Client Treatment

Complaint Resolution

Over-indebtedness

Product Pricing

Transparency

The Smart Campaign conducted a study on the client protection practices of 12 microfinance institutions in Latin America and the Caribbean (LAC). This study looked at an assortment of organizations such as NGOs, banks, and credit unions in different countries, analyzing their client protection performance from the point of view of practitioners, offering recommendations to improve their client protection practices. The findings in this Study of Practices in LAC are intended to help stakeholders reflect on the current state of practice among microfinance institutions in LAC and how performance gaps can be addressed.

Overall, the MFIs studied in the report performed well in the principles of Preventing Over-Indebtedness, Responsible Pricing, and Ethical Staff Behavior, but there is (sometimes significant) room for improvement in the principles of Transparency, Appropriate Collections, and Mechanisms for Complaint Resolution. This report revealed that client protection performance is not easily generalized and improvement in certain principles is needed to meet the standards laid out.

We believe that reaching the Campaign’s standards of care in client protection across all seven principles is a possible objective for most organizations to achieve, provided enough time and dedication. Ultimately implementing the principles will strengthen institutions and improve client well-being.

&nbsp;

&nbsp;

&nbsp;

&nbsp;

Study of Client Protection Practices in Latin America and the Caribbean (English)

Latin America and The Caribbean

Alexandra (Alex) Rizzi

Senior Research Director, Consumer Data Opportunities and Risks

Alex Kessler

Jacobo Menajovsky

Madeleine Longwell

Eric Noggle

Tess Johnson

Malacci Ohrt

Elisabeth Rhyne

Ezra Mannix

Patrick Traynor

Pablo Anton-Diaz

Ethan Loufield

John Owens

Lizzy Bolze

Hannah McCandless

Benin

Ghana

Uganda

Rwanda

Sub-Saharan Africa

Europe and Central Asia

India

South Asia

Delivery Channels

Digital Financial Services

Financial Capability

Telcos

Agent Banking

Mobile Banking

Underserved Groups

<h1>Why Consumer Rights and Responsibilities?</h1>
The <a href="https://www.smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles">Client Protection Principles</a> provide a common framework for financial service providers (FSPs), policymakers, and clients to better understand and discuss consumer protection issues. While much of the Center for Financial Inclusion’s (CFI) work with the financial inclusion industry has focused on providers and regulators, there is a third crucial constituency: clients.

Client awareness and capability is a critical component of effective financial consumer protection. Clients have the right to demand fair treatment and lodge complaints with government authorities, but these rights mean little if they don’t know what constitutes lawful treatment or how to access complaints channels. Similarly, clients play a role in protecting themselves by practicing behaviors to maintain their privacy and safety. While FSPs can institute protective processes and regulators can craft policy safeguards, improving client awareness of their rights and responsibilities helps consumers play their part to support a sustainable financial system.

This report provides lessons learned from initiatives in Ghana, Uganda, and Benin to raise consumer protection awareness among clients through multimedia campaigns, digital tools and other outreach strategies. It covers country-specific consumer protection issues and the individualized campaigns to address these issues. We also offer five key takeaways to help inform future client protection and empowerment awareness building activities.

Clients Deserve to Know: Using Radio to Educate and Empower Consumers in Africa

Today there are close to 700 million mobile money accounts registered worldwide — a number that, if it were a population, would rank as the world’s third-largest country. East Africa continues to lead in digital financial innovations as well as account usage, with two-thirds of the combined adult populations of Kenya, Rwanda, Tanzania, and Uganda actively using mobile money. With the proliferation of mobile financial services, particularly among underserved populations, it is vital that users be treated fairly and with dignity. In the momentum to define responsible digital finance and recognize providers of high-quality financial services, the industry must not forget the consumer.
<h1>Client Voices: Why We Listened</h1>
<a href="/about/what-we-do/the-smart-campaign/">The Smart Campaign</a>, a global initiative to create an environment in which financial services are delivered safely and responsibly to low-income clients, has long recognized that client perspectives are often underrepresented in consumer protection discussions. With the Client Voices Project, the Campaign questions whether the industry’s assumptions about what constitutes problematic treatment rightly reflect what clients themselves worry about.

The dual objectives of the project are to solicit input from low-income clients about what they consider good and bad treatment in their interactions with financial service providers and to assess the prevalence of consumer protection problems among these clients, using quantitative surveys. The project is designed to act as a catalyst for financial service providers, regulators, industry associations, consumer advocacy groups, and others to improve client protection in ways that are grounded in client feedback.
<h1>Major Findings</h1>
Based on a survey of over 1,200 people in three districts in Rwanda, this report delves into the experiences of individuals who use digital financial services (DFS), the main client protection issues they are concerned about, and the impact and prevalence of negative experiences. We find that mobile money enjoys a high degree of satisfaction and trust from clients in Rwanda, even though 40 percent of clients report being targeted by fraudulent schemes, which have become increasingly sophisticated.
<blockquote>Customers report wising up to scams and fraud, but with a continuous influx of new mobile money users and fraudsters who innovate quickly, the threat is real and constant. Fraud represents the greatest potential to damage customer trust and engagement with mobile money in Rwanda.</blockquote>
However, there are many ways that DFS operations and practices can be improved to better protect clients and strengthen trust. Client recourse mechanisms, for example, represent an important area for improvement: many clients shared that they feel helpless and unsure about what to do after realizing they have been duped. Additionally, for business models that rely more on the mobile interface than on human interaction, clients increasingly rely on agents for information and guidance. This presents an opportunity to provide better service, as well as a risk for poor client treatment.

We hope that providers, industry associations, support organizations, regulators, consumer protection advocates, and clients can benefit from these findings to create a stronger, more inclusive client protection ecosystem. We offer specific recommendations for many of these stakeholders.

Client Voices: Rwandans Speak on Digital Financial Services

<em>This post originally appeared on American Banker's <a href="https://www.americanbanker.com/opinion/consumer-harm-from-data-breaches-is-a-black-box">BankThink</a> page.</em>

Data privacy and security concerns are red-hot right now, with near daily headlines about yet another breach. Often missing from the conversation, however, is information about the nature and prevalence of harms consumers actually experience as a result of poorly protected data. We appear to enjoy speculating about what might happen to consumers more than documenting what does and has happened. And yet, there is no better guide to prioritizing remedial action than clear documentation of the consequences of shortcomings, their frequency and their severity.

The Center for Financial Inclusion at Accion, an action-oriented think tank focused on financial inclusion, examines issues around data protection among financial service providers around the world, with an emphasis on those serving the base of the pyramid. From the financial inclusion point of view, we need to understand the financial losses that customers experience — primarily theft and fraud — when data breaches occur.

While we have been able to <a href="https://www.centerforfinancialinclusion.org/digital-finance-and-data-security-2">explore security vulnerabilities</a> by working with the computer scientist Patrick Traynor of the University of Florida, we have found it more difficult to find good data on the consumer side. How often do consumers experience theft and fraud, how harmful are these events to consumers and financial institutions when they do occur, and how do they relate to security lapses or poor policies among financial institutions and their regulators? Without this data, we as a sector can only view part of the problem. We are unable to analyze the link between security system measures and actual consumer harm. It’s as though we have lost the car keys but are only able to look for them under the streetlight.

It sounds overly simplistic to say that a data breach leads to negative consequences only when those who obtain personal information actually use it. But while the breach of data from millions of bank accounts makes front-page news, we know startlingly little about the number of uses of those identities or the amounts of money lost. One estimate of incidence comes from the Identity Theft Resource Center, a nonprofit dedicated to assisting victims. It cites 1.6 billion record breaches since 2005, but only 16.7 million identity theft victims. A quick hallway poll of my own colleagues revealed many experiences of fraud, generally through idiosyncratic events rather than massive ones, underlining the fact that hackers and fraudsters tend to rip people off quietly and often individually. When this happens, victims themselves may not know how or when their personal data was tapped. As an industry, we are short of information about the pathways hackers use to turn data breaches into monetary thefts.

Where could the industry begin to gather this information?

Cybercrimes units among law enforcement agencies undoubtedly have a great deal of information about the incidence of theft resulting from fraudulent uses of personal data. In theory, their financial forensics can work backward from a monetary theft to the data breach that made it possible. But we need to ensure that such units address losses by ordinary consumers and not just big ticket white collar crimes. We also need to ensure that law enforcement knowledge translates into useful advice for financial institutions and regulators.

Large banks and major card providers also have masses of relevant information and expertise. They have invested enormous resources over decades to identify and cope with fraud, creating fraud detection systems and workforces dedicated to assisting customers who are victims, and they still write off millions of faulty transactions. While it may be expensive, that very investment is a major source of their business success: It makes it possible for consumers to trust that when their credit card information is stolen, they will not be liable. But what about smaller financial institutions and new market entrants that cannot afford the sophistication of major card providers? They need to know more about how consumers experience fraud and theft. It would be valuable for the regulators, researchers and industry associations that monitor the financial sector and have a stake in its success to gather more systematic demand-side research to document these consumer experiences — and that information needs to be publicly available so that financial service providers and their consumers can benefit from it.

These recommendations are a starting point to better inform consumers and the financial services industry about the risks associated with data breaches, and how they can be prevented and addressed. Better information on the incidence and severity of consumer harms can enable financial service providers and policymakers to weigh trade-offs between data protection investments and the risks associated with incomplete protection. As a result, they can target remedial actions more effectively, avoiding both over-spending and running unacceptable risks — with better outcomes for consumers.

Consumer Harm from Data Breaches is a Black Box

The keynote speaker at a recent EU conference on data protection and privacy, Apple CEO Tim Cook s<a href="https://www.computerworld.com/article/3315623/security/complete-transcript-video-of-apple-ceo-tim-cooks-eu-privacy-speech.html">poke surprisingly bluntly</a> about the consequences of how data is being collected and used, and stressed an immediate need to enact data privacy regulation -- at least in Apple’s home country -- which would be on par with his host’s General Data Protection Regulation (GDPR) framework, enacted May 2018.

“Our own information, from the everyday to the deeply personal, is being weaponized against us with military efficiency,” he said. “Platforms and algorithms that promised to improve our lives can actually magnify our worst human tendencies. Rogue actors and even governments have taken advantage of user trust to deepen divisions, incite violence, and even undermine our shared sense of what is true and what is false.”

Cook reviewed the four rights that are articulated in the GDPR: First, the right to have personal data minimized; second, the right to knowledge; third, the right to access, that is, to make it easy for users to get a copy of, correct, and delete their personal data; and fourth, the right to security.

For those of us in the financial inclusion space, it was a pleasant surprise to see such a high-profile tech CEO speak so forthrightly on the topic. Data security has also very much consumed our discussions, both in an <a href="https://content.centerforfinancialinclusion.org/getting-data-right/">essay</a> and in a <a href="https://www.centerforfinancialinclusion.org/the-road-to-getting-inclusion-right-data-and-an-effective-ecosystem">speech</a> at our recent 10th anniversary symposium. We’re grappling with this technical and multi-faceted issue in order to make sure that we “get it right” as data enables greater financial inclusion in the developing world.

Furthermore, the recent “Banana Skins” report, “<a href="https://www.centerforfinancialinclusion.org/finance-for-all-wedded-to-fintech-for-better-or-worse">Finance for All: Wedded to Fintech for Better or Worse</a>,” published by the Center for the Study of Financial Innovation in conjunction with CFI, reveals that leaders in financial inclusion see technology’s risks as by far the biggest challenge they currently face.

Lofty words and alarms may be on message, but what matters is moving toward tangible steps to protect data. A recent working paper by <a href="https://www.dvara.com">Dvara Research</a>, a financial systems policy research institution in India, lays out a <a href="https://www.dvara.com/blog/2018/11/08/video-effective-enforcement-of-a-data-protection-regime/?utm_source=feedburner&amp;utm_medium=email&amp;utm_campaign=Feed%3A+dvara+%28Dvara+Blog%29">framework for a data protection regime</a> that could addresses both prevention of and response to data breaches. The authors provide a risk-based framework for “responsive regulation” in India, noting that the most regulations are created after a major data breach has occurred (such as the Aadhaar data breach in India about a year ago). The paper highlights principles – such as transparency, accountability, and proportionality – that should guide the regulators.

Speaking of regulation, The Economist Intelligence Unit’s <a href="https://www.centerforfinancialinclusion.org/global-microscope-2018">Global Microscope</a>, a ranking of the enabling environments in 55 countries carried out in partnership with CFI, has also taken a forward-looking digital approach in evaluating governments’ abilities to create smart, practical and deliverable regulation, including in data protection. Colombia (which tops the overall ranking) and South Africa, for example, have dedicated financial consumer protection frameworks and specialized enforcement capacity, along with government entities with a strong capacity to enforce data protection laws.

We at CFI couldn’t agree more with these intentions, and we’re also contributing our part toward making sure the need for data protection, transparency, and consumer knowledge are deeply ingrained in those operating in the financial inclusion space.

This is why the <a href="http://smartcampaign.org/">Smart Campaign</a> is strengthening its attention to data privacy and security in its standards for consumer protection certification for digital financial services. We are also sponsoring research, such as that from CFI Fellow Patrick Traynor, which showed how some digital financial service providers have <a href="https://www.centerforfinancialinclusion.org/digital-finance-and-data-security-2">gaps in their data security</a> protocols, and offered some easily actionable technical fixes (see also this <a href="http://www.cgap.org/blog/cybersecurity-mobile-financial-services-growing-problem?utm_source=CGAP+Reader+%2811.26.18%29&amp;utm_campaign=CGAP+Reader+%2811.26.18%29&amp;utm_medium=email">post and slide deck</a> from CGAP with challenges and best practices for digital financial service providers).

In 2019, CFI will continue to tackle this issue, to do our part as advocates of data protection for billions of vulnerable unbanked and underbanked consumers around the world.

&nbsp;

Apple CEO Sounds Right Notes on Data Protection and Privacy

Given their rapid spread and growth, this question urgently needs answering. As part of its ongoing CFI Fellows Program, CFI asked <a href="http://www.centerforfinancialinclusion.org/people/patrick-traynor/">Patrick Traynor</a>, professor at the University of Florida’s Department of Computer Information Science &amp; Engineering (CISE) to find out.

Traynor and his team of computer science researchers looked at the security of online fintech applications using a collection of both automated and manual standard analysis techniques widely available in the computer science toolkit. They examined the apps and websites of 52 digital apps, mainly digital lenders, from all across the world to see how they handle user data. Additionally, after the technical analysis, Traynor’s team also evaluated the privacy policies for each application to see if they described how users’ data would be used and protected, and the recourse available to users in case of any misuse. <a href="http://www.centerforfinancialinclusion.org/digital-finance-and-data-security-2/">Read the full report</a>.

These tests allowed for a rapid assessment of the state of communications security between users’ mobile devices and each institution’s backend servers. The tests determined whether the mobile application properly determined the identity of the other end of communications, and whether the institutions’ backend servers were properly configured against the most up-to-date attacks against the SSL/TLS security suites. A thorough analysis of the apps’ public code included, among other things, a review of the process for registration and login, user authentication, money transfers and techniques used to isolate the website or application’s data from other potentially malicious) applications on the phone. Through such an analysis, the researchers were able to determine how easily an adversary could inject false transactions or alter legitimate transactions in the platform.

The results of the study were surprising. No company studied was perfect, some were good enough, and some had real vulnerabilities. The researchers found that the integrity of data gathered from mobile money applications varied dramatically across the sample. Interestingly, neither presence in a developed market nor company maturity predicted better security performance: similar security vulnerabilities were found in both early stage startups and more established providers and in institutions from all world regions in the sample. No company is immune from security gaps, and mobile fintechs are no exception.

In an effort to motivate and enable companies to address these vulnerabilities, CFI sent individual results to each of the companies reviewed in the study. Additionally, Traynor prepared a short guidebook with instructions on how to correct the most commonly identified security vulnerabilities uncovered by this study. The recommended changes will provide significant security improvements for a low time and monetary investment.

Through Accion’s Venture Lab, we organized a private webinar with Traynor for six companies in the sample. He walked participants through the tests and addressed questions on how to implement his recommended changes. We recognize and commend these companies for their dedication to address the issues this study encountered in their systems, and would like to encourage other companies in the study to do the same by reaching out to us directly. Our aim as CFI is to motivate better data security practices and we are available to support any company taking action on this matter.

Accion Venture Lab is also working to create and share resources for their portfolio companies and the broader industry. Focused on developing a set of practical resources to help early-stage fintech startups implement better information security and data privacy, their approach is to leverage insights from industry experts and portfolio companies to create actionable and accessible content. The tools they are building include:
<ul>
 	<li>Diagnostic: checks and tests that companies can use to identify major gaps in security and privacy</li>
 	<li>FAQ: resources to answer the most salient questions from companies about data protection</li>
 	<li>Data policy outline: key components of a quality data policy for financial services companies</li>
 	<li>Implementation guide: best practices to implement changes to data practices</li>
</ul>
Additionally, Venture Lab is working on relevant questions for due diligence. The goal is not to screen out a company based on these, but rather to identify areas where Venture Lab can help develop more robust policies and practices.

At both CFI and Venture Lab, we believe that integrity of client data gathered from mobile applications is important to secure. Companies don’t always dedicate the time and resources to understand their vulnerabilities and compromising incidents with data will damage the credibility and limit the reach of digital apps. By measuring the state of security in this space and providing targeted resources for digital fintechs, we can enable responsible digital financial services and greater financial inclusion.

&nbsp;

New Data Security Study of Fintech Apps Highlights Vulnerabilities

<em>This post is one of five entries related to the report “<a href="http://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/1030-accelerating-financial-inclusion-with-new-data">Accelerating Financial Inclusion with New Data</a>,” a collaboration between CFI and the Institute of International Finance (IIF).</em>

One might think that with the explosion of new types of data and advanced analytics there would be an abundance of low-hanging fruit for financial service providers to feast on. While the excitement about the potential of non-traditional data may be justifiable, the reality is that the hard work of building the networks to derive value from such data is just getting underway. Just as the invention of the automobile required the development of roads, signage, lighting, laws and regulations, so too will data need its own groundwork before it can bring transformative change to the financial system and society at large.

Any change of this magnitude also requires large-scale collaboration to ensure that the infrastructure and standards put in place are broadly applicable across technologies, data types, industries and countries. As such, alongside the many in-house and bilateral initiatives afoot across various providers and markets, there needs to be a much more holistic and collaborative approach to developing data ecosystems that can align principles, practices and standards to facilitate the flow of data through value chains and across geographies.
<blockquote>Complexity and fragmentation across a growing number of holders of data and in legal and regulatory environments makes it essential to work at an ecosystem level to allow data to flow more freely.</blockquote>
Our recently released report, <a href="https://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/1030-accelerating-financial-inclusion-with-new-data">Accelerating Financial Inclusion with New Data</a>, discusses various impediments to unlocking data’s potential, ranging from determining which types of data to leverage to how to access it, to where data can be stored and how to integrate it with existing data and systems. For example, mobile network operators are often reluctant to engage in agreements with third parties to share mobile phone data, known as call detail records, because of regulatory ambiguity about what can be shared – and to retain a competitive advantage. Social media companies restrict the data third parties can access, and some have policies that prohibit the use of their data for credit scoring. Other obstacles include varying regulation of cross-border data flows, a shortage of specialized expertise in data management and analytics, and a lack of standardization. All of this results in complexity and fragmentation across a growing number of holders of data and in legal and regulatory environments, making it essential to work at an ecosystem level to allow data to flow more freely.

Fortunately, a number of developments reflect this ecosystem-building approach. A recent Brookings Institution <a href="https://www.brookings.edu/research/regulating-for-a-digital-economy-understanding-the-importance-of-cross-border-data-flows-in-asia/">report</a> addressing cross-border data flows in Asia explained that despite the enormous economic benefits brought on by the global flow of data, governments are increasingly turning to what is referred to as <em>data localization</em> to restrict data flows. At the same time, however, the report provides some examples of solutions that facilitate the free flow of data among countries with different approaches to privacy. Citing the Cross-Border Privacy Rules developed by the Asia-Pacific Economic Cooperation (APEC) forum, it says, “A key benefit of the APEC regime is that it enables personal data to flow freely even in the absence of two governments having agreed to formally recognize each other’s privacy laws as equivalent. Instead, APEC relies on businesses to ensure that data collected and then sent to third parties either domestically or overseas continues to protect the data consistent with APEC privacy principles.” Various other frameworks of this nature have emerged as well, which are helping to build the connections needed for our increasingly data-driven economies to thrive.

In a new <a href="https://www.slideshare.net/slideshow/embed_code/key/mK7BOSft2scEUj">report</a> exploring trends in how data is being shared in emerging markets, Rafe Mazer, a consultant specializing in consumer protection and competition in financial services, addresses the emergence of a variety of public and private sector-led data sharing models and offers a set of considerations for assessing their fit for different country contexts. The report identifies the challenge posed by the concentration of data in “data silos” and says, “In these data silos the firm that generates or collects the data on the consumer defines the terms of use of the data up front in a way that limits the consumer’s right to access this data or share it, while giving wide-ranging and often ill-defined rights to the firm to share and sell consumers’ account data to third party service providers.” Mazer emphasizes the need for providers, policymakers and others to replace these silos with open data sharing models and concludes that “the single most important action to support data sharing in emerging markets is likely to be policy reforms, as experiences in other markets point to a need to compel certain minimum levels of data sharing for these models to reach a national scale.”
<blockquote>We hope to see more holistic and collaborative approaches to developing data ecosystems that can align principles, practices and standards to facilitate the flow of data.</blockquote>
While significant progress has already been made in finding innovative ways to leverage non-traditional data, much of what has taken place to date has been through internal experimentation or bilateral arrangements, such as <a href="https://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/872-how-financial-institutions-and-fintechs-are-partnering-for-inclusion">partnerships between financial institutions and fintechs</a>. Looking ahead, we hope to see an expansion of comprehensive multi-party arrangements that can help to channel the ever-increasing flows of new data into our broader efforts to advance financial inclusion.

Building Data Ecosystems for Financial Inclusion

As digital credit providers have grown exponentially over the past few years, and as digital products and models have proliferated, so too have concerns around consumer protection. In the recently published report, <a href="http://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/1036-responsible-digital-credit">Responsible Digital Credit</a>, I argue that ensuring that digital credit customers receive responsible treatment requires more than enhanced consumer protection laws and regulations. It also requires strong commitment from the digital credit industry. Finally, it needs consumers who are empowered to play a more proactive role in managing their digital credit responsibly.

Over the past year, I have interviewed digital credit industry associations, credit providers and their third-party data analytic providers, regulators, policy makers, and various consumer protection leaders. Many of these groups are working to develop responsible digital lending principles. With their input, my report proposes a guiding framework for responsible digital lending.  The framework uses the Smart Campaign <a href="https://www.smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles">Client Protection Principles</a> as a basis for grouping the issues. In addition, I propose an eighth principle: security and fraud protection.

Digital credit, and especially the use of mobile phones, significantly alters interactions between borrowers and lenders. Lenders utilizing the mobile channel to advertise, acquire and transact with customers must pay particular attention to the limitations of mobile interaction with customers and follow industry <a href="http://onlinelendersalliance.org/wp-content/uploads/2016/03/Best-Practices-2016-1.pdf">mobile best practices</a>. While many of the standard consumer protection practices continue to apply, new concerns, or more accurately, new faces on older concerns, have emerged. In this post, I want to highlight several of the considerations I found most important and relevant for the digital lending industry.
<h2><strong>Responsible Algorithms</strong></h2>
Many digital credit models rely on algorithms to process data about clients and make credit decisions. Because most lenders consider their algorithms proprietary, it is difficult for observers to know on what basis credit decisions are actually made. This opaque situation raises the spectre of discrimination. Attributes that are considered inappropriate bases for differentiation, such as religion, language, gender, or ethnic origin, are areas of particular concern with regard to algorithm-based lending practices. As highlighted by a Smart Campaign <a href="http://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/916-smart-brief-tiny-loans-big-questions">report</a>, while credit offers may differ based on risk analysis, such differentiation should be consistently applied, stated in advance, and made with the goal of benefitting clients. To prevent discriminatory digital credit practices, some recommendations include:
<ul>
 	<li><a href="https://www.whitecase.com/publications/insight/algorithms-and-bias-what-lenders-need-know"><strong>Pretest, test and retest for potential bias</strong></a><strong>.</strong> Digital credit providers and third-party data analytics providers should continuously monitor the outcomes of their algorithmic programs to identify potential problems. Such testing could involve running scenarios to identify unwanted outcomes and developing and building controls that prevent adverse outcomes.</li>
 	<li><a href="http://www.ijmo.org/papers/43-A10212.pdf"><strong>Document the rationale for algorithmic features</strong></a><strong>.</strong> Digital credit providers should be able to provide visualization and a decision tree for the factors their algorithms analyze, as well as the justification for relying on these factors. The rationale should address how borrower debt capacity is assessed, given the importance of this concept in traditional underwriting.</li>
 	<li><strong>Independent review</strong> of companies' proposed data sets and/or algorithms.</li>
</ul>
A self-regulatory approach could be used to develop best practices guidelines for data inputs and the development of nondiscriminatory artificial intelligence systems, following the model that has been successful for the Payment Card Industry Security Standards Council.
<h2><strong>Indebtedness Monitoring</strong></h2>
Because digital lending is often based on non-traditional underwriting criteria, to prevent over-indebtedness among digital borrowers it may be relatively more important to monitor outcomes at the portfolio level. Some of the ways to do this include:
<ul>
 	<li><strong>Avoidance of debt traps</strong> by ensuring that clients are not forced into automated repeat loans.</li>
 	<li><strong><a href="http://www.responsiblebusinesslending.org/">Responsible credit reporting</a></strong> – Better compliance with reporting strengthens markets and leads to better client protection practices.</li>
 	<li><strong><a href="http://www.centerforfinancialinclusion.org/storage/documents/Smart_Brief_Tiny_Loans_Big_Questions_Final_092617.pdf">Monitoring digital credit provider’s portfolio quality</a></strong> – Industry benchmarks for portfolio quality can help to advance the understanding of risks and avoid business models that rely for their success on high default rates.</li>
</ul>
<h2><strong>Digital Transparency </strong></h2>
Digital credit platforms allow for 24/7 communications with clients that, if harnessed properly, can assist them with immediate technical support, remind them about upcoming payments and even identify counselors or resources for clients in financial stress. However, when communication is totally digital, there are heightened concerns about ensuring that clients really know what they are signing up for. Disclosure must lead to client understanding. Borrower disclosure standards should address:
<ul>
 	<li>Standards for <strong>honest advertising</strong> and penalties for misleading marketing materials of credit products. Furthermore, providers should advertise the name of the financial regulator they report to in all advertising materials.</li>
 	<li><strong>Readability</strong> and format – Disclosures need to be easy to comprehend, available in the customer’s local language, and provided in print and digital formats.</li>
 	<li><strong>Comparative tools</strong> – Standard summary disclosure documents would allow borrowers to compare credit offers, both digital and traditional.</li>
 	<li><strong>Adequate notice periods</strong> – Consumers should be notified in advance of changes to interest rates, fees or terms and conditions.</li>
</ul>
A somewhat different but related and relevant concern, often overlooked in this context, is the vulnerability of individual investors who put their money into pure peer-to-peer (P2P) lending platforms. Protections need to be extended to them as well, with a focus on ensuring that they receive the information they need to evaluate risks and that they have recourse channels when something goes amiss.
<h2><strong>Data Privacy and Usage Standards</strong></h2>
While many regulators and most industry groups agree that it is important to protect the confidentiality and security of customers’ information, data use and the level of disclosure about its use are challenging topics. In the <a href="http://ec.europa.eu/justice/data-protection/reform/index_en.htm">EU</a> and in countries such as <a href="https://www.pc.gov.au/inquiries/completed/data-access/thedraft">Australia</a>, regulators are enacting rules mandating that individuals be notified about the use of their personal data and allowed to opt out. Opt-out rules should be considered as a potential requirement for all digital credit providers, especially in markets where mobile push-marketing has become problematic.

Over the next several years it will be important for laws or regulations to be put in place to protect consumer data privacy and guide information sharing. The rules need to:
<ul>
 	<li>Provide for informed consent, such that customers explicitly permit electronic data collection prior to its collection and use, and are given the option to consent or not.</li>
 	<li>Require providers to have a clear data collection and handling policy which limits the amount of data collected as well as the timeframe it is stored.</li>
 	<li>Inform clients about their data trails and credit histories, including the ability to ensure accuracy and correct for any errors or discrepancies.</li>
 	<li>Give regulators the power to discipline providers who repeatedly allow personal data to be misused.</li>
</ul>
<h2><strong>Fraud Prevention and Security </strong></h2>
New security vulnerabilities arising from digital credit strongly point to fraud and cyber-security as consumer protection concerns. It is increasingly urgent for digital credit providers to adopt standard security compliance measures and then to regularly test and update them. Providers must also be responsible for ensuring that the third-parties they use, including lead generators, brokers, agents, and data analytics providers, also have adequate security in place. Ultimately, providers need to be responsible for the actions of their third-parties (e.g., agents, contractors, lead generators, brokers and collectors).

Consumers should be made aware of the potential for fraud and encouraged to report suspected fraud cases or security breaches. Consumer awareness campaigns on the most common incidents of fraud (via the internet, SMS alerts, signage at agent kiosks, etc.) can help with this.

While the recommendations just listed do not apply in all markets, they do point to the urgent need for regulators, industry bodies, individual providers and consumers to work together to construct the ground rules for responsible digital credit that will ensure that consumers are adequately protected.

<em>Editor's Note: This research was made possible by support from Mastercard Foundation and other partners.</em>

&nbsp;

A Framework for Responsible Digital Credit

Jeffrey Riecke

Never before have issues of data privacy and security been more top of mind. In the United States this attention was on <a href="https://cfi-blog.org/2018/04/11/financial-inclusion-responds-to-the-zuckerberg-moment/">full display</a> a few weeks ago when every media outlet was glued to Facebook’s CEO Mark Zuckerberg as he fielded questions from Congress on how his company handles, and has mishandled, user data.

Europe begins a new era for data protection today as the General Data Protection Regulation (<a href="https://gdpr-info.eu/">GDPR</a>) goes into effect, following its passage roughly two years ago. The law is being celebrated widely for its robust customer-centricity. The degree to which it succeeds, in Europe and globally, in enforcing a business environment that provides adequate safeguards for consumer data management remains to be seen. One thing is certain, however: it has the potential to change the way we all interact with businesses, from internet platforms to banks.

First, a quick overview of the law.

The regulation <a href="https://www.youtube.com/watch?v=j6wwBqfSk-o">tightens rules</a> on what companies can and can’t do with customers’ personal data. Data qualifies as “personal” if it can identify the user, which includes names, phone numbers, usernames, and even GPS data and IP addresses.

The law strives to put customers in control of their data. It requires providers to attain explicit consent from users on data that will be gathered and how it will be used. Instead of users automatically opting in to data sharing, providers must configure their systems with no pre-checked boxes. Users must actively opt in. Providers are compelled to use simple, accessible language communicating what’s in their user data agreements.

The regulation significantly strengthens individuals’ abilities to access their data, and even to erase it. An individual can ask a company for the data in their personal file and the company must comply within a month. If the user believes that a company should correct data, or delete data altogether, the company must comply in most cases.

Punishment for noncompliance is steep, with delinquent companies facing fines up to €20 million or 4 percent of the company’s total revenues, whichever is higher. It’s <a href="https://www.theverge.com/2018/5/24/17388206/microsoft-expand-data-privacy-tools-gdpr-eu">reported</a> that Microsoft has had more than 1,600 engineers working on GDPR-related projects.

Even though the regulation only pertains to citizens of the European Union and companies operating there, in today’s global business landscape, where there is no shortage of cross-border business, we’re likely to see providers all over the world adopting stricter data practices to ensure compliance with the GDPR.

What does the new regulation mean for financial services?

We’re likely to see providers throughout the financial services ecosystem reconfiguring their digital products and the related data systems to align with the new standards. For example, a bank might only do 2 percent of its total global business in the EU, but if it fails to comply with the GDPR, it could still be subject to penalties – a strong incentive, indeed. Not all financial services providers will be affected equally. Larger institutions that have had the resources over the past two years to allot product designers, compliance lawyers, and the like to GDPR are better positioned than startups and small providers to take these regulatory changes in stride. Moreover, not all financial services providers use data in the same way. Institutions that use “alternative” data sources to underwrite credit decisions might be faced with a bigger barrier than financers whose business models aren’t contingent on customers opting to share personal information.

Of course, there’s a difference between the letter of the law and business practices. As Richard Waters of <em>The Financial Times</em> <a href="https://www.ft.com/content/bbbce328-5f64-11e8-9334-2218e7146b04">put it</a>, “The principles behind the regulation are laudable, but it is likely to take an onslaught of official complaints from privacy activists to test the parameters of this new regime.”

We’ll be curious to see the degree to which the new law improves users’ engagement with their data. When many of us are faced with a new user agreement, we just click and carry on. Would the requirement to click opt in boxes make a difference in whether we actually read the agreements? Will we take the time to sort out what data we are willing to share and with whom? Perhaps not, but the GDPR works to offer every opportunity for us to do so.

<strong>Have you read?</strong>

<a href="https://cfi-blog.org/2017/04/07/internet-data-and-banking-data-should-the-same-rules-apply/">Internet Data and Banking Data - Should the Same Rules Apply?</a>

<a href="https://cfi-blog.org/2015/10/07/addressing-customer-needs-off-to-the-data-mines/">Addressing Customer Needs? Off to the Data Mines</a>

<a href="https://cfi-blog.org/2017/05/01/how-secure-is-data-used-in-digital-credit/">How Secure Is Data Used in Digital Credit?</a>

&nbsp;

How Will Europe’s General Data Protection Regulation Affect Us?

Mark Zuckerberg <a href="https://www.nytimes.com/2018/04/10/us/politics/mark-zuckerberg-testimony.html">defended</a> Facebook’s handling of customer data yesterday before the U.S. Senate, and many of us at Accion and the Center for Financial Inclusion were riveted. Not that the testimony was especially compelling as television spectacle, but because the issues at stake are so important both for our own lives and for our work.

I did a quick scan of the staff here in our Washington, D.C. office, and would like to share some of their thoughts.

Many of us identified with the widespread shock toward Facebook for using our data (or allowing others to use it) in ways we don’t like and without our clear consent. “It’s hard to separate the relevance for our work [in financial inclusion] from my anger at the relevance of these events for my life,” said <a href="http://www.centerforfinancialinclusion.org/about/staff/675-sonja-kelly">Sonja Kelly</a>. For <a href="http://www.centerforfinancialinclusion.org/about/staff/733-Allyse-McGrath">Allyse McGrath</a>, the first thought was a sense of relief that policy makers are “actually doing something about protecting our data” which she quickly amended to “at least starting to explore how to do so.” Other folks are more skeptical and wondering whether legislators will do anything once the furor dies down.

Data privacy and data security are central to the success of financial inclusion. As <a href="http://smartcampaign.org/">Smart Campaign</a> director <a href="http://www.centerforfinancialinclusion.org/about/staff/124-isabelle-barres">Isabelle Barres</a> pointed out, the Campaign enshrined data privacy as one of the seven <a href="http://smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles">Client Protection Principles</a> from the very beginning. Through the years we have seen a somewhat peripheral principle become increasingly prominent, as customer data became more digital and more abundant. “There are absolutely some data abuses, and regulators need to step in,” she said. “And perhaps there is hope that the focus on Facebook will be a trigger to force companies to think about consumer data more carefully.” More broadly, our staff are concerned that the proliferation of data collected without much regulation can lead to the kinds of aggressive push marketing we are beginning to see with digital credit delivery in some countries.

<img class="alignright wp-image-25420" style="border: 0 solid #000000" src="https://centerforfinancialinclusionblog.files.wordpress.com/2018/04/quote-1-real1.png" alt="" width="340" height="102" />Senators asked Zuckerberg a lot of questions about Terms and Conditions (T&amp;C). Long and legalistic, people do not read the Facebook T&amp;Cs, and if they did, they would not likely understand them. In such a situation, does consent really exist? This problem is exactly the same in financial inclusion. On many mobile money platforms, for example, T&amp;Cs cannot be read on the phone when the customer is actually using the service. Customers have to log on to an internet-connected computer to download the T&amp;Cs – and we know almost none of them do. What have these customers given away? They do not know.

The solution proposed in the hearing today was to ask customers to opt-in to data sharing rather than setting sharing as the default and asking them to opt out. This choice is just as relevant for payment and credit apps as it is for Facebook. The presumption should always be in favor of privacy and the customers’ right to choose how their data is used.

<a href="https://www.accion.org/content/venture-lab-team">Coryell Stout</a> of the <a href="https://www.accion.org/venturelab">Accion Venture Lab</a> team noted that fintech start-ups often do collect enormous amounts of data. Venture Lab vets the founders and managers of their investee companies thoroughly, with an eye toward social mission. They also review data use and management policies. They do not invest until satisfied that the data is used to benefit customers. However,  the potential for misuse exists, if data is in the hands of people with other motivations. “We know that companies are collecting a lot of data. It needs to be secure, and we need more clarity about who controls the data fintechs collect.” Governments may need to help create that clarity.

<img class="alignright wp-image-25422" style="border: 0 solid #000000" src="https://centerforfinancialinclusionblog.files.wordpress.com/2018/04/quote-1.png" alt="" width="339" height="130" />The landmark European law on data privacy, the <a href="https://www.eugdpr.org/">General Data Protection Regulation</a>, which goes into effect next month, comes down solidly on the side of consumer ownership and control of data. Yesterday’s hearings suggest that the U.S., which has until now had a much more pro-company perspective, may become somewhat more sympathetic to the European approach. Regulators in the emerging and frontier markets in which we work are just starting to come to grips with the issue, and may forge their own path, as <a href="http://www.mondaq.com/india/x/655034/data+protection/Data+Protection+Laws+in+India">India</a> and <a href="https://www.economist.com/news/china/21735613-will-impede-governments-snooping-china-consumers-are-becoming-more-anxious-about-data">China</a> are doing.

The consequences of misuse of consumers’ social media data can be significant – not just annoying ads, but election meddling and more. But the consequences of misuse of financial data can be even more direct: money lost to scams, theft and mis-selling. As we watch the public conversation play out over the broad questions of data ownership, we need to ensure that a similar conversation is moving forward to ensure that the highly sensitive data financial service providers handle – whether they are banks, microfinance institutions, telcos or fintechs – is secure and properly used.

<em>Featured image credit: Alessio Jacona via <a href="https://www.flickr.com/photos/10296406@N00/25140171161">Flickr Creative Commons</a></em>

<strong>Have you read?</strong>

<a href="https://cfi-blog.org/2014/04/16/facebook-to-provide-remittances-the-news-and-the-bigger-picture/">Facebook to Provide Remittances? The News and the Big Picture</a>

<a href="https://cfi-blog.org/2015/09/24/discrimination-and-credit-underwriting-in-the-age-of-social-media/">Discrimination and Credit Underwriting in the Age of Social Media</a>

<a href="https://cfi-blog.org/2017/11/20/choosing-a-payday-lender-can-online-reviews-help/" target="_blank" rel="noopener">What Global Bankers Are Worried About</a>

&nbsp;

&nbsp;

&nbsp;

&nbsp;

Financial Inclusion Responds to the Zuckerberg Moment

India is a global leader in financial inclusion. For over a decade, Accion has worked with and learned from India’s innovators, investors, and policymakers to expand economic opportunity for its people and businesses.

The recent <a href="https://www.nbcnews.com/tech/security/massive-equifax-data-breach-could-impact-half-u-s-population-n799686">security breach of credit reporting agency Equifax</a> exposed birth dates, social security numbers and credit card information of up to 143 million consumers. The hackers will likely sell this personal information which could result in financial and medical identity left, and fraudulent credit card activity and tax reporting, along with a slew of other activities. Earlier this week <a href="https://www.nytimes.com/2017/09/26/business/equifax-ceo.html?mcubz=3">Equifax announced</a> their CEO, Richard Smith will be retiring and could walk away with $18 million in pension benefits. The Massachusetts Attorney General, Maura Healey <a href="http://www.npr.org/2017/09/14/550949718/after-equifax-data-breach-consumers-are-largely-on-their-own">called it</a> “the most brazen failure to protect consumer data we have ever seen.” As a result, the Federal Trade Commission, members of Congress and multiple states’ authorities are looking into criminal investigations. However, the burden of this breach will fall primarily on individual consumers to ensure they are protected, and only <a href="https://qz.com/1079138/whats-the-worst-that-can-happen-with-the-equifax-breach-a-lot-especially-if-youre-poor/">10 percent</a> of the potential 143 million affected have even checked the Equifax site to see if their information was compromised. (You can check to see if you may have been impacted <a href="https://www.equifaxsecurity2017.com/am-i-impacted/">here</a>.)

The precautionary recommendations put forth have been to: 1. Check your credit score regularly (which can only be done for free once a year); 2. Freeze your credit; and 3. Purchase credit monitoring services. (Freezing your credit means establishing a “lock” that prevents opening new forms of credit in your name, while monitoring your credit is the process of periodically reviewing your credit reports for accuracy and changes that might be the result of fraudulent activity.) The irony of these suggestions is that you have to rely on the three major credit bureaus (Equifax, Experian and TransUnion) to perform these consumer protection activities. How can we know we are safe from fraud when our recourse requires trusting the entities that have been compromised? What’s more, why should we pay additional fees to correct the credit bureau’s mistake?

The Equifax breach affects consumers at all levels of the socioeconomic landscape, and unfortunately those with fewer financial resources and capability will be affected the most. Correcting identity theft can be a time consuming and financially burdensome endeavor. For many it is challenging to come up with emergency cash to cover legal fees to prove identity theft or restore credit, recover stolen assets and pay for additional credit monitoring services. And sadly, we haven’t seen strong consumer protection support on behalf of the credit bureaus and formal financial service providers in the wake of this breach -- support like educating the public about monitoring credit, providing more than one free credit report annually or offering free/discounted credit monitoring for more than one year. Thomas Hinton, CEO of the consumer advocacy non-profit American Consumer Council, <a href="https://qz.com/1079138/whats-the-worst-that-can-happen-with-the-equifax-breach-a-lot-especially-if-youre-poor/">said</a> he “is deeply concerned that Equifax – and all credit reporting companies – are not doing enough in a timely manner to protect under-served consumers who have been victimized by this data breach and stand to suffer the most.”

Such massive security breaches erode the public’s trust in the financial system, particularly among the unbanked already skeptical of entering the formal financial fold. The <a href="http://www.usfinancialdiaries.org/issue">U.S. Financial Dairies</a> showed that many Americans don’t trust the financial system because of unexpected bank fees – like overdraft fees – and because banks provide little or no social support, which many people get with informal group lending and savings options.

This isn’t the first major data breach in U.S. history and it won’t be the last. Last year when Yahoo was in negotiations to be bought by Verizon, it came out that <a href="https://www.csoonline.com/article/2130877/data-breach/the-16-biggest-data-breaches-of-the-21st-century.html">1.5 billion</a> user accounts were compromised between 2013 and 2014. And we can’t forget the 2013 Target breach that compromised credit/debit card and contact information of up to <a href="https://www.csoonline.com/article/2130877/data-breach/the-16-biggest-data-breaches-of-the-21st-century.html">110 million</a> customers.

So, what can be done? How can anyone feel comfortable about the protection of personal information?

Financial service providers are looking to biometric data as a secure identification source for financial services. Over the past seven years, <a href="https://uidai.gov.in/about-uidai/about-uidai.html">the Unique Identification Authority of India (UIDAI)</a> has issued over <a href="https://uidai.gov.in/about-uidai/about-uidai.html">one billion</a> Unique Identification Numbers (UID), also known as Aadhaar numbers, which are verified and authenticated with biometric data via finger prints or iris scans. This identification system is a part of <a href="http://indiastack.org/about/">India Stack</a> that uses four distinct technology layers – including simplified payments addressing and interoperability – to provide digital financial services across governments and businesses in India.

The technology already exists to use finger print and facial scans to unlock our phones or log into personal banking apps, and there is even the potential of using <a href="https://www.wired.com/2016/03/biometrics-coming-along-serious-security-concerns/">ear scans and heart beat identification</a> as biometric identification sources. But so far biometric identification is fairly unregulated, some consider the security to not yet be airtight and there are additional privacy concerns with using bodily identifiers. Hackers are already finding ways to spoof biometric identification. Recently, the security firm Vkansee was able to <a href="https://www.wired.com/2016/03/biometrics-coming-along-serious-security-concerns/">break into Apple’s Touch ID system</a> with a small piece of play doh. But we will see rapid improvements in Apple’s security, particularly with the new iPhone X Face ID technology.

In the case of India’s Aadhaar scheme, there is robust opposition to the program, with concerns including the perceived ease of forging fingerprints, the program’s potentially inadequate digital security, and its ubiquity. Some opponents of the program believe that if the Aadhaar numbers are widely integrated and linked between previously-siloed databases, it expands the opportunity for citizen profiling and surveillance. In August, India’s Supreme Court <a href="https://www.theatlantic.com/technology/archive/2017/09/aadhaar-worlds-largest-biometric-database/538845/">issued a ruling</a> enshrining the fundamental right to privacy. The anti-Aadhaar movement in the country celebrated the ruling, asserting that the program is in conflict with this fundamental right. Soon the Supreme Court will indeed assess if Aadhaar does violate Indian citizen’s privacy rights.

Regardless of how our information is authenticated, it is becoming increasingly important for consumers to protect and regularly track their financial information. Consumers should be concerned about the potential threats and take appropriate action by checking their credit score and monitoring credit card activity. But we can also realize that, at least as of now, security breaches are mostly out of our hands.

<strong>Have you read?</strong>

<a href="https://cfi-blog.org/2017/05/01/how-secure-is-data-used-in-digital-credit/">How Secure Is Data Used in Digital Credit?</a>

<a href="https://cfi-blog.org/2017/05/05/demonetization-brought-out-the-best-in-indian-microfinance-clients/">Demonetization Brought Out the Best in Indian Microfinance Clients</a>

<a href="https://cfi-blog.org/2017/06/28/why-do-privacy-policies-matter-for-digital-credit/">Why Do Privacy Policies Matter for Digital Credit?</a>

&nbsp;

In the Wake of the Equifax Breach, Are Biometrics the Answer?

<em>&gt; Posted by Dr. Katharine Kemp, Research Fellow, UNSW Digital Financial Services Regulation Project</em>

<em>The following post was <a href="http://www.ifmr.co.in/blog/2017/08/22/big-data-financial-inclusion-and-privacy-for-the-poor/">originally published</a> on the IFMR blog. </em>

<img class="alignright wp-image-24028" src="https://centerforfinancialinclusionblog.files.wordpress.com/2017/08/thumb_a98e715cf75d4c2ca7eea8e88847d4ba.jpg" alt="" width="365" height="243" />Financial inclusion is not good in itself.

We value financial inclusion as a means to an end. We value financial inclusion because we believe it will increase the well-being, dignity and freedom of poor people and people living in remote areas, who have never had access to savings, insurance, credit and payment services.

It is therefore important to ensure that the <em>way</em> in which financial services are delivered to these people does not ultimately diminish their well-being, dignity and freedom. We already do this in a number of ways – for example, by ensuring providers do not make misrepresentations to consumers, or charge exploitative or hidden rates or fees. Consumers should also be protected from harms that result from data practices, which are tied to the provision of financial services.

<strong>Benefits of Big Data and Data-Driven Innovations for Financial Inclusion</strong>

“Big data” has become a fixture in any future-focused discussion. It refers to data captured in very large quantities, very rapidly, from numerous sources, where that data is of sufficient quality to be useful. The collected data is analysed, using increasingly sophisticated algorithms, in the hope of revealing new correlations and insights.

There is no doubt that big data analytics and other data-driven innovations can be a critical means of <a href="http://www.pc.gov.au/inquiries/completed/data-access/report" target="_blank" rel="noopener noreferrer">improving the health, prosperity and security of our societies</a>. In financial services, new data practices have allowed providers to serve customers who are poor and those living in remote areas in new and better ways, including by permitting providers to:
<ul>
 	<li>Extend credit to consumers who previously had to rely on expensive and sometimes exploitative informal credit, if any, because they had no formal credit history;</li>
 	<li>Identify customers who lack formal identification documents;</li>
 	<li>Design new products to fit the actual needs and realities of consumers, based on their behaviour and demographic information; and</li>
 	<li>Enter new markets, increasing competition on price, quality and innovation.</li>
</ul>
But the collection, analysis and use of enormous pools of consumer data has also given rise to concerns for the protection of financial consumers’ data and privacy rights.

<strong>Potential Harms from Data-Driven Innovations</strong>

Providers now not only collect more information directly from customers, but may also track customers physically (using geo-location data from their mobile phones); track customers’ online browsing and purchases; and engage third parties to combine the provider’s detailed information on each customer with aggregated data from other sources about that customer, including their employment history, income, lifestyle, online and offline purchases, and social media activities.

Data-driven innovations create the risk of serious harms both for individuals and for society as a whole. At the individual level, these risks increase as more data is collected, linked, shared, and kept for longer periods, including the risk of:
<ul>
 	<li>Inaccurate and discriminatory conclusions about a person’s creditworthiness based on insufficiently tested or inappropriate algorithms;</li>
 	<li>Unanticipated aggregation of a person’s data from various sources to draw conclusions which may be used to manipulate that person’s behaviour, or adversely affect their prospects of obtaining employment or credit;</li>
 	<li>Identity theft and other fraudulent use of biometric data and other personal information;</li>
 	<li>Disclosure of personal and sensitive information to governments without transparent process and/or to governments which act without regard to the rule of law; and</li>
 	<li>Harassment and public humiliation through the publication of loan defaults and other personal information.</li>
</ul>
Many of these <a href="http://www.cgap.org/blog/making-case-privacy-poor" target="_blank" rel="noopener noreferrer">harms are known to have occurred</a> in various jurisdictions. The reality is that data practices can sometimes lead to the erosion of trust in new financial services and the exclusion of vulnerable consumers.

Even relatively well-meaning and law-abiding providers can cause harm. Firms may “segment” customers and “personalise” the prices or interest rates a particular consumer is charged, based on their location, movements, purchase history, friends and online habits. A person could, for example, be charged higher prices or rates based on the behaviour of their friends on social media.

Data practices may also increase the risk of harm to society as a whole. Decisions may be made to the detriment of entire groups or segments of people based on inferences drawn from big data, without the knowledge or consent of these groups. Pervasive surveillance, even the awareness of <a href="https://www.jstor.org/stable/23252125?seq=1#page_scan_tab_contents" target="_blank" rel="noopener noreferrer">surveillance, is known to pose threats</a> to freedom of thought, political activity and democracy itself, as individuals are denied the space to create, test and experiment unobserved.

These risks highlight the need for perspective and caution in the adoption of data-driven innovations, and the need for appropriate data protection regulation.

<strong>The Prevailing “Informed Consent” Approach to Data Privacy</strong>

Internationally, many data privacy standards and regulations are based, at least in part, on the <a href="https://www.priv.gc.ca/en/opc-actions-and-decisions/research/explore-privacy-research/2016/consent_201605/" target="_blank" rel="noopener noreferrer">“informed consent”</a> – or “notice” and “choice” – approach to informational privacy. This approach can be seen in the Fair Information Practice Principles that originated in the U.S. in the 1970s; the 1980 OECD Privacy Guidelines; the 1995 E.U. Data Protection Directive; and the Council of Europe Convention 108.

Each of these instruments recognise consumer consent as a justification for the collection, use, processing and sharing of personal data. The underlying rationale for this approach is based on principles of <a href="http://scholarship.law.gwu.edu/cgi/viewcontent.cgi?article=2093&amp;context=faculty_publications" target="_blank" rel="noopener noreferrer">individual freedom and autonomy</a>. Each individual should be free to decide how much or how little of their information they wish to share in exchange for a given “price” or benefit. The data collector gives notice of how an individual’s data will be treated and the individual chooses whether to consent to that treatment.

This approach has been <a href="https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2533057" target="_blank" rel="noopener noreferrer">increasingly criticised</a> as artificial and ineffectual. The central criticisms are that, for consumers, there is no real notice and there is no real choice.

In today’s world of invisible and pervasive data collection and surveillance capabilities, data aggregation, complex data analytics and indefinite storage, <a href="https://www.priv.gc.ca/en/opc-actions-and-decisions/research/explore-privacy-research/2016/consent_201605/" target="_blank" rel="noopener noreferrer">consumers no longer know or understand</a> when data is collected, what data is collected, by whom and for what purposes, let alone how it is then linked and shared. Consumers do not read the dense and opaque privacy notices that supposedly explain these matters, and could not read them, given the hundreds of hours this would take. Nor can they understand, compare, or negotiate on, these privacy terms.

These problems are exacerbated for poor consumers who often have more limited literacy, even less experience with modern uses of data, and less ability to negotiate, object or seek redress. Yet we still rely on firms to give notice to consumers of their broad, and often open-ended, plans for the use of consumer data and on the fact that consumers supposedly consented, either by ticking “I agree” or proceeding with a certain product.

The <a href="https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2784123" target="_blank" rel="noopener noreferrer">premises of existing regulation are therefore doubtful</a>. At the same time, some commentators question the relevance and priority of data privacy in developing countries and emerging markets.

<strong>Is data privacy regulation a “Western” concept that has less relevance in developing countries and emerging markets?</strong>

Some have argued that the individualistic philosophy inherent in concepts of privacy has less relevance in countries that favour a <a href="http://www.tandfonline.com/doi/abs/10.1080/10572317.2007.10762729" target="_blank" rel="noopener noreferrer">“communitarian” philosophy of life</a>. For example, in a number of African countries, “ubuntu” is a guiding philosophy. According to ubuntu, “a person is a person through other persons”. This philosophy values openness, sharing, group identity and solidarity. Is privacy relevant in the context of such a worldview?

Privacy, and data privacy, serve values beyond individual autonomy and control. Data privacy serve values which are at the very heart of “communitarian” philosophies, including compassion, inclusion, face-saving, dignity, and the humane treatment of family and neighbours. The protection of financial consumers’ personal data is entirely consistent with, and frequently critical to, upholding values such as these, particularly in light of the alternative risks and harms.

<strong>Should consumer data protection be given a low priority in light of the more pressing need for financial inclusion?</strong>

Some have argued that, while consumer data protection is the ideal, this protection should not have priority over more pressing goals, such as financial inclusion. Providers should not be overburdened with data protection compliance costs that might dissuade them from introducing innovative products to under-served and un-served consumers.

Here it is important to remember how we began: financial inclusion is not an end in itself but a means to other ends, including permitting poor and those living in remote areas to support their families, prosper, gain control over their financial destinies, and feel a sense of pride and belonging in their broader communities. The harms caused by unregulated data practices work against each of these goals.

If we are in fact permanently jeopardising these goals by permitting providers to collect personal data at will, financial inclusion is not serving its purpose.

<strong>Solutions</strong>

There will be no panacea, no simple answer to the question of how to regulate for data protection. A good starting place is recognising that consumers’ “informed consent” is most often fictional. Sensible solutions will need to draw on the full “toolkit” of privacy governance tools (Bennett and Raab, 2006), such as appropriate regulators, advocacy groups, self-regulation and regulation (including substantive rules and privacy by design). The solution in any given jurisdiction will require a combination of tools best suited to the context of that jurisdiction and the values at stake in that society.

Contrary to the approach advocated by some, it will not be sufficient to regulate only the use and sharing of data. Limitations on the <em>collection</em> of data must be a key focus, especially in light of new data storage capabilities, the likelihood that de-identified data will be re-identified, and the growing opportunities for harmful and unauthorised access the more data is collected and the longer it is kept.

Big data offers undoubted and important benefits in serving those who have never had access to financial services. But it is not a harmless curiosity to be mined and manipulated at the will of those who collect and share it. Personal information should be treated with restraint and respect, and protected, in keeping with the fundamental values of the relevant society.

<em>Image credit: Accion</em>

<strong>Have you read?</strong>

<a href="https://cfi-blog.org/2017/06/28/why-do-privacy-policies-matter-for-digital-credit/">Why Do Privacy Policies Matter for Digital Credit?</a>

<a href="https://cfi-blog.org/2017/05/01/how-secure-is-data-used-in-digital-credit/">How Secure Is Data Used in Digital Credit?</a>

<a href="https://cfi-blog.org/2017/05/15/data-are-not-neutral-part-1-of-2/">Data Are Not Neutral (Part 1 of 2)</a>

Big Data, Financial Inclusion and Privacy for the Poor

<em>CFI Fellow Patrick Traynor, an Associate Professor in the Department of Computer and Information Science and Engineering (CISE) at the University of Florida, explains the second part of his research effort on the security and privacy of data in digital lending applications. Patrick’s previous post, explaining the first part of his research on evaluating the privacy policies of digital lending applications, can be found </em><a href="https://cfi-blog.org/2017/06/28/why-do-privacy-policies-matter-for-digital-credit/"><em>here</em></a><em>.</em>

“I’m sorry, but we are just not interested in providing security for our customers.”

Here is a phrase that you are unlikely to see from any company, at least if they want to stay in business. In fact, you are far more likely to see statements to the opposite. Yet time and again, the same services that tout security as something they care about prove to be tremendously vulnerable. Think about it – when was the last week that you didn’t hear about stolen Bitcoins, ransomware attacks, or data breaches?

If companies care so much about security, what is going on?
<h2><strong>What Does "Secure" Mean?</strong></h2>
Security is one of the least well-defined terms I know. By itself, it completely lacks context. Secure against what? Against whom? Under what conditions? Based on what assumptions?

As an analog, think about a restaurant that claims to care about “consumer health.” Is this statement regarding ingredients in their meals? Calories? What about cleanliness? How is the food prepared? Do employees really wash their hands after using the restroom? Most would agree that it is insufficient to simply trust such claims, and we rely on external entities (e.g., health department ratings, government regulations for calorie counts on menus, etc.) to give “consumer health” more measurable meaning.

The answers to my above “security in context” questions become deeply technical very quickly. In fairness, it is debatable whether it is realistic for the general public to understand these details. Regardless, this gap between specificity and understanding often permits real security considerations to end at exceedingly broad public statements. If nobody checks or bothers to define what security means, the thinking often goes, why bother to go further?

That’s where my team comes in – think of us as the health department for the security of online credit systems.

Before I go into further details, let’s make something clear. “Security” is hard. Even if you answer all of the context questions above, ensuring that you get it right all of the time in every location is something that nobody seems to know how to do well. Unlike most other engineering, where major assumptions remain within a predictable range (e.g., when building a bridge, winds, currents and the pull of gravity are all accounted for in the design), security faces the problem of constantly evolving adversaries. That means that what worked perfectly well yesterday may do very little to protect systems tomorrow. That said, we cannot write off security as an inevitable failure just because it is hard. Moreover, there are many tried and true techniques that absolutely should be in place for anyone to begin tossing around the word security. Our job is to ensure that we see these techniques in place and working correctly.
<h2><strong>What Are We Measuring?</strong></h2>
If we are specific about what we claim is secure, it is possible to understand the ways in which systems are likely to be strong. For my <a href="http://www.centerforfinancialinclusion.org/programs-a-projects/cfi-fellows-program">CFI Fellowship research</a> on the security of online credit applications, I am measuring the characteristics of the connection between mobile devices and the server within the application provider’s network. While it possible to measure the security of many parts of an online credit system, the most critical is ensuring that connections between mobile devices and the service provider’s servers is secure. Accordingly, we focus our attention here. The figure below shows this in more detail.

[caption id="attachment_23960" align="aligncenter" width="616"]<a href="https://centerforfinancialinclusionblog.files.wordpress.com/2017/08/patrick-traynor-graphic.png"><img class="wp-image-23960" src="https://centerforfinancialinclusionblog.files.wordpress.com/2017/08/patrick-traynor-graphic.png" alt="" width="616" height="215" /></a> A high-level overview of our security analysis[/caption]

Why is this the right thing to measure? Simply, if a user cannot communicate securely with a company’s server, nothing else matters. An adversary need not bother to try to breach other security if this portion is poorly executed. Think of it this way – if the online credit provider’s system were a castle, we are most interested in the protections around the drawbridge over the moat. If nobody is watching who and what comes across that drawbridge, it does not matter how high the castle walls may be. Said differently, systems that do not get this part of security correct might as well be saying that quotation from the beginning of this post.

My team will characterize security with regards to the following metrics. First, we will look to see whether or not the mobile device uses strong encryption algorithms to protect the confidentiality (i.e., the secrecy) and integrity of all communications. Mobile platforms contain many different encryption algorithms, but even the best algorithms can be used in dangerous ways. Accordingly, we will reverse engineer mobile applications (where available) and determine which algorithms their developers have chosen.

Second, we will measure how mobile devices confirm the identity of the server. This is critical – when done poorly, a mobile device is happy to divulge any and all secrets to an adversary on the other end of a connection. There are some standard ways that an expert would expect this step to be done, and our previous published work on mobile money (<a href="http://www.cise.ufl.edu/~traynor/papers/reaves-usenix15a.pdf">Reaves, et al., Mo(bile) Money, Mo(bile) Problems: Analysis of Branchless Banking Applications in the Developing World, Proceedings of the USENIX Security Symposium (SECURITY), 2015</a>) showed that approximately 50 percent of applications analyzed in that space did so incorrectly.

Finally, we will measure the configuration of the servers with which a mobile device communicates. Poor configuration here could again render the connection vulnerable as an adversary may be able to force the selection of weak/no cryptographic algorithms encrypting communications.

One major advantage to this analysis is that fixes to these problems can also be achieved at relatively low cost. Specifically, any faults that we find will not require impacted companies to spend hundreds of thousands of dollars to deploy advanced detection systems. Rather, a combination of changes by their development team and administrators can potentially address these issues in short order. We intend to alert all of the impacted companies prior to the release of our final report.

As a final note, finding no faults in this portion of a system does not mean that everything is secure. Moreover, this kind of analysis requires significant resources and time to carry out. It is our hope that each of the companies we study see these results as a first step, and use them to start a broader internal discussion about what they are doing to ensure security inside their company (e.g., creating policies about software updates and patching machines, establishing mechanisms for researchers who discover vulnerabilities to provide responsible disclosure of vulnerabilities, deployment of mechanisms for the secure storage of sensitive data, etc.).

No single analysis can measure all aspects of security. However, we look forward to sharing our results with the general public and the financial inclusion community in the near future. Together, we can ensure the transformative power of these systems while minimizing risks to users.

<strong>Have you read?</strong>

<a href="https://cfi-blog.org/2017/05/01/how-secure-is-data-used-in-digital-credit/">How Secure Is Data Used in Digital Credit?</a>

<a href="https://cfi-blog.org/2017/05/15/data-are-not-neutral-part-1-of-2/">Data Are Not Neutral (Part 1 of 2)</a>

<a href="https://cfi-blog.org/2017/06/28/why-do-privacy-policies-matter-for-digital-credit/">Why Do Privacy Policies Matter for Digital Credit?</a>

&nbsp;

How Secure Are Emerging Digital Credit Services?