# South Africa's Taxi Industry as a
Cybersecurity-Awareness Game Changer: Why and
How?

Petrus Duvenage, Victor Jaquire, Basie Von Solms

► To cite this version:

Petrus Duvenage, Victor Jaquire, Basie Von Solms. South Africa's Taxi Industry as a Cybersecurity-Awareness Game Changer: Why and How?. 15th IFIP World Conference on Information Security Education (WISE), Jun 2022, Copenhagen, Denmark. pp.92-106, 10.1007/978-3-031-08172-9_7 hal-05311506

HAL Id: hal-05311506

https://inria.hal.science/hal-05311506v1

Submitted on 13 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# South Africa's Taxi Industry as a Cybersecurity-Awareness Game Changer: Why and How?

Petrus Duvenage✉, Victor Jaquire✉, and Sebastian von Solms✉

University of Johannesburg, Johannesburg, South Africa
{pcduvenage,vjaquire,basievs}@uj.ac.za

**Abstract.** The South African economy is not only the second largest in Africa, but it is also the most diversified, industrialized and technologically advanced on the continent. This technological advance is evidenced by its citizenry's comparatively high-level of digital connectivity and interconnectedness. On the reverse side, South Africa (SA) has the third highest number of cybercrime victims internationally. Maintaining and expanding its competitive technological advantage requires of South Africa to have a robust national cybersecurity endeavour. This needs to include an innovative, high-impact cybersecurity awareness campaign that effectively reaches a diverse population. This paper's primary aim is to propose such a high-impact drive, namely a broad-based national cybersecurity awareness campaign that levers the South African minibus taxi industry. The paper's three objectives pertain to the 'why' and 'how' of such a campaign. The paper's first objective is to substantiate the need for a broad-based cybersecurity awareness campaign (in short: why is it needed?). The second objective is to substantiate why the taxi industry constitutes an optimal platform for a game changing campaign. Thirdly, the paper advances a proposition on a Taxi Industry Cybersecurity Awareness Campaign (TICAC) (i.e. how can the taxi industry be a game changer?). We qualify the TICAC as a tentative, high-level conceptual proposition subject to much further research on the theoretical/academic and practical levels. It is hoped that the paper would be of value to also other countries - developed and developing - in utilising private and/or public transport industries as platforms for cybersecurity awareness initiatives.

**Keywords:** Cyber security awareness · Public transport · Minibus taxi industry · Developing countries · Wi-Fi · South Africa

## 1 Introduction

With COVID-19 dominating the headlines throughout 2020 and 2021, “the consistent development and deployment of information and communication technology (ICT) infrastructure and its concomitant services has meant a continued trend towards digital transformation for societies, businesses and governments alike” [1]. Individuals and
institutions are moving more and more of their existential activities online and at a faster rate. The pandemic has unquestionably deepened digital reliance.

The pandemic has not only accelerated digital reliance, but also the concurrent exploitation of the cyber sphere by cyber criminals and other malicious actors. Trend Micro, for example, estimates that 2021 witnessed a 47% year-on-year increase in cyber threats internationally [2]. Research cited by Interpol [3] found that in 2021 cybercrime reduced Gross Domestic Product (GDP) of Africa countries by more than 10% and at projected cost of an estimated 4.12 billion USD.

Consequently, cybersecurity has further expanded its presence as a priority item on the agendas of governments and enterprises [4]. In terms of technology and governance, 'zero trust' models and practices are now on the forefront [5]. Technology and governance alone are of course not the sole solution. Humans as part of the ecosystems remain the weakest link in cybersecurity. Insecure cyber practices by individuals not only pose a risk to themselves but also the institution(s) they work for or otherwise digitally interact with. This has been amplified by the COVID-era's 'new normal'. Against this backdrop, the already vibrant interest in interdisciplinary cybersecurity awareness research has been boosted further. Academic research into innovative, fit-for-purpose cybersecurity awareness mechanisms is particularly pertinent. In South Africa, like the rest of Africa, there is a particular need for game changing initiatives that can increase broad-based cybersecurity awareness [6]. Public transport, this paper contends, could offer a useful platform for cybersecurity awareness. However, academic research on leveraging public transport for cybersecurity awareness in general remains limited.

Therefore, this paper's primary aim is to substantiate and propose a broad-based national cybersecurity awareness campaign that leverages the South African minibus taxi industry. For ease of reference, this initiative is referred to in the paper as TICAC (Taxi Industry Cybersecurity Awareness Campaign). As suggested by its title, the paper's three objectives pertain to the 'why' and 'how' of such a campaign. These objectives are to:

* Substantiate the need for a broad-based cybersecurity awareness campaign (in other words: why is such a campaign needed?).

* Motivate the assertion of the taxi industry being an optimal platform for the campaign (i.e. why the taxi industry can be a game changer?).

* Advance a proposition on Taxi Industry Cybersecurity Awareness Campaign (RICAC) - i.e. how the taxi industry can be a game changer?

We qualify the TICAC as a tentative, conceptual proposition subject to further research and not in any a roadmap for implementation. While the paper utilises South Africa as a case study for such an initiative, it would also be of interest to practitioners and academics of other countries. In tabulated format, the structure of the paper - linked to the objectives - is depicted in Table 1 (on the next page).
<table><caption>**Table 1. Paper objectives and structure**</caption><thead><tr><th></th><th></th></tr></thead><tbody><tr><td>Objective 1: Substantiate why there is a need for a broad-based cybersecurity awareness campaign</td><td></td></tr><tr><td>Section 2</td><td>The critical need for innovative, broad-based cybersecurity awareness initiatives in South Africa</td></tr><tr><td>Objective 2: Motivate why can the taxi industry can be a game changer</td><td></td></tr><tr><td>Section 3</td><td>Requirements to which a broad-based cybersecurity awareness campaign in South Africa should comply to be effective</td></tr><tr><td>Section 4</td><td>Reasons why the South African minibus taxi industry with WiFi offering could be a game changer</td></tr><tr><td>Objective 3: Outline how the taxi industry can be a game changer</td><td></td></tr><tr><td>Section 5</td><td>International research on the use of public transport for cybersecurity awareness</td></tr><tr><td>Section 6</td><td>Proposal on a Taxi Industry Cybersecurity Awareness Campaign (TICAC)</td></tr><tr><td>Section 7</td><td>Security considerations that should be considered in the rolling out of TICAC</td></tr></tbody></table>

This section contextualised the paper and presented its aims, objectives and structure. In accordance with the structured outlined above, the next section seeks to respond to the question: Why is there a critical need for a broad-based cybersecurity awareness campaign in South Africa?

## 2 The Need for Innovative, Broad-Based Cybersecurity Awareness Initiatives in South Africa

As was noted in the preceding section, the acceleration of certain trends in the cyber threat landscape has led to an even higher prioritisation of cybersecurity awareness internationally. While globally important, there is a particular acute need for an innovative broad-based cybersecurity awareness in South Africa. To contextualise, substantiate and unpack this assertion, this section is structured as follows:

* Sect. 2.1 shows South Africa as a continental leader in terms of technological advancement and digital connectivity. Although these are positives, these factors also increase the attack surface vulnerable to exploitation.

* In overviewing the South African cyber threat landscape, Sect. 2.2 contends that these vulnerabilities are exploited by malicious actors and that South Africa is indeed highly cyber insecure and targeted.

* Sect. 2.3 shows that South Africa's cyber insecurity to a substantial degree relates to certain deficiencies in its national cybersecurity maturity (of which cybersecurity awareness is an important pillar).

* Sect. 2.4 specifically appraises and identifies some shortcomings in cybersecurity awareness in South Africa.
Flowing from these four Subsects. (2.1–2.4), we conclude Sect. 2 with asserting the need for fit-for-purpose, broad-based awareness cybersecurity initiatives in South Africa.

## 2.1 South Africa as a Technologically Advanced and Connected Continental Leader

South Africa's economy is not only the second largest in Africa, but it is the most diversified, industrialized and technologically advanced on the continent [7]. Overall it is also the most technologically innovative and leads the continent in fields such as AI, and IoT [1, 8]. This accelerating technological advance is further evidenced by the sophistication of South Africa information and communication sector as well as its population's comparatively high-level of digital connectivity, interconnectedness and uptake of digital devices. The following attest to this digital connectivity and interconnectedness:

* South Africa's active mobile broadband subscriptions (102 per 100 inhabitants) not only tops that of African countries but is far in excess of the world average of 75 per 100 inhabitants [1].

* South Africa is one of only four African countries where the proportion of individual Internet users in 2020 was above the world average of 51.4% [9].

* It is estimated that in 2021, 36.45 million South Africans accessed the internet through mobile devices [9].

* South Africa (with Mauritius and the Seychelles) are leading the e-government ranking in Africa [1].

## 2.2 Cyber Insecurity and the South African Threat Landscape

Although interconnectivity and technological advancement generally are positives, such factors could (for reasons discussed in Sect. 2.3), also have a negative reverse side. As is clear from the following statistic, this is the case in that South Africa:

* Has the third highest number of cybercrime victims internationally [10].

* In 2021 was found to be the 24 most cyberinsecure of 75 countries surveyed by Comparitech [11]. While South Africa's risk score incrementally improved from in 2019, South Africa is sliding further down the list, "meaning it is not keeping up" [11].

* In 2020 had a 100% annual increase in mobile banking application fraud and is estimated to have experienced 577 malware attacks an hour [3].

* Was recorded by Trend Micro to have had 230 million threat detections from January 2020 to February 2021 - nearly 200% more than the next worst affected African country of Kenya [3].

* Is one of the top ten countries "globally where threat actors received the highest volume of cryptocurrency from illicit addresses" [3].
## 2.3 Assessing South Africa's National Cybersecurity Maturity

Maintaining and expanding its competitive advantage (outlined in Sect. 2.1) would require of South Africa to have a robust national cybersecurity endeavor. However, the concise overview of the South Africa threat landscape (Sect. 2.2) suggests that this is not the case. This is also evidenced by South Africa's ranking in the ITU's 2020 Global Cybersecurity Index (GCI) report [1]. The ITU [4] assessed national cybersecurity across five pillars, namely (i) legal measures, (ii) technical measures, (iii) organisational measures, (iv) capacity development measures and (v) cooperation measures.

The ITU found South Africa to be substantially lagging its peers in its national cybersecurity effort [4]. In the 2020, the ITU [4] ranked South Africa 59th globally and only 8th in Africa. The ITU [1] graphically depicts its assessment of South Africa national cybersecurity maturity as follows:

<figure><img src="image_3.png" /><figcaption>Fig. 1. South Africa's national cybersecurity maturity [1]</figcaption></figure>

Moving from the wider context provided in the preceding subsections (Sect. 2.1 to 2.3), the next section more specifically examines the status of cybersecurity awareness in South Africa. This is done in line with Sect. 2's aim to substantiate and explicate the need for initiative broad-based cybersecurity initiatives in South Africa.

## 2.4 Defining and Appraising South Africa's Public Cybersecurity Awareness (as Part of 'National Cybersecurity' Maturity)

"Effective cybersecurity awareness raising is essential in keeping citizens, businesses, governments, youth, and organizations alert. With the current shift to digital services, governments need to ensure that all users are aware of the risks they face while carrying out digital activities" [4].

Cybersecurity awareness is of course a crucial element of national cybersecurity and accordingly features so in the cybersecurity maturity models of inter alia the ITU and Oxford University. The ITU [4] positions "cyber security awareness" as a subset of
"capacity development". Phrased differently, "cyber security awareness" is one of the main factors used in assessing "capacity development". As indicated in in Fig. 1 above, South Africa performs poorly in "capacity development".

As far as could be ascertained from consulted academic literature, there is no recent survey or comprehensive analysis of specifically the status of public cybersecurity awareness in South Africa. From available public sources, the following can be surmised:

* There is no broad-based (public) cybersecurity awareness programme centrally coordinated or driven by government.

* Several entities in government and the private sector are engaged in cyber security awareness initiatives but these are directed at specific target groups and are not centrally coordinated.

* Corporate entities in general are committed to cybersecurity awareness in respect of their workforces. A Mimecast's State of Email Security 2020 report, for example, found that 99% of South African respondents offer security awareness training [12].

* Existing cybersecurity awareness initiatives in South Africa, however, are not effective and/or do not have a sufficiently broad impact. According to Mimecast [12], to illustrate, "half of South African employees surveyed" admitted to opening emails they considered suspicious."

* South African Internet users "are [comparatively] inexperienced and less technically alert than users in other nations' [10].

When the effectiveness of South Africa cybersecurity public awareness campaigns is contrasted against Internet penetration, the country falls out in an intersection of high concern, namely "high Internet penetration" but deficient and insufficient "public cybersecurity awareness campaigns" [4].

## 3 Requirements for Effective Broad-Based Cybersecurity Awareness Campaign (in the South Africa Context)

The preceding section indicated the need in South Africa for an effective public (broad-based) cybersecurity awareness campaign. To be a game changer, this cybersecurity awareness campaign should duly consider the requirements to which this campaign should comply. Therefore, this section aims to derive such requirements.

Dlamini & Modise [13] rightly state that there is no single fit-for-all cybersecurity awareness campaign. Instead, a broad-based public cybersecurity awareness campaign should be specifically designed by means of a process that has the following six elements [14]: "Cybersecurity awareness goals and objectives, Identify intended audience, Define topics to be covered, Define delivery methods to be used, Develop a strategy for rollout, and Develop evaluation methods."

Although all of the above cited elements are informative, this paper was qualified as not being a roadmap for implementation. Instead the paper limits itself to deriving the requirements to which the envisaged campaign should comply. No postulations could be found in consulted literature on requirements to which a broad-based cybersecurity awareness campaign, comparable to the one envisaged in the paper, should comply.
Therefore, the six requirements discussed in the next paragraph were identified through inductive reasoning that is specific to South Africa's political and socio-economic context and the nature of the envisaged campaign.

In addition to considering the above-mentioned six elements of a cybersecurity awareness campaign [13], we also consider aspects such as the South African political and socio-economic realities and its national cybersecurity posture to derive requirements. Based on our assessment of the noted elements and aspects, the inter-related requirements to which the cybersecurity awareness campaign should comply are as follows:

1) The broadest feasible target group should be reached and aimed at the spectrum of the population which stands to benefit the most.

2) Because the target audience should be broad, the campaign should allow for some segmentation (i.e. be flexible in that it allows for some variation in topics and pitch-level to different audience sub-groups (such as scholars, students, blue collar workers, office workers and manual labourers).

3) The delineation of the target group should consider socio-economic realities such as South Africa's highly unequal income distribution and digital divide (See Sect. 4).

4) An innovative delivery method(s) and platform(s) capable of reaching a broad audience should be used.

5) The delivery method and strategy should incentivise the target audience's engagement.

6) The campaign should be cost effective and not be solely rely on government for financing.

Building on the requirements to which a broad-based cybersecurity awareness campaign should comply, the next section examines why the South African minibus taxi industry could be a game changer.

## 4 Why the South African Minibus Taxi Industry with a WiFi Offering Could Be a Game Changer

This section appraises why the South African minibus taxi industry as platform for a broad-based cybersecurity awareness campaign. Phrased differently, this section substantiates our contention that there are substantial grounds for our assertion that the taxi industry (with a WiFi offering to commuters) could change the cybersecurity awareness landscape. To this end we firstly demarcate the preferred (cyber security awareness campaign) target group and, secondly, describe the taxi industry as a potential platform for delivering the campaign.

As was noted in Sect. 3, the envisaged cyber security awareness campaign has, as first requirement reaching the broadest population group feasible. In addition, requirement 3 pertains to South African techno and socio-economic realities. Based on these requirements we contend that a broad-based campaign should favour lower-middle and low income groups as well as those with no direct income. (e.g. scholars, the unemployed, jobseekers and the poor). These groups are henceforth collectively referred to in the paper as the ‘target group’.
According to a 2019 estimate, this target group comprises 76% of the South African population [15]. The overwhelming part of the target group does not have fixed affordable Internet. It is estimated that only 10% of South African homes have fixed affordable Internet and that low income earners could pay up to 80 times more for Internet access than better earning citizens [16].

However, by virtue of smart phone ownership, most of the target group has a device to access the Internet. A recent Deloitte's [17] survey shows that smart phone possession in all income groups within South African exceeds 90%. Smart phone ownership in the lowest income group stands at 94% [17]. The relatively high cost of data, however, is a barrier to the target group accessing the Internet. While some cities, towns, communities and institutions host free WiFi services these offerings are predominantly localised and by no means service the whole of the target group. Consequently, there is a dire need in South Africa for low cost or free WiFi accessible to the majority of the population.

The target group, as described above, is very reliant on public transport in the form of minibus taxis (hereafter refer to as the 'taxi industry'). This industry's estimated 200 000 taxis accounts for "75% of all daily transport – about 15 million commuter trips daily to work, schools and universities, to access healthcare or for leisure" [18]. In addition to local services, longer-distance services are also provided. The majority of commuters favours taxis, over less expensive buses and trains, because they deliver a more effective and efficient service [18]. For the most part, taxi operators belong to taxi associations [19]. Those associations, which are granted certain routes by South African government authorities, have formal leadership structures [19]. Such associations exist on the national, provincial, regional and local/primary taxi level. While the taxi industry and some associations have been marred by (sometimes violent and deadly) competition, these associations nonetheless provide nodal points of engagement with the industry on TICAC.

To the best knowledge of the authors, there currently are no coordinated free WiFi offerings that use the taxi industry as platform. Consulted literature made no mention of such offerings. With the qualification that it is a supposition to be tested with further research, we assume current WiFi offerings of any kind by the minibus taxi industry in South Africa to be at best very rare. As far we could ascertain there is a near void in this regard. Linking a Free WiFi offering (with imbedded cybersecurity awareness campaign elements) would thus constitute an innovative proposition incentivising both industry participation and target audience's engagement. Once again with the qualification that it is a contention requiring further research, the combination of the tax industry's expected buy-in and the envisaged high-level of uptake by a broad target audience would present attractive advertising prospects to profit-driven business entities. Practically, such advertising (by for example cellular service providers) could take the form of at least the partial sponsoring of data and devices. While private sector sponsoring alone would not necessarily fully fund the envisaged cybersecurity awareness campaign, it could contribute significantly to its cost-effectiveness and affordability. With government's financial support a free WiFi offering would be realistically achievable.

Based on the foregoing analysis of some potential role-players (taxi industry and business entities) and the target group, it can be concluded that the taxi industry with
a sponsored, free WiFi offering could potentially be a cybersecurity awareness game changer.

Measured against the criteria stated in Sect. 3, the proposal on the taxi industry's utilisation thus satisfies requirements 1, 3, 4 and 6. The proposition we advance in Sect. 6, will show the proposal to also meet requirements 2 and 5 (as stated in Sect. 3). Since it could be of value in the design of our proposition on the taxi industry as a game changer, the next section reviews international research of possible relevance in the use of public transport for cybersecurity awareness.

# 5 International Experience: The Use of Public Transport for Cybersecurity Awareness

The previously stated aim of the literature review was to identify published academic research with regard to the utilisation of public transport for cybersecurity awareness. For this purpose, a search with the string “cybersecurity awareness through mobile platforms on public transport” was done on the following platforms: Scopus, EBSCO, Institute of Electrical and Electronics Engineers (IEEE) Explore, Springer Link, and Google Scholar. The addition of further search terms such as “taxi(s)” and “minibus taxi/s”, and the utilisation thereof in various combinations - with the terms cited in the section’s introductory sentence – also rendered very limited existing research directly relevant to TICAC’s configuration.

In fact, at the time of the literature review, no published works could be found that expressly note the implementation and/or drive of cybersecurity awareness initiatives through mobile platforms utilising the public transport/taxi industry as a focus area for awareness content delivery. However, broadening the search parameters by adding the words “digital” and “advertising” to the search string, yielded numerous publications with regard to the successful utilisation of mobile advertising and other digital displays. These publications focus on past and current research on advertising methods, ideas and toolsets utilising mobile platforms within public transport.

In respect of digital advertising, Evans, Moore & Thomas [20] found that the “rapid expansion of wireless technologies has provided a platform to support intelligent systems in the domain of mobile marketing”. Qin, Zhu, Lu, Xue & Li [21], as a further example, researched the optimisation of mobile advertising in “vehicular networks” such as taxis and busses. Using “extensive simulations” based on “three real data sets of taxi and bus traces” Qin et al. [21] assert that certain mobile methods/tools can “greatly improve the coverage and the intensity of advertising”.

It stands to reason that a mobile cybersecurity awareness campaign shares similarities with a mobile platform advertising campaign. Therefore, it is highly plausible that some mobile advertising's methods and toolsets can be adapted to a taxi-based cybersecurity awareness campaign in South Africa. This will require much further research and development - which falls outside the paper's aim to advance a high-level conceptual proposal.

To summarise, while the literature review did not find existing research on the use of public transport for cyber security awareness per se inferring from mobile advertising research, it does however support the feasibility of a based cybersecurity awareness campaign using a mobile platform.
## 6 How Can the South African Minibus Taxi Industry Be a Game Changer?

Building on the preceding sections, we now proceed to advancing a high-level, conceptual proposal on how the South African minibus taxi industry could be utilised as a game changing broad-based, mobile cybersecurity awareness campaign.

The aim is to provide contours that can guide further research and the engagement of role players. Given its nature (high-level concept) and aim, the proposal is generic and does not mention specific government institutions or private sectors entities.

Our proposal is premised on the necessity for functional public private partnerships. As with national cybersecurity in general, the Taxi Industry Cybersecurity Awareness Campaign (TICAC) needs to a joint venture between government and the private sector (taxi industry, content/application developers and other business entities - notably cellular services providers). TICA's success will depend on synergy between these role-players in taking up the opportunity to drive, implement and mature this cybersecurity awareness initiative. In short, the South African minibus taxi industry can only be a game changer through a collective effort involving all four categories of role players. The four categories of role-players and some tentative ideas on the respective functions, is graphically depicted in Fig. 2 on the next page below.

<figure><img src="image_4.png" /><figcaption>Fig. 2. High-level outline of a Taxi Industry Cybersecurity Awareness Campaign (TICAC)</figcaption></figure>

The core concept, as per Fig. 2, can be expanded with a combination of the following aspects:
* Sponsored secure WiFi offerings to commuters:

* Providing an extra enticement (in the form of free data), as an incentive to utilising their taxi service,

* Ensuring a platform through which a large contingent of the (online) population can be engaged to receive awareness content w.r.t. cybersecurity.

* Sponsored secure content development (such as films, animation or games):

* Primarily for the utilisation on mobile platforms within the taxi industry for cybersecurity awareness purposes,

* Once the initial infrastructure is established and implemented, the bouquet of content can be expanded and/or matured to free education and training content for students on the move.

* Sponsored secure delivery mechanism development, such as:

* Secure web based login before data or internet services can be utilised by a commuter,

* Mobile device vulnerability assessment and free security implementation options to commuters, and

* Continuous threat monitoring and mitigation.

* Government support services, such as:

* Policy development that could include encouragements for participating companies, such as tax and/or other incentives,

* Coordination,

* Assistance with, and or funding of content development,

* Impact/success rate assessment, and

* Client feedback.

Our research found several existing solutions (in a fast growing list of applications and services) that are currently available and utilised for mobile (and other) cybersecurity education and awareness purposes. A study conducted by Zang-Kennedy & Chiasson [22] identifies 119 tools, 54 digital games as well as 34 films and animation for "educating users about cybersecurity and privacy". The same study found digital games to be the most widely used type of tools and identified five web-based games that are also available as mobile applications. Which of these solutions would be most suitable to the South African context would of course require further research.

This section outlined a proposition on TICAC and observed on applications and services available and utilised for mobile (and other) cybersecurity education and awareness purposes. The next section draws on existing research to identify some initial security considerations that should be noted in configuring TICA.
# 7 Initial Security Considerations

Security in the design, implementation, operation and maturing of TICAC is of course of paramount importance. Implementing such a campaign in an unsecure manner will in a very real sense defeat the purpose of cybersecurity awareness. The broadening of our literature review to public WiFi security and the maturing of cybersecurity awareness campaigns more generally, did render aspects of value. This being a high-level proposal, only brief reference can be made to the following three inter related security aspects for consideration in configuring TICAC, namely (i) the socio-technical nature of cybersecurity, (ii) WiFi networks' vulnerability to exploitation and the cybersecurity paradox, and (iii) the need for TICAC's progressive maturing.

## 7.1 Socio-Technical Nature of Cybersecurity

Countless studies and incidents have showed humans to be the weakest link in the cybersecurity chain [23, 24]. This underlines the concern that it cannot be left up to TICA's target audience to securely connect to the convenience of free Wifi/data typically trump security considerations.

Breitinger [24], for example, found that within a specific area 78.7% of people not only access public unsecured WiFi networks, but did so means of automatic connection. As aptly phrased by Leuprecht, Skillicorn, & Tait [23] "The way humans and technology interact, blurs and dissolves the concepts of being 'inside' or 'outside' a cybersecurity space". Even more so because it is intended for a developing country with deficient cybersecurity awareness (see Subsect. 2.4), TICAC's secure design and implantation should therefore duly consider the human factor and the status of South Africa's cybersecurity awareness.

## 7.2 WiFi Networks' Vulnerability for Exploitation and the Cybersecurity Paradox

Public WiFi is not only particularly vulnerable to exploitation by adversaries (such as criminals), but can also be used by governments for surveillance purposes [25, 26]. In this regard, Leuprecht, Skillicorn & Tait [24] observe on the "paradox" in that "governments want to ensure cybersecurity, but at the same they want access to the data of individuals and organizations for surveillance purposes". In expanding this paradox "governments want companies and citizens to protect themselves, but ... do not want them to use encryption and other cybersecurity measures, as this might allow terrorists and criminals to hide their traces" [24].

Consequently, "governments thus often attempt to balance good and evil by allowing encryption but requiring backdoors" to remotely access the encrypted devices. Such backdoors can also be exploited by others and merely shift cybersecurity threats from the front door elsewhere" [24].

Since the TICAC is essentially a joint venture between government and the private sector - with a free public WiFi offering at its core - addressing the security challenges noted in this paragraph is imperative but complex.
## 7.3 The Need for TICAC's Progressive Maturing

RICAC's secure and success implementation will depend on the following of a well-formulated maturity process involving all role-players. Oxford CMMs' [1] five stages of maturity for building cybersecurity awareness serve as an example. These stages range from "Start-up" scenario where the need for cybersecurity awareness "is not recognised or is only at initial stages of discussion"; to the "Dynamic" Scenario in which a country "creates new regional/international cybersecurity awareness-raising programmes that contribute to .... international awareness-raising."

By highlighting initial security considerations, this section completed our high-level outline of TICAC. The next section concludes the paper by summarising our findings and observing on areas for further research.

# 8 Conclusion

This paper examined the South Africa's taxi industry as a potential cybersecurity-awareness game changer. The research we conducted resulted in three primary findings. Firstly, there is a dire need for a broad-based cybersecurity awareness campaign in South Africa. Secondly, the taxi industry was found to be indeed a potential game changing platform (for the rollout of a broad-based cybersecurity awareness campaign). Thirdly, we found that a TICAC will have to have, at its core, a joint venture between government and the private sector (taxi industry, cellular services providers, other business entities and content/application developers). The high-level proposition on TICAC we then advanced was qualified as a tentative, conceptual outline requiring much further research. As an immediate priority, such further research will be aimed at determining the views of identified role-players on the feasibility and configuration of a TICAC (See Fig. 2). A related immediate priority research priority relates to the difficulties and challenges pertaining to the government-private sector partnership so vital to TICAC's success. It is imperative that these challenges and viable solutions be identified and described. In addition, further research will focus on identifying cyber security awareness tools and applications most suitable to a TICAC. Taking a broader view, the pertinence and viability of a TICAC in developing countries, other than South Africa, presents another promising research area.

## References

1. International Telecommunication Union (ITU): Global Cybersecurity Index 2020. https://www.itu.int/epublications/publication/global-cybersecurity-index-2020/en/. Accessed 11 Nov 2021

2. BusinessTech: South Africa is a playground for cyber criminals – here are the scams to be aware of (2021). https://businesstech.co.za/news/technology/531640/south-africa-is-a-playground-for-cyber-criminalsf/. Accessed 29 Nov 2021

3. Interpol: The African Cyberthreat Assessment Report 2021 (2021). https://www.interpol.int/content/download/16759/file/AfricanCyberthreatAssessment_ENGLISH.pdf. Accessed 9 Dec 2021
4. ITU: Digital trends in Africa 2021: Information and communication technology trends and developments in the Africa region, 2017–2020 (2021). https://www.itu.int/pub/D-IND-DIG_TRENDS_AFR.01-2021. Accessed 11 Nov 2020

5. Microsoft: New insights on cybersecurity in the age of hybrid work (2021). https://www.microsoft.com/security/blog/2021/10/27/new-insights-on-cybersecurity-in-the-age-of-hybrid-work/. Accessed 2 Dec 2021

6. Bada, M., Von Solms, B., Agrafiotis, I.: Reviewing national cybersecurity awareness in Africa: an empirical study. In: 3rd International Conference on Cyber-Technologies and Cyber-Systems, Athens, Greece (2018)

7. Olalelec, D.: Top 10 leading African countries in Global Innovation Index 2020. Technology (2020). https://technology.ng/2020/09/top-10-leading-african-countries-in-global-innovation-index-2020/. Accessed 13 Oct 2021

8. Chigozi, E.: The Top Ten Most Technological Advanced Countries in Africa. AnswersAfrica (2020). https://answersafrica.com/top-10-most-technologically-advanced-countries-in-africa.html. Accessed 1 Dec 2021

9. Statista: Number of mobile internet users in South Africa from 2016 to 2026 (2021). https://www.statista.com/statistics/558867/number-of-mobile-internet-user-in-south-africa/. Accessed 11 Dec 2021

10. Accenture: Insight into the cyber threat landscape in South Africa (2020). https://www.accenture.com/_acnmedia/PDF-125/Accenture-Insight-Into-The-Threat-Landscape-Of-South-Africa-V5.pdf. Accessed 9 Oct 2021

11. Bischoff, P.: Which countries have the worst (and best) cybersecurity? CompaSystems (2021). https://www.comparitech.com/blog/vpn-privacy/cybersecurity-by-country/. Accessed 29 Nov 2021

12. Mimecast: State of Email Security Report – 2021 (2021). https://www.mimecast.com/global-assets/documents/ebook/state-of-email-security-report-2021.pdf. Accessed 12 Dec 2021

13. Dlamini, Z., Modise, M.: Cyber security awareness initiatives in South Africa: a synergy approach. In: 7th International Conference on Information Warfare and Security, University of Washington, Seattle, USA (2012)

14. Mashiane, C.T., Dlamini, I.Z., Mahlangu, T.: A rollout strategy for cybersecurity awareness. In: Proceedings of the 14th International Conference on Cyber Warfare and Security, Stellenbosch, Cape Town, South Africa (2019)

15. Mamacos, E.: Is-your-family-poor-middle-class-or-rich. News 24 (2019). https://www.news24.com/parent/family/relationships/is-your-family-poor-middle-class-or-rich-take-this-test-and-find-out-20190821. Accessed 12 Dec 2021

16. Malaba, K.: How is South Africa's digital divide making inequality worse in the country? Global Citizen (2021). https://www.globalcitizen.org/en/content/south-africa-digital-dividend-makes-inequality-worse/. Accessed 2 Jan 2022

17. Deloitte: Global Mobile Consumer Survey 2019- South Africa Cut. https://www2.deloitte.com/content/dam/Deloitte/za/Documents/technology-media-telecommunications/za-GMCS-2019-final-report.pdf. Accessed 30 Nov 2021

18. Fobosi, S.: South Africa's minibus taxi industry has been marginalised for too long. https://theconversation.com/south-africas-minibus-taxi-industry-has-been-marginalised-for-too-long-this-must-change-142060. Accessed 12 Dec 2021

19. Daily Maverick: Cocked and 100% loaded: Taxi industry calls the shots (2020). https://www.dailymaverick.co.za/article/2020-07-14-cocked-and-100-loaded-taxi-industry-calls-the-shots/. Accessed 11 Nov 2021

20. Evans, C., Moore, P., Thomas A.: An intelligent mobile advertising system (iMAS): location-based advertising to individuals and business. In: 6th International Conference on Complex, Intelligent, and Software Intensive Systems (2012). https://doi.org/10.1109/CISIS.2012.24
21. Qin, J., Zhu, Y., Zhu, H., Lu, L., Xue, G., Li, M.: POST: exploiting dynamic sociality for mobile advertising in vehicular networks. IEEE Trans. Parallel Distrib. Syst. 27(6), 1770–1782 (2016). https://doi.org/10.1109/TPDS.2015.2467392

22. Zhang-Kennedy, L., Chiasson, S.: A systematic review of multimedia tools for cybersecurity awareness and education. ACM Comput. Surv. 54, 1 (2020). https://doi.org/10.1145/3427920

23. Leuprecht, C., Skillicorn, D., Tait, V.: Beyond the castle model of cyber-risk and cyber-security. Gov. Inf. Q. 33(2), 250–257 (2016). https://doi.org/10.1016/j.giq.2016.01.012

24. Breitinger, F., Tully-Doyle, R., Hassenfeldt, C.: A survey on smartphone user's security choices, awareness and education. Comput. Secur. 88, 101647 (2020)

25. Dunning, J.P.: Taming the blue beast: a survey of Bluetooth based threats. IEEE Secur. Priv. 8, 20–27 (2010). https://doi.org/10.1109/MSP.2010.3

26. Fuller, J.: How bluetooth surveillance works. How Stuff Works (2008). https://electronics.howstuffworks.com/bluetooth-surveillance.htm. Accessed 5 Jan 2022

27. Oxford Global Cybersecurity Centre: Cybersecurity Capacity Maturity Model for Nations (CMM) (2021). https://gcscc.ox.ac.uk/the-cmm. Accessed 13 Jan 2022