"Ward List" iPhone App

There is a new applicationin the Apple app store that has caused me some concern which I'd like some input on from the LDS tech community. It claimsto allow Bishoprics to upload the data from MLS to their server for use by members of the ward that have the unit number and password (set by the Bishopric). They claim to have addressed matters like security, but this goes beyond carrying ward list information on a PDA (which is widespread) to having information, including membership numbers, birthdays, etc, uploaded to a third-party website. My question/concern is that many wards are implementing this, because of its utility, but are putting at risk the information of many members in the church.

I'm asking because our Bishop wants to implement this and asked me (as his counselor) what I thought of it. I told him that I wanted to get more information from the company, and sent an email. However, the biggest question isn't how secure they make the data, but is it correct practice to upload MLS information to their database server?

I can imagine what the church would say about it, but I wonder if there is already a policy in place.

--Michael

In the Security section of the Policy and Guidelines for Computers Used by Clerks for Church Record Keeping it states:

Information stored on computers concerning members, donations, and financial transactions is confidential and should be protected from unauthorized disclosure.

The Church Handbook of Instructions (CHI), book1, p 150, states the policy on confidentiality of records.

In post #8 of the Ward Mapsthread in the Unit Web Sitesforum, Tom Welch, the Technology Community Manager for the Church, responded with information that is very similar to what you are asking.

Based on the discussions in several threads where member privacy information is beyond the control of the Church, such as storage on a third party server, the best course of action is to not use MLS data for what you describe.

For further guidance consult with your stake president.

jdlessley wrote: Based on the discussions in several threads where member privacy information is beyond the control of the Church, such as storage on a third party server, the best course of action is to not use MLS data for what you describe.

It sounds like from these discussions that this particular utility should not be used because it uploads ward member data to a third-party server. There are several utilities that create local HTML files that are similar, but because they are kept local to the units, they are approved for use.

The next question is, should someone from the church contact the makers of this app and ask them to discontinue marketing this product? I know that there are many units who are using it already.

Thank you for the links to the appropriate policies.

Mr.Intel wrote:It sounds like from these discussions that this particular utility should not be used because it uploads ward member data to a third-party server. There are several utilities that create local HTML files that are similar, but because they are kept local to the units, they are approved for use.

The next question is, should someone from the church contact the makers of this app and ask them to discontinue marketing this product? I know that there are many units who are using it already.

Thank you for the links to the appropriate policies.

We will contact the developer about this.

MLS provides an export of data for those authorized to use on their personal devices (PC's, PDA, etc.) for official Church work only. That data is to be kept secure at all times. However the Church does not approve of uploading that data to a non-church site, no matter how secure it is. There may be privacy laws that may inadvertantly be violated.

Tom

It may be worth pointing out that the reason why these kinds of applications keep popping up is that the existing export model is not meeting many people's needs.

If the the demand for things like this were satisfied by the existing authorized Church solution, the Church wouldn't have to play "whack-a-mole" with every one of these projects as they pop up.

njpomeroy wrote:It may be worth pointing out that the reason why these kinds of applications keep popping up is that the existing export model is not meeting many people's needs.

If the the demand for things like this were satisfied by the existing authorized Church solution, the Church wouldn't have to play "whack-a-mole" with every one of these projects as they pop up.

I don't think the issue is the export model -- these applications are using the exports from MLS, and independent developers are doing some cool things with that data.

Rather, the issue is taking proper security and privacy precautions with this exported data. That's why the Church is so concerned (rightly so, in my opinion) about anyone uploading this data to any third-party servers. But on a properly secured Church-owned administrative computer there is no problem running applications that do not communicate that data over the Internet.

The Church will never be able to satisfy all the requests for features and applications. One of the main reasons for this site and the companion wiki is to collaborate on the development of applications that extend the Church's software offerings, and to discuss other independent efforts. But all these efforts need to take care to preserve security and privacy of confidential membership data.

I also believe that the Church would like to see a number of common administrative Church tasks and duties brought to the web somehow. In my opinion, this would begin to make MLS exports unnecessary as there are so many ways to access the web from a mobile device now.

On one hand, as an iPhone owner I don't see the need for such an app since I regularly access my ward's directory via iPhone's Safari and the LUWS.

On the other hand, the usefulness of the LUWS could definitely be enhanced to be less obtuse and to provide more useful features, not only for iPhone users, but for other Internet users as well.

jbh001 wrote:On one hand, as an iPhone owner I don't see the need for such an app since I regularly access my ward's directory via iPhone's Safari and the LUWS.

On the other hand, the usefulness of the LUWS could definitely be enhanced to be less obtuse and to provide more useful features, not only for iPhone users, but for other Internet users as well.

As an iPhone user, who is consistently asked for members phone numbers from other members, and is part of a highly dynamic ward, having access to an "update on demand" database is highly useful. Safari is great and all, but it takes on the short end two minutes to login to the church's website, and start browsing the membership lists.... and that's on wireless. 3G is about five minutes, and EDGE is 'forget about it'.

There are also other needs, too. Bishoprics and other ward leaders need to have access to home and visiting teaching routes, stake leadership information, and more. Having this information always with you is beneficial like having the internet is beneficial to family history work.

The issue isn't that the church is holding out on the increasingly tech-savvy members. The issue is that there is a way for members to change "the way things have always been done" to better and more efficient methods without making sure to safeguard the data like the church does.

As an aside, there is a new app called "iWard" that allows members to import data from the LUWS with their individual logins. As far as I can tell, the data is sent over the internet just as if it were coming into a browser, only stored on the iPhone for later use. [Editor's note by Alan_Brown: Any discussion of iWard should be continued on the "iWard" iPhone App thread).]

Mr.Intel wrote:The issue isn't that the church is holding out on the increasingly tech-savvy members. The issue is that there is a way for members to change "the way things have always been done" to better and more efficient methods without making sure to safeguard the data like the church does.

The Church does the things the way they do to make sure the data is safeguarded. Using any personal privacy data without regard to securing it exposes the user and the Church to legal action.

I am all for more efficient ways of accessing data - even ward and stake membership directories. Using any application that gets the membership information from the LUWS still obligates the user of that data to protect that data in accordance with Church policies.

As a bishop, I need to get sundry info on any member in my ward at any time. I'd prefer not to carry my big binder with the 90page report where anyone could take it and look at it. The MLS data base would be much safer in my iPhone than in my binder and much more portable and accessible.
I currently have the MLS on my iPhone in HTML format which is ridiculously large. A native app would be much better that has encryption and password protection.

C.H.I. 2006, bk.1, p.151. "Many countries have enacted data privacy laws. These laws regulate the processing of personal data, such as the information contained in membership records or other records that identify individuals. To determine the extent to which such laws govern local management of Church records or to obtain direction in specific instances, local Church leaders should consult either (1) membership records personnel at the administration office or (2) the data privacy officer at the following e-mail address: dataprivacyofficer@ldschurch.org "

tomw wrote:We will contact the developer about this.

MLS provides an export of data for those authorized to use on their personal devices (PC's, PDA, etc.) for official Church work only. That data is to be kept secure at all times. However the Church does not approve of uploading that data to a non-church site, no matter how secure it is. There may be privacy laws that may inadvertantly be violated.

Tom

Tom, we contacted the "developer" of Ward List just the other day and got the following response. Can you give us an update on what happened and also, confirm that we should not be uploading MLS information to their web site?


From: Ward List [mailto:wardlist@teknonsys.com]
Sent: Tuesday, April 21, 2009 12:44 PM
Subject: Re: Church approval

The church does not approve or disapprove any such apps. They do, however, include the export function in MLS specifically for apps such as Ward List. The only stipulation is that the files be password protected. If you have questions about whether or not to use such a tool, you should consult with your Bishop and/or Stake President.

Having said that, let me assure you that the data is, in fact, secure. It cannot be accessed without the combination Unit Number and Password that you specify when converting the data. We also have an update (version 1.2.0) that is awaiting app store approval right now. We expect it to clear by the end of the week. This update give a little bit more security. Data is sent to specific devices (encrypted on the server as an intermidiary). Once the device has downloaded the database, it is removed from the servers and cannot be accessed again.

Let me know if you have any more questions.

Dave Yorke
Teknon Systems, LLC

BradWeech wrote:Tom, we contacted the "developer" of Ward List just the other day and got the following response. Can you give us an update on what happened and also, confirm that we should not be uploading MLS information to their web site?

Tom has stated more than once on these forums that uploading MLS export files (and any other type of sensitive Church data) to third-party servers not hosted by the Church is requested to be discontinued. He has never waivered on this request and it hasn't changed for 2 years. That policy is still in effect and will be unless he or another Church representative say otherwise. If you want me to cite these posts by providing links, I can do so. One such post is in this thread. In addition to all of this, Tom specifically stated that legal privacy laws (not just Church policy) could be violated by using an import feature like Ward List has.

Dave is mistaken in stating that the export function in MLS is included "specifically for apps such as Ward List." Ward List is hosted online on a third-party server; no matter how secure it is, the Church does not approve of uploading MLS export files to such services. If Ward List were ported to a desktop application where you as the user could personally ensure of its security and keep it from being distributed, then this would be a different matter entirely. Tom specifically stated what the intent of the export functionality of MLS was intended for when he said the data is "for those authorized to use on their personal devices (PC's, PDA, etc.) for official Church work only."

I'm in no place to comment on any conversation or resolution that may have taken place (or has yet to happen) between the Church and the developer(s) of Ward List.

Hope this helps.

I find it interesting the ward list site does not post a privacy policy for members to read. It is also interesting that they do not provide any details of how they maintain the integrity and security of the data. Protection by password is ridiculously weak!

Members beware!!

mkmurray wrote:Dave is mistaken in stating that the export function in MLS is included "specifically for apps such as Ward List."

I think the problem there is that so far this policy has only been communicated via tech.lds. Following other lines of communication could cause one to arrive at a different conclusion.

We have contact the developer as well and asked for the process of uploading data from MLS to their site be discontinued. If people can figure out how to get the information to the iPhone without having to go through an intermediary server, that would be great. I can envision an iPhone app that embeds a browser and then grabs the data from the browser window and stores it.

It is always hard to ask someone who has done some fantastic work to stop doing that work. Fortunately, and hopefully, this project could find it's way into the new community Local Unit Website application.

Tom

tomw wrote: I can envision an iPhone app that embeds a browser and then grabs the data from the browser window and stores it.

This is essentially the technique used by the "iWard" iPhone App (and the companion iStake app as well).

tomw wrote:I can envision an iPhone app that embeds a browser and then grabs the data from the browser window and stores it.

I don't understand this at all.

A browser-based scraper would be kludgy, but not that hard to build technically , at least until an undocumented web page is redesigned. Except, of course, MLS is not a browser-based client anyway. This could be done for LUWS.

There also are Windows scripting methods that can be used to drive apps via the screen. Again, kludgy but still automated.

If all someone wants to do is populate an iPhone app from MLS, and the user has authorized access to MLS export files, the developer just need to build an iPhone app that loads those files.

However, as a policy matter, I have a hard time distinguishing a browser/scraper app or script that automatically extracts data from a Church system from another app that just automatically loads csv exports or exported reports. Either way, an automated process to populate a third-party server would seem to cross the same line.

boomerbubba wrote:I don't understand this at all.

A browser-based scraper would be kludgy, but not that hard to build technically , at least until an undocumented web page is redesigned. Except, of course, MLS is not a browser-based client anyway. This could be done for LUWS.

There also are Windows scripting methods that can be used to drive apps via the screen. Again, kludgy but still automated.

If all someone wants to do is populate an iPhone app from MLS, and the user has authorized access to MLS export files, the developer just need to build an iPhone app that loads those files.

However, as a policy matter, I have a hard time distinguishing a browser/scraper app or script that automatically extracts data from a Church system from another app that just automatically loads csv exports or exported reports. Either way, an automated process to populate a third-party server would seem to cross the same line.

There are a few advantages to the approach of scraping data from LUWS over MLS export files:

• The data can be updated frequently very easily, with no interaction with MLS -- the iPhone only needs its normal Internet connection to connect to LUWS.
• The data can be obtained by any member of the stake, without needing to request export files from a ward/stake clerk (which he certainly shouldn't give regular members anyway because of the confidential information in the export files).
• The data is downloaded to the iPhone over https, using the same security that is used by stake members to view LUWS in a browser.
• The data doesn't reside on a third-party server -- it just resides on the iPhone, which can be password protected to comply with standard Church policy regarding PDAs.

Of course the data from LUWS is not nearly as complete as the MLS export data, so priesthood leaders may well want an iPhone app that uses MLS export files. But the advantages above are certainly compelling for the basic data (and have the added advantage that iPhone apps exist right now that can do this).

Alan_Brown wrote:There are a few advantages to the approach of scraping data from LUWS over MLS export files...

I will confirm however that it feels..."hacky" to scrape the data off LUWS. You feel like the code you write today could be broken if they change HTML structure tomorrow. It just doesn't feel reliable enough. I wrote some LUWS scraping code half a year ago. In the next week or two, I'm about to dust off that code and make sure it still correctly scrapes the data in order to get it ready to deliver to the community as a utility they can use.

So is the overall conclusion of this not to use the ward list iPhone App?

jpa wrote:So is the overall conclusion of this not to use the ward list iPhone App?

Correct, because of the 3rd-party server issue. But iWard, iStake, and Ward Tools do not have 3rd-party server issues and are thus okay to use.

I thought that I would share with the forum a response that I received from the developer of the Ward List App by email. I inquired about security and church policy. Here is the response.

There are three methods of getting data from the computer to the iPhone:

1. General Upload: The data is encrypted and sent to the server. It remains on the server so it is always available for download by the iPhone
2. Device-Specific Updates: The data is still encrypted and sent to the server, but it is deleted once the iPhone downloads it. Only the specified iPhone can download the data.
3. Direct Upload: The data is sent directly to the iPhone and never sent to any servers.

It should be noted that while it is hosted on a third-party server, it is not publicly accessible. It can only be downloaded by the iPhone app and only then with the unit number and password specified when running the converter. Because of this, we maintain that this is still the most secure method of getting data from the computer to the iPhone. It is certainly much more secure than sending the CSV files via email or saving them to a USB disk. For that reason, most units choose to use the server methods. For those who do no feel comfortable sending their data to the server, the direct upload method is provided and does not involve any servers. I hope this answers any questions you have about the process.

Dave Yorke
Teknon Systems, LLC

It sounds like option three is similar to what the Ward Tools App does and requires a wireless network which not many wards have. Option two sounds better than option one since he states that the data is deleted from the server after being downloaded to the iPhone and you can specify which iPhones receive the download.

Would using the wireless option be okay? What about option two?

Thanks.

jpa wrote:Would using the wireless option be okay? What about option two?

I am not a representative for the Church in any way and this will all be my own personal thoughts.

From conversations I have had with Church employees, I get the impression that they are in a dilemma when trying to answer questions like these. The Church loves to encourage such ingenuity and creativeness whenever it is found. However, they also have to error on the side of caution whenever possible. When it comes to data about fellow Ward Members, they want us to be cautious and prudent. They are many legal issues worldwide when dealing with the privacy of Church members, and it varies greatly in restrictiveness from country to country.

I will give you the "policy" as it has been relayed to all of us here in the Community by Church employees...

The Church has given us guidance (here on the forums, but not publicly announced beyond that) that they would prefer we do not take ward data regarding members and upload it to a non-Church hosted server. There were no requirements for security given that serve as an exception to that guidance.

Now, with that being said, I do know that it is difficult for Church employees to answer requests for a blanket, public policy that covers all situations. It has been admitted that if such guidance is pushed to be made official and binding, it will always land on the side with extreme caution. Again, the dilemma for them is that they don't want to just blindly squash all innovation.

So, in conclusion, and with all of that being said, my advice is to take this guidance that has been given to heart and follow the "spirit of the law" in the best way you know how. Seek personal inspiration and make as best an informed decision as you can. If necessary, seek counsel from your local priesthood leaders whether they feel it is appropriate use of membership info. I am most certainly not advocating a "do it and ask for forgiveness later" mentality. But if we as a Community push for a concrete policy, it is likely it will end up more restrictive than it currently is.

I hope my personal thoughts will prove helpful and explain the hesitancy by Church employees and other Community members to give a solid Yes or No answer.

jpa wrote: It sounds like option three is similar to what the Ward Tools App does and requires a wireless network which not many wards have. Option two sounds better than option one since he states that the data is deleted from the server after being downloaded to the iPhone and you can specify which iPhones receive the download.

Would using the wireless option be okay? What about option two?

I don't understand option three. The vendor's email does not actually mention wireless, and there is nothing on the Teknon Systems web site that documents this option. If option three does use local WiFi like Ward Tools for iPhone does, the Ward List web siteneeds to be updated.

As for option two, it still uses a third-party server, which is what church guidelines forbid. The issue is not that the Ward List method is inherently insecure, but rather that it violates the guidelines per se.

tomw wrote:However the Church does not approve of uploading that data to a non-church site, no matter how secure it is. There may be privacy laws that may inadvertantly be violated.

After that statement, I don't see how option 1 or 2 are still viable options. Unless the server in question is owned by the Church, is it not an approved method regardless of how secure that server might be.

I expect that as LUWS gains more features, I wouldn't be surprised to see the ability to export MLS files disappear altogether from future versions of MLS (or for MLS to disapper altogether). This would mean that apps similar to iWard/iStake would become the only method of getting this info to the iPhone/iPod Touch, short of a lot of cumbersome, tedious, and frequent manual entry.

jbh001 wrote:I expect that as LUWS gains more features, I wouldn't be surprised to see the ability to export MLS files disappear altogether from future versions of MLS (or for MLS to disapper altogether). This would mean that apps similar to iWard/iStake would become the only method of getting this info to the iPhone/iPod Touch, short of a lot of cumbersome, tedious, and frequent manual entry.

I think there always will be a need for export files in some form, because the functionality of LUWS or MLS won't ever fill all the needs that custom developers do with this data.

I do agree that the architecture seems to be moving in a direction that would support online hosting of such export files on the church's own servers, with authenticated and secure download. But as far as we know, no such development is in plan yet.

The immediate threat to the export files is the new HT/VT application under development, which would destroy two of the current MLS export files without a replacement for units that choose to use it. At least the adoption of that application is optional.

boomerbubba wrote:I don't understand option three. The vendor's email does not actually mention wireless, and there is nothing on the Teknon Systems web site that documents this option. If option three does use local WiFi like Ward Tools for iPhone does, the Ward List web siteneeds to be updated.

I inquired about this with the Ward List vendor, and was told that this option does use local WiFi, so presumably it is within church guidelines. The vendor's website is out of date of this issue, and they promised to update it.

As for the other two options that do use a third-party server, Teknon apparently continues to offer and promote those methods, which seems like encouraging users to violate church guidelines.

Thanks for all of your comments.

Simple solution: have the church offer space on a server of theirs for Ward List to use for the general upload feature. No more "3rd party" server involved.