Request a clarification on usage of non-church owned websites

Brethren-

We would like clarification on what is permitted or not permitted.

There is a letter from the Presiding Bishopric dated December 13, 2004. The subject is Authorized Churct Web Sites.

It reads as follows:
-----
The Church has established a number of global Web sites and e-mail networks. There may also be Church-sponsored country or area Web sites, stake and ward Web sites on lds.org, and e-mail services for priesthood leaders and missionaries. These Web sites contain Church-approved content, meet the legal requirements of copyrights and privacy, and can be recognized by the presence of the Church logo. No other sites are authorized.

This restriction includes but is not limited to temples, missions, visitors' centers, auxiliaries, quorums, classes, Scout units, and committees for special events. Any such Web sites or e-mail groups sjhould be discontinued immediately.

This is an update of the guidelines from the January 22, 2003, letter of the Presiding Bishopric, regarding stake and ward Websites.
-----

It is also attached in a PDF for reference.

So here are my questions:
1) Are there letters on this subject that further clarify or replace this one?

2) As I read this this is only limiting the use of public content websites correct? (Meaning this does not apply to non-content tools such as the secured and priviate sites such as the Scouting, Geneology, YM/YW websites, or Home Teaching websites?)

I would think given the nature of this website this would be an important clarification to have.

Any help would be appreciated as my Stake Presidency needs to have the most recent info to permit the use of these tools.

Thanks!

My understanding is there is to be no website that represents an official church unit or organization. So, no RS, YM, YW, Singles, etc. This doesn't prevent individuals from creating websites that have some specific interests - such as a website for RS sisters, or church teens, etc. But it can never become the "voice of" or officially tied to a ward or stake.

Obviously there are exceptions that are granted at the top level. Things like lds.org, FamilySearch.org, etc.

While some of the concerns about "local" websites disappears when they aren't public, I see nothing granting exceptions to sites that are closed to the public. "No other sites are authorized." sounds quite plain to me.

But since you are looking for an official answer, notice that this older letter dated 2001 is in the new STS section of lds.org. As such, it would be safe to consider it current policy. Also, ask your Stake President to consult the current version of the Church Handbook of Instruction. There's a good chance it's covered there. If your stake president still has questions, I suggest he call Church Headquarters.

RussellHltn,

I appreciate your thoughts on this as well as the link to the older letter. The Stake Presidency has referenced their manuals and it is just not clear enough for the masses. This prior letter was about discontinuing the use of local sites now that http://www.lds.org was up to speed.

The concern is that the Dec 13, 2004 letter talks about "no other sites authorized" as it relates to the usage of Church content. The really bad part is not everyone understands the context of the word "content" as it relates to the web.

If a non-technical person reads the letter they think they cannot use ancestry.com, scouting.org, ellisisland.com, and all the other web tools sites which are commonly used.

In summary, it is NOT that plain to the less technical people who have to interpret these letters.

P.S. There's should to be a July 1, 2005 letter on the subject of the internet as it relates to Family History Centers. Can you send me a link to that as well?

I'll give you a deep link to the Letters and Polices section for Stake Technology Specialists. No log in is required to find this section, it's open to anyone who browses the right way from the lds.org site. I'm sure you'll find many things of interest there.

As for trying to explain the existing letters: Keep in mind it's addressed to church units and telling them they can not have a website or email list. It is not addressed to Church members telling them they can not access any such site. Nor is it addressed to church members that they can not have personal websites that may be of interest to a given demographic.

In other words, the site can not represent an official organization at the stake or ward level. It can only represent individuals. At least that's my take on the subject. (Stake a ward sites within lds.org are an obvious exception.)

The obvious sites that are not allowed are any sites that imply any official statement, content, or views of the Church, sites that provide information that may be copyrighted by the Church or other individuals, sites that allow or encourage anyone to upload any membership data or confidential information. We will continue to work on refining this policy to be more specific.

Tom

Tomw-

We really need this clarified otherwise the use of commonly used sites (such as scouting.org, ymyw.org, etc.) are perceived as being in violation of church policy.

I would think this to be a higher priority given that it will undermine the innovation that beta.tech.lds.org is about.

enriquer wrote:Tomw-

We really need this clarified otherwise the use of commonly used sites (such as scouting.org, ymyw.org, etc.) are perceived as being in violation of church policy.

I would think this to be a higher priority given that it will undermine the innovation that beta.tech.lds.org is about.

I think Tom W. is saying that "Church content" mentioned in the letter is referring to official Church data that would come from MLS or similar systems. We should not export data from such systems and then directly upload them into a non-Church hosted server.

There is no violation in merely using sites like ancestry.com, scounting.org, ymyw.org, ellisisland.com, in the normal way (just as long as you are not uploading MLS data directly into these sites). Genealogical data, Scouting progress data, and YM/YW award progress data is not considered "Church content" (someone correct me if I'm wrong please).

The other intent of the letter is for local units not to create their own websites that attempt to officially represent the Church or some Church organization in any way. Obviously the sites you mention were not created by you, nor did the authors of the sites create them in an attempt to represent the Church in any official capacity. There were designed to merely help you with some task, like researching your ancestors, keeping track of scouting progress, etc. They are only helpful, supplementary sites, and not trying to be official Church sites.

mkmurray wrote:I think Tom W. is saying that "Church content" mentioned in the letter is referring to official Church data that would come from MLS or similar systems. We should not export data from such systems and then directly upload them into a non-Church hosted server.

There is no violation in merely using sites like ancestry.com, scounting.org, ymyw.org, ellisisland.com, in the normal way (just as long as you are not uploading MLS data directly into these sites). Genealogical data, Scouting progress data, and YM/YW award progress data is not considered "Church content" (someone correct me if I'm wrong please).

The other intent of the letter is for local units not to create their own websites that attempt to officially represent the Church or some Church organization in any way. Obviously the sites you mention were not created by you, nor did the authors of the sites create them in an attempt to represent the Church in any official capacity. There were designed to merely help you with some task, like researching your ancestors, keeping track of scouting progress, etc. They are only helpful, supplementary sites, and not trying to be official Church sites.

Until I get better clarification, I think this sums it up pretty clearly.

Tom

We had this question come in to our "Ask a Question" feature and got this answer from our correlation department.

Tomw / Mkmurray-

Hmmm....this is still not as clear as you would think. You see we really need a definition of what is deemed "content" by the Church. If you use the definition known to all of us in cyberspace it is the copyrighted material mentioned in that letter.

While we are at it we probably need the church's definition of "uploaded" too. Is uploaded a file upload or does it also mean keyed in?

So if ward members/leaders are to use the ymyw.org or scouting.org we have a problem. Because all of the informaiton they have does originate from the MLS system in one fashion or another.

enriquer wrote:While we are at it we probably need the church's definition of "uploaded" too. Is uploaded a file upload or does it also mean keyed in?

So if ward members/leaders are to use the ymyw.org or scouting.org we have a problem. Because all of the informaiton they have does originate from the MLS system in one fashion or another.

In my opinion, that's not entirely true. Just because a name and address is stored in MLS, doesn't mean I am restricted from putting my name and address on other non-Church websites. I can't think of any sensitive, personal data that is usually found only in MLS that would be asked for by ymyw.org or scouting.org.

mkmurray wrote:In my opinion, that's not entirely true. Just because a name and address is stored in MLS, doesn't mean I am restricted from putting my name and address on other non-Church websites. I can't think of any sensitive, personal data that is usually found only in MLS that would be asked for by ymyw.org or scouting.org.

Mkmurray-

I agree. However, Church policies as they are written now do not make the distinction that seems obvious to us.

This isn't really stated in any policy, but I think I will submit it to everyone for consideration and debate...

Perhaps one good point of policy could be that you should never upload somebody else's MLS data that is not your own onto a non-Church hosted server. So if you are taking your own MLS data and uploading it to a non-Church server, do you have that right to your own data about yourself? But you should never have that right over someone else's data. Basically what it boils down to is that you can submit your own personal information to another non-Church website/server, but you cannot take any bulk export out of MLS (other people's data) and put it on a non-Church server.

Tom W. has basically been saying this the whole time that you cannot export MLS data to a non-Church server. This seems like something that would help solve the question of what "Church content" is; what does everyone think (especially Enrique)?

I agree that exporting from the MLS database and uploading it falls under the policy. If the user inputs his own data then that is not covered, even if it is the same data under MLS.

stated in the policy "Discontinuation of Local Church Unit Web Sites

With this in mind, a policy for creation, operation and maintenance of local unit web sites is being developed and will be sent to Priesthood leaders.

I just want to know if this policy has been established?

Thanks!

Yes, the sites must be hosted by the church in the Local Unit Web Site (LUWS) system of lds.org. As of right now these are only available in the United States but is currently being updated to go to the international world.

I see no difference between uploading data from MLS and manually entering data that was acquired from MLS. Either action renders the exact same results.

I'm sure that whoever wrote the policy that prohibits uploading church data to websites would say that entering the data manually is also prohibited.

Brad O.

mkmurray wrote:Just because a name and address is stored in MLS, doesn't mean I am restricted from putting my name and address on other non-Church websites.

You are correct, but the question is, where does the data for Scouting or YM/YW originate from? Do they ask the members for it or does it come from reports that were printed from MLS? If I understand the purpose of these sites, it's to allow leaders to manage and organize their responsibilities. Just as you can't really have a HT/VT site without loading membership data on it, I don't know how you can have a site that manges Scouting or YM/YW without membership data. If these are "idea" with no data, then no problem.

Since there is a prohibition on uploading MLS data, it's hard for me to justify hand typing data from MLS reports.

My take on the situation is it's OK for you to enter data about yourself since you are giving permission to do so. But there is a concern if church leaders enter/upload data on members to non-church websites without the members' permission. To the extent that these sites can be used without entering data on other living people, by all means use the Scouting, Ancestry, YM/YW, HT/VT, etc sites.

RussellHltn wrote:My take on the situation is it's OK for you to enter data about yourself since you are giving permission to do so. But there is a concern if church leaders enter/upload data on members to non-church websites without the members' permission. To the extent that these sites can be used without entering data on other living people, by all means use the Scouting, Ancestry, YM/YW, HT/VT, etc sites.

Exactly what I wanted to say and I think the letter wanted to be understood.

RussellHltn wrote:Since there is a prohibition on uploading MLS data, it's hard for me to justify hand typing data from MLS reports.

My take on the situation is it's OK for you to enter data about yourself since you are giving permission to do so. But there is a concern if church leaders enter/upload data on members to non-church websites without the members' permission. To the extent that these sites can be used without entering data on other living people, by all means use the Scouting, Ancestry, YM/YW, HT/VT, etc sites.

Yes, this is exactly what I meant as well. Thank you for clarifying. I don't think it matters whether it is imported automatically or manually hand-typed, it is the same. You as an individual have no right to insert other people's sensitive MLS data onto a non-Church hosted server.

The key point I am trying to make is that just because my name and address are stored in MLS, doesn't mean I can't put it on some other non-Church site. But, I also don't have the right to put other names and addresses that are not mine onto a non-Church server.

mkmurray wrote:This isn't really stated in any policy, but I think I will submit it to everyone for consideration and debate...

Perhaps one good point of policy could be that you should never upload somebody else's MLS data that is not your own onto a non-Church hosted server. So if you are taking your own MLS data and uploading it to a non-Church server, do you have that right to your own data about yourself? But you should never have that right over someone else's data. Basically what it boils down to is that you can submit your own personal information to another non-Church website/server, but you cannot take any bulk export out of MLS (other people's data) and put it on a non-Church server.

Tom W. has basically been saying this the whole time that you cannot export MLS data to a non-Church server. This seems like something that would help solve the question of what "Church content" is; what does everyone think (especially Enrique)?

I just want to make sure everyone understands that I am a big proponent of innovation. However, the participants on this forum will be faced with these obstacles until the church publishes some clear definitions as to what is not permitted. So while I concur and value the opinions shared thus far this thread is really about obtaining some "official" definitions which are understandable by all (not just the techies.)

While I concur that data exported from any church system (aka MLS, or the membership directory on the ward websites) is "Church data" it is not "content" as understood by the technology community. Content is defined as a publication or document and in most cases is copywritted.

We also need to know what constitutes an "export" and "upload" in the eyes of the church. Does this mean outputing a report to a disk file, or cutting and pasting from the clipboard, or is it just limited to the export function of the application. The dictionary states that it is to output documents, data, etc. into a format usable by another software program. Does "upload" mean any transfer (via file or keyboard) of information or is it limited to the dictionary's definition to convey software, data, character sets, etc. from one computer to another.

So we need "official" clarifications on what is deemed "content", on whether "web apps" (like ymyw.org, scouting.org, etc.) are permitted for use, and how "export" and "upload" are defined.

In summary, until these "official" clarifications are intelligible to ALL our technology efforts will get tripped up by Priesthood leaders who read letters from the church and interpret them to say we are limited to using official church websites.

mkmurray wrote:Yes, this is exactly what I meant as well. Thank you for clarifying. I don't think it matters whether it is imported automatically or manually hand-typed, it is the same. You as an individual have no right to insert other people's sensitive MLS data onto a non-Church hosted server.

The key point I am trying to make is that just because my name and address are stored in MLS, doesn't mean I can't put it on some other non-Church site. But, I also don't have the right to put other names and addresses that are not mine onto a non-Church server.

mkmurray / RussellHltn / thedqs-

So according to this "no distinction" approach each of you has concurred with the church should request that all "web apps" (ymyw.org, scouting.org) not be used, right?

This is the problem and it is why we need "official" clarification.

enriquer wrote:So according to this "no distinction" approach each of you has concurred with the church should request that all "web apps" (ymyw.org, scouting.org) not be used, right?

No, I never said "all web apps". In fact, I would say "most web apps" probably meet acceptable requirements to make them okay.

Well, we've all given our input and opinions. I do agree with you that it is time for a more precise policy. It appears there are many conflicting intrepretations of the same policy.

Tom W. has already mentioned they are considering a more defined policy. In the meantime, I would suggest trying to understand and apply the intent of the policy, even if it isn't totally clear what it is trying to say. I think there is a consensus that nobody has a right to upload (automated or typed) other people's sensitive MLS or Unit Web Site data onto a third party, non-Church server. This is why I am saying it doesn't rule out all "web apps," only the non-Church ones that make you upload bulk "Church content" that is not your right to redistribute.

Again, this isn't official policy, but I think it's close to the intent of the policy. Be prayerful and close to the Spirit and you won't stray from the spirit of the law.

It does not seem to me that all data in MLS is considered sensitive. Things such as DOB and ordinace dates are obviously sensitive, but not the person's name. The only information from MLS used in a HT/VT reporting website are the assigned family or individual names. It does not seem to me that grouping those names into routes and districts makes the information sensitive.

Uploading the organization from MLS saves having to enter the information manually, but again, just becuase it came from MLS, that does not make the information sensitive. Finally, information on a HT/VT reporting website is accesible only to those leaders given specific access to the information for their stewardship. The general public or even other church members are not able to access it.

Jerry S

jerbarb wrote:The only information from MLS used in a HT/VT reporting website are the assigned family or individual names. It does not seem to me that grouping those names into routes and districts makes the information sensitive.

Which website are we talking about? The one I've seen has name, address, phone number, and by association the fact they are a member. Collectively that information can be considered sensitive.

jerbarb wrote:Finally, information on a HT/VT reporting website is accessible only to those leaders given specific access to the information for their stewardship. The general public or even other church members are not able to access it.

In a perfect world, yes. But you also have to consider that by placing it on the web it also becomes possible for hackers to get to it. By placing it on a third-party website, it's no longer where the church can protect it.

Despite all of these discussions about what is sensitive and what is not, the established policy that has been put forth on this site by Church leadership is that no bulk data from MLS is to be put on a third-party, non-Church hosted server, no matter what method it is.

enriquer wrote:Tomw / Mkmurray-

Hmmm....this is still not as clear as you would think. You see we really need a definition of what is deemed "content" by the Church. If you use the definition known to all of us in cyberspace it is the copyrighted material mentioned in that letter.

While we are at it we probably need the church's definition of "uploaded" too. Is uploaded a file upload or does it also mean keyed in?

So if ward members/leaders are to use the ymyw.org or scouting.org we have a problem. Because all of the informaiton they have does originate from the MLS system in one fashion or another.

Currently there are no further guidelines that I can provide you. You must use your own best discretion. My own personal view is that sites like YMYW.org, etc. are fine as long as you type in the information. We use this in my ward but to better protect the privacy, we never use first names of the youth, but instead only use initials.

Tom

enriquer wrote: In summary, until these "official" clarifications are intelligible to ALL our technology efforts will get tripped up by Priesthood leaders who read letters from the church and interpret them to say we are limited to using official church websites.

It goes without saying that if your Priesthood leaders do not want to use some web site that you think may be OK, you should not.

Tom

mkmurray wrote:Despite all of these discussions about what is sensitive and what is not, the established policy that has been put forth on this site by Church leadership is that no bulk data from MLS is to be put on a third-party, non-Church hosted server, no matter what method it is.

Bulk data no matter what method means that the scouting.org, ymyw.org, etc. sites are all in violation of current church policy then.

Whereas the site that Jerbarb is speaking about is limited to the names of the heads of household which are okay given they are a public record?

tomw wrote:It goes without saying that if your Priesthood leaders do not want to use some web site that you think may be OK, you should not.

Tom

Of course not. The real issue is how is a non-technical local leader to make this determination given the lack of current "actionable or intelligible guidelines" from the church?

Folks,

I strongly believe that we should focus on data content. The method by which the data gets there is completely irrelevant. Just because the current policy doesn't specifically mention the manual entry of data, the end result is exactly the same. If uploading the data from MLS to a website is not allowed, I think manually entering the data from MLS shouldn't be allowed unless the Church specifically says otherwise.

Brad O.

enriquer wrote:Bulk data no matter what method means that the scouting.org, ymyw.org, etc. sites are all in violation of current church policy then.

Tom W.,

If what Enrique says is true that these sites require sensitive data from MLS, does the Church plan to approach these sites and inform them of the Church policy regarding MLS data on non-Church hosted servers?

brado426 wrote:Folks,

I strongly believe that we should focus on data content. The method by which the data gets there is completely irrelevant. Just because the current policy doesn't specifically mention the manual entry of data, the end result is exactly the same. If uploading the data from MLS to a website is not allowed, I think manually entering the data from MLS shouldn't be allowed unless the Church specifically says otherwise.

Brad O.

Yes. I think that follows the spirit of what's being discussed. Our stake has been using PDF based forms for a number of things. The forms are filled out and then, when submitted, e-mail the data to the appropriate person.

As soon as I found out about it, I asked about the information being provided on the forms and told them how insecure e-mail really is... but it is still in use. Technically, we are probably in compliance with official statements. It is not a church site nor an e-mail list and all information is, as far is I know, entered by hand. It is simply a set of PDF forms that e-mail data around -- data that in my mind should not be.

--kpederson

I'd like to add the following comments based on the comments already made and also my interpretation of church statements:

'The real issue is how is a non-technical local leader to make this determination given the lack of current "actionable or intelligible guidelines" from the church?' - the correct answer is revelation - the same thing that I presume prompted the guidelines from the church to begin with. I realize that church leaders are human, and they can make mistakes, but as long as they hold the positions they do in righteousness, it's our job to follow them - even if the techy in all of us is itching for a little freedom. We lack the authority to receive revelation for the organizations they preside over.

I think in large part here we seem to be driving at the technical details of the guidance where maybe we should be stepping back and asking about the intent of the guidance (just my 2 cents, and yes, I might be exercising my right to be wrong here).

All of these letters name websites. At least one of them names e-mail or e-mail groups. Since I feel fairly certain the church has no issues with HTTP/HTTPS/POP3/IMAP/SMTP protocols or HTML/MIME/etc formats I would have to believe what they were driving at is the content distribution since that is essentially what websites and e-mail allow for. When you look at it from content distribution you now spread the influence of the letters across the spectrum of all applications (as I believe it should be).

Now, what content is the issue? The easily identifiable items would be:
1. Anything representing itself as coming from the Church or a Church entity.
2. Anything out of MLS.

What, if anything else, is included?

Lets start pulling out some pieces of the letters.

March 15th, 2001 letter:

"... local church units and organizations should not create or sponsor web sites."

I added the underlining for emphasis. I think web sites can safely be replaced with "content". "units" and "organizations" will include pretty much any division within a local ward/branch you can come up with - and the local part makes it pretty clear they do mean down on the ward/branch level. Creating or sponsoring content I would interpret to mean pretty much the use of any non-church-approved application that requires the input (in any form) of some sort of data from our organization.

December 13th, 2004 letter:

"These Web sites contain Church-approved content, meet the legal requirements of copyrights and privacy, and can be recognized by the presence of the Church logo. No other sites are authorized."

I added the underlining to "content" and "privacy". Notice the word of content. I really think what they have to say about websites here they mean about any other application floating around out there too even if it doesn't use the HTTP protocol to communicate.

"privacy" I think this aspect has already been covered in this thread as the use of MLS data has been discussed.

"No other sites are authorized." - I really think this covers it. Note that the church added the underlining here.

"This restriction includes but is not limited to temples, missions, visitors' centers, auxiliaries,
quorums, classes, Scout units, and committees for special events. Any such Web sites or e-mail
groups should be discontinued immediately."

I added the underlining. Once you've drilled down to "quorums", "classes", "Scout units", and "committees", I think you mean pretty much any division or subdivision of a local ward/branch you can come up with. They say that any such "web sites" or "e-mail groups" should be discontinued immediately. I don't think they're going to name all possible forms, just the more popular ones, and the issue of "content" I've already mentioned so I think "web sites" or "e-mail groups" can be swapped out for "content distribution applications" to cover the range.

So, what's allowed?

Should you be e-mailing things back and forth when acting in a Church capacity and using non-church e-mail systems? Probably not.

Is http://www.scouting.org in violation of Church policy? Of course not, it represents an organization that is not part of the Church.

Is use of http://www.scouting.org a violation of Church policy? If you're promoting it's use as a church scouting leader of some sort in a way that involves the submission of church relevant information (your class roster) to the site, then you probably are in violation - if you're not, then no.

Is use of http://www.ymyw.org a violation of Church policy? Unless the church has made a specific exception for it somewhere, I would think the answer would have to be yes.

Is the use of a SSL secured ward mapping application that requires authentication and only allows the Bishopric in a violation of Church policy? Yes, regardless of how the ward data made it's way in.


Just my thoughts on the topic. Maybe I'm wrong, but perhaps I'm right.

Please work with your local ward/branch and stake leaders if you have specific questions about some site or service that you want to use. Until I have further directives from the Church, I don't have much more that I can add.

Tom

gblack wrote:Is use of www.ymyw.org a violation of Church policy? Unless the church has made a specific exception for it somewhere, I would think the answer would have to be yes.

Our stake just asked for authorization to use ymyw.org from SLC and it was approved.

I have a question regarding groups and, further towards that end, ning.com (social network). Probably everyone is aware of LDS Scouting on Yahoo groups. And our own council has formed a Yahoo group for Venturing that LDS leaders participate on.

But what about setting up a Yahoo group for a specific LDS unit (e.g., stake or ward)? Seems it might violate the policy as it's for a specific LDS unit and is public. But what if it's made private access only?

Along those lines, what's good for Yahoo would probably be good for ning.com. I know that one of our wards in our stake has set up a ning.com social network for the ward, but it's private so you can only see the name unless you are invited to it.

Assume in all the above that no MLS data is input (whether by import or manual). The question goes to having individual LDS units set up networks.

I assume that a ning.com social network for Texas YM Leaders would be okay, since it's not setup for any one unit, and merely is a resource for Texas YM leaders to use to coordinate scouting events and better their youth programs.

Last question - hoping this isn't rambling - regarding use of Google Notebooks and Docs. I have gotten into the habit of storing my notes and such in Google notebooks, and saving documents to Google Docs as it allows me to access them using my Treo from anywhere. They are password protected, and encrypted using secured connections, so is the use of those tools governed? And if we "share" them by giving access to "collaborators"?

I don't have much time to formulate a response, nor do I think it would add much. But I would like to say that I don't think that these issues will be resolved until the Church provides authorized use of modern, functional web tools and apps currently available by third-parties, or internally creates authorized applications that provide enough functionality to be accepted by the masses.

LUWS, MLS, and other Church-provided apps and tools are unfortunately not keeping pace with the ingenuity and innovation of well-meaning members and others developing unapproved and third-party tools being used. Business factors of bureaucracy, time, and budgets within the Church are most likely all contributing to the seeming lack of progress in approved tools. Revelation most of us are not privy to may also contribute. Meanwhile many International areas have no approved tools or only some that those of us in the US/Canada may have.

I believe both the Church and the tech/developer community need to work together through this forum and other means to hasten the work of providing functional, modern, and meaningful apps to further the work and ease the administrative load of local units. Perhaps partnerships such as FamilySearch are pursuing in relation to tools could be arranged through licensing or other means until the Church can develop their own equivalent tools.

Enough rambling, I hope we can continue a meaningful and productive discussion regarding tools that assist all of us in our administrative Church work.

The thing to be careful of with other web sites is the exchange of confidential information.

Tom

Anytime we use an e-mail account on a server other than our own (SBC, Sprint, Google, AOL, etc.) this will be an issue, correct? Often times we send information on meetings, etc., via e-mail, and a copy of that information then sits on that e-mail server unless our e-mail client is set to download and delete from the server (sometimes the case).

As that e-mail sits on that server, the only thing protecting the data is a password or the security of the e-mail server itself. So I'm thinking that the same rule would apply to online storage of notes (Google Notebook) or other information.

Correct?

I'm not really asking for a policy. I am asking more what the unofficial sensitivity of the Church is to information being stored on password protected/encrypted servers such as Google Notes and such. It would be really hard to not be able to store any information online - even in a password/encrypted public server (though I could see that being a hard line).

tortdog wrote:Our stake just asked for authorization to use ymyw.org from SLC and it was approved.

I'm curious what this means.

• How did you ask (phone, e-mail, letter)?
• Who made the request (stake president, a clerk, etc.)?
• What department approved this use?
• How was the approval given (verbal, letter)?
• Was the approval in the nature of "We have no problem with any stake using that site" or "We give approval for your stake to use that site" or "Your stake may use that site as long as you follow these guidelines (followed by specific restrictions)"?

Since other units may have similar questions, it would be nice to know what process you followed.

tortdog wrote:Anytime we use an e-mail account on a server other than our own (SBC, Sprint, Google, AOL, etc.) this will be an issue, correct? Often times we send information on meetings, etc., via e-mail, and a copy of that information then sits on that e-mail server unless our e-mail client is set to download and delete from the server (sometimes the case).

I have not been aware of any such draconian policy restrictions applied to email. There is apparently some common sense applied. Some of the most sensistive files I would not advise sending by email without encryption, but bishoprics exchange private information by email all the time.

I think it does make a difference whose email server is being used. The big vendors tend to have published privacy policies and terms and conditions that offer protection. So do ISPs. But your employer may extend no such protection to its domain if you use your work email for personal (church) use. Typically employer computer systems and their contents are deemed to be the property of that employer. And if, for example, you work for any level of government, the chances are that a court would not recognize a "reasonable expectation of privacy" for Fourth Amendment purposes over your personal data on that system. So for many good reasons, including employer policy, I try to avoid personal emails to/from my work address.

And if your email is hosted on a hand-me-down server in someone's spare room (@scriptkiddies.net) all bets are off.

I would also not advise sending sensitive information by email unless you've been assured by the recipient that it is OK to do so. Other members of the family may have access to the computer and possibly the downloaded unencrypted email.

kgthunder wrote:I don't have much time to formulate a response, nor do I think it would add much. But I would like to say that I don't think that these issues will be resolved until the Church provides authorized use of modern, functional web tools and apps currently available by third-parties, or internally creates authorized applications that provide enough functionality to be accepted by the masses.

LUWS, MLS, and other Church-provided apps and tools are unfortunately not keeping pace with the ingenuity and innovation of well-meaning members and others developing unapproved and third-party tools being used. Business factors of bureaucracy, time, and budgets within the Church are most likely all contributing to the seeming lack of progress in approved tools. Revelation most of us are not privy to may also contribute. Meanwhile many International areas have no approved tools or only some that those of us in the US/Canada may have.

I believe both the Church and the tech/developer community need to work together through this forum and other means to hasten the work of providing functional, modern, and meaningful apps to further the work and ease the administrative load of local units. Perhaps partnerships such as FamilySearch are pursuing in relation to tools could be arranged through licensing or other means until the Church can develop their own equivalent tools.

Enough rambling, I hope we can continue a meaningful and productive discussion regarding tools that assist all of us in our administrative Church work.

I would have to totally agree. I have thought for years that it would be great if the Church would do something like this on their web site. What I can't understand is if the Church has a system on CDOL for Stake Clerks to add in Temple Recommends, then why can't they produce a way to enter information like on ymyw.org and returnandreport.org?

I also seems that there are a lot of people out there putting these sites together and could be "contracted" by the Church to produce the technology for the web site and then host them on an "authorized" church web site. Maybe this is too simplistic of a view on my part.

tortdog wrote: I'm not really asking for a policy. I am asking more what the unofficial sensitivity of the Church is to information being stored on password protected/encrypted servers such as Google Notes and such. It would be really hard to not be able to store any information online - even in a password/encrypted public server (though I could see that being a hard line).

Email is an accepted tool that has become increasingly important in Church work. Common sense should be used when communicating via Email or other electronic mediums. Meeting times, details about activities, coordination, etc. would not be considered confidential. Welfare issues, on the other hand, would be. Treat all confidential or sensitive information like you would your bank account.

Tom

tomw wrote:Email is an accepted tool that has become increasingly important in Church work. Common sense should be used when communicating via Email or other electronic mediums. Meeting times, details about activities, coordination, etc. would not be considered confidential. Welfare issues, on the other hand, would be. Treat all confidential or sensitive information like you would your bank account.

Tom

I doubt that in general bishoprics and other ward leaders apply such a restrictive guideline. It would be quite a bit more restrictive than common practice in business and government.

Just in the case of the particular example you cite, welfare, our bishop routinely sends an email to quorum leaders to help the families signed up for a biweekly bishop's storehouse delivery. These leaders are tasked to help various families get to the delivery location. Other examples, with roughly the same level of sensitivity, are probably common.

If this is the policy guideline for email, then there needs to be a better solution. Perhaps the Church should facilitate use of some common encryption software, such as PGP, or provide a secure email host at CHQ for ward leaders. The latter solution would probably be less complex to implement.

Alan_Brown wrote:I'm curious what this means.

• How did you ask (phone, e-mail, letter)?
• Who made the request (stake president, a clerk, etc.)?
• What department approved this use?
• How was the approval given (verbal, letter)?
• Was the approval in the nature of "We have no problem with any stake using that site" or "We give approval for your stake to use that site" or "Your stake may use that site as long as you follow these guidelines (followed by specific restrictions)"?

The Stake YM President called and spoke with David Pack, the Director of the Church's LDS Relationships with BSA program. He indicated the Church's policy is to let wards that wish to use ymyw.org, or any of the other software like it, as they see fit.

Not very specific - which I like.

boomerbubba wrote:I doubt that in general bishoprics and other ward leaders apply such a restrictive guideline. It would be quite a bit more restrictive than common practice in business and government.

I completely see the frustration were e-mail to be tightly controlled. But the reality is that e-mail is only as safe as the security on which it is stored or, even, communicated. Even Lexis failed the test, with private data pilfered by people who were not supposed to access the data.

So it does happen. And while the LDS Church is solely responsible for the data it maintains on LDS.org, that data isn't very private (names/addresses/phones). The important data (on MLS) is kept offline (excepting what may be maintained on LDS servers for official Church use in SLC).

When we send communication via e-mail on the worthiness of Br. Smith, or the family needs of Br. Young, that data is not safeguarded by any official LDS security. I'm assuming this is one of the reasons the Church doesn't want LDS sites that contain any such information (or less private data such as names/addresses and phone numbers).

But I'm kind of guessing.

tortdog wrote:He indicated the Church's policy is to let wards that wish to use ymyw.org, or any of the other software like it, as they see fit.

It is one thing to use software, and quite another to use a website, I would think. I am not sure this answer will fly at our next stake presidency meeting, at least for our stake.

tortdog wrote: When we send communication via e-mail on the worthiness of Br. Smith, or the family needs of Br. Young, that data is not safeguarded by any official LDS security. I'm assuming this is one of the reasons the Church doesn't want LDS sites that contain any such information (or less private data such as names/addresses and phone numbers)..

To be clear, I am not contending over where the line ought to be drawn as a matter of policy. Nor am I sitting in judgment of leaders whose own interpretation of where the common-sense line is happens to be different from the interpretation tomw articulated above, however ambiguously.

What I am trying to do is to look at this pragmatically, and to suggest a technical solution that would ameliorate the problem. Since it is apparent that lots of local leaders do have a need for confidential email to conduct ward business efficiently -- wherever the line is drawn -- perhaps the Church should provide them a secure communications channel by one means or another. That's what other large organizations do for especially sensitive data.

Much of this problem would go away, for example, if bishoprics and other ward leaders were issued email addresses like bishop_nnnnnn@lds.org or EQP1_nnnnnn@lds.org, where nnnnnn is the unit number, and CHQ hosted the email server. Other solutions such as encryption are possible, but I think church-hosted email would be easier to implement in the field. All the local leaders would need would be a browser and a password.

boomerbubba wrote:Much of this problem would go away, for example, if bishoprics and other ward leaders were issued email addresses ...

Bishops and stake presidents have this already, as do mission presidents. I agree, though, that it would be helpful if others had this, as well.

One thing that I see happening in many cases, however, is that a bishop will redirect his mail to a personal address. And this seems to me to defeat the purpose of having the controlled site in the first place.

lajackson wrote:Bishops and stake presidents have this already, as do mission presidents. I agree, though, that it would be helpful if others had this, as well.

Well, the other part of boomerbubba's point was that it could also be secure and encrypted in some way, that is if the email is delivered across the net in any way. Otherwise, if the "email" service (even if it's more of a PM service) were hosted completely in-house, then the username and password would be all that's needed (from a communication standpoint).

mkmurray wrote:Well, the other part of boomerbubba's point was that it could also be secure and encrypted in some way, that is if the email is delivered across the net in any way. Otherwise, if the "email" service (even if it's more of a PM service) were hosted completely in-house, then the username and password would be all that's needed (from a communication standpoint).

It appears there might be a bit of confusion over whether we're talking about conventional email vs. web-based access to something that looks like web-based email. Conventional email is delivered via SMTP and is usually rather unsecure. Web-based message communication, where the message stays on one central server (or server farm), can be made quite secure. It sounds to me that boomerbubba is referring to the latter.

rmrichesjr wrote:It appears there might be a bit of confusion over whether we're talking about conventional email vs. web-based access to something that looks like web-based email. Conventional email is delivered via SMTP and is usually rather unsecure. Web-based message communication, where the message stays on one central server (or server farm), can be made quite secure. It sounds to me that boomerbubba is referring to the latter.

I think we are on the same page, but maybe not. I am not suggesting a total SMTP/POP configuration, but a central email server with a web intereface that would look rather like Yahoo or GMail to the user.. (My own ISP provides both interfaces for the same underlying server, which is also possible.) But I do think the system hosted by CHQ would still be email, not just a specialized messaging system. That way, leaders could still exchange non-confidential email with rank-and-file members using their lds.org address.

But for confidential email to/from other leaders within the system, the only email server involved would belong to the Church.

So it would function rather like the email server at my employer. So long as I am exchanging email with other employees, no third-party servers are involved. Only email I send or receive to outside communicants would sit on a third-party server.

An https web server could supply all the encryption needed because SSL is end-to-end with the client browsers. Users would need no special software beyond their browsers, which have built-in support for SSL. That is good enough for online banking.

For routine private ward communications, I think that level of security would suffice. It would be far beyond what ward leaders have today.

boomerbubba wrote:An https web server could supply all the encryption needed because SSL is end-to-end with the client browsers. Users would need no special software beyond their browsers, which have built-in support for SSL. That is good enough for online banking.

For routine private ward communications, I think that level of security would suffice. It would be far beyond what ward leaders have today.

I have to point out though, that with any security measures proposed, the real questions are, what is it we are trying to protect, who are we trying to protect it from, and are we really accomplishing that?

For example, a Bishop sends an email to the RS Pres regarding some special needs for Sis Jones in the Ward. She is reading the email when the Home Teachers knock on her door, and because (being a good Mom) she has placed the family computer in a predominant place in her home, the Home Teachers get a free look at the message as she rounds up the rest of the family. Oops.

In the above situation, it would not have mattered in the least if the message was delivered by the securest means possible. Once the final destination is reached and the message unencrypted, all bets are off. Here's my point. Even if the email WAS intercepted along the way and read by a 3rd party, they would have no clue WHO Sis Jones was (nor would they care).

How often are we emailing people's personally identifiable information? Things like date of birth, mother's maiden name, membership number, etc. I would say it's extremely rare in the day to day dealings between Ward leaders. So if the information has no value whatsoever to anyone outside the Ward, then what's the point of securing it from them? Of course, leaders must be cautioned about accidentally revealing sensitive information entrusted to them (like in the above example), but that's not what this discussion is about.

lajackson wrote:It is one thing to use software, and quite another to use a website, I would think. I am not sure this answer will fly at our next stake presidency meeting, at least for our stake.

I'm thinking that you are drawing a distinction where most non-technical people would not. I'm not sure how technical savvy Br. Pack is, but since ymyw.org is not a software package but a Internet site I don't think that he was making such a distinction. He was familiar with ymyw.org and did not suggest that the Intenet site would be off limits.

Yes, I understand that you can take the programs on ymyw.org and save them to a local server and run them there without the Internet, but I think that's taking it WAY beyond what Br. Pack meant.

Mikerowaved wrote:Once the final destination is reached and the message unencrypted, all bets are off. Here's my point. Even if the email WAS intercepted along the way and read by a 3rd party, they would have no clue WHO Sis Jones was (nor would they care).

How often are we emailing people's personally identifiable information? Things like date of birth, mother's maiden name, membership number, etc. I would say it's extremely rare in the day to day dealings between Ward leaders. So if the information has no value whatsoever to anyone outside the Ward, then what's the point of securing it from them? Of course, leaders must be cautioned about accidentally revealing sensitive information entrusted to them (like in the above example), but that's not what this discussion is about.

Exactly. No matter how secure the Church were to make it, it is only as secure as the end user. And you KNOW that local leaders would be redirecting LDS e-mail to a personal e-mail account (though the Church could make that difficult). But with the Church failing to quickly move forward on other technical issues, I really don't see this being a priority, e.g., how hard would it be to implement ymyw.org but it hasn't.

Is what it is.

I think the key is to keep communication innately useless except for the intended users, e.g., by leaving out the identifiable information, using initials, etc. Notes on paper may be seen if the notebook is left out in the foyer, by chance. But if the notes are taken in a more secure manner (initials, etc.) at least it presents an impediment to potential harm from leaking out.

Mikerowaved wrote:I have to point out though, that with any security measures proposed, the real questions are, what is it we are trying to protect, who are we trying to protect it from, and are we really accomplishing that?

For example, a Bishop sends an email to the RS Pres regarding some special needs for Sis Jones in the Ward. She is reading the email when the Home Teachers knock on her door, and because (being a good Mom) she has placed the family computer in a predominant place in her home, the Home Teachers get a free look at the message as she rounds up the rest of the family. Oops.

In the above situation, it would not have mattered in the least if the message was delivered by the securest means possible. Once the final destination is reached and the message unencrypted, all bets are off. Here's my point. Even if the email WAS intercepted along the way and read by a 3rd party, they would have no clue WHO Sis Jones was (nor would they care).

How often are we emailing people's personally identifiable information? Things like date of birth, mother's maiden name, membership number, etc. I would say it's extremely rare in the day to day dealings between Ward leaders. So if the information has no value whatsoever to anyone outside the Ward, then what's the point of securing it from them? Of course, leaders must be cautioned about accidentally revealing sensitive information entrusted to them (like in the above example), but that's not what this discussion is about.

The whole discussion arose in the context of the third-party servers. Some questioned whether policy precludes using email since email is commonly hosted on third-party servers. My suggestion is intended to avoid that risk.

The hypothetical example of the RS president who fails to secure confidential information emailed to her could equally be posed for failure to protect printouts or files handed off by sneakernet, or even overheard conversations. It is up to the RS president to protect that confidential information, no matter the source. It's a matter of teaching people correct principles and letting them govern themselves.

You question whether there is significant need to communicate confidential information. I think there is a large need, and wards are already using conventional email in ways that are outside the bounds of tomw's simple example of welfare. That generalizes to other topics. Many communications that a bishop might have with the RSP, EQP, Welfare Committee, etc., would be held behind closed doors if conducted in person. And many -- including tomw above -- say such content should not be transmitted by email because it is insecure.

But I know that in my ward -- and I suspect in thousands of others -- such restrictive practices would impede the ordinary flow of need-to-know information that already occurs via email. The tradeoff is inherent. If you restrict communications to personal meetings or phone tag, not as much gets done or details don't get written down. If there were a secure channel available, most of that risk could be ameliorated.

So I think the gist of all of this is that most local leaders are using conventional, 3rd party email solutions to communicate within the ward and to communicate with other units around the Church. The current solution still has issues with "leaving the email window open" when guests come to your house.

At least with boomerbubba's solution, it would be housed on a secure Church server and the email address names could be something very predictable. I guess the rest of the argument is whether it will be worth the effort to implement and whether there would be a significant amount of security achieved to justify the effort.

Along the lines of what Boomer says, the whole reason I brought this up was in my quest to find consistency in policy:

* if we restrict non-LDS.org sites from hosting confidential information then
* don't we have to restrict all non-LDS.org e-mail servers as well

But the Church probably will never take that second step, so why attempt to prevent the first (as long as it is just as secure as the e-mail servers).

So my view would be that if we recognize that confidential information will be sent via non-LDS.org e-mail (and it will) albeit with some security (https for online e-mail, password protection, etc.), then shouldn't we be able to similarly use non-LDS.org servers that are password protected and commercially available for similar purposes, e.g., keep notes on a password-protected Google notebook, or an invitation-only network site?

I'm looking to treat non-LDS.org hosted application servers consistently with non-LDS.org email servers.

tortdog wrote:Along the lines of what Boomer says, the whole reason I brought this up was in my quest to find consistency in policy:

* if we restrict non-LDS.org sites from hosting confidential information then
* don't we have to restrict all non-LDS.org e-mail servers as well

But the Church probably will never take that second step, so why attempt to prevent the first (as long as it is just as secure as the e-mail servers).

I think consistency can be found in the concerns. The first question is "what is confidential" when we're talking 3rd party servers? Outside of the church, no one cares about who's getting welfare.

I think the big concern is the harvesting of church membership data for marketing purposes. Email isn't a concern for that since there's far too much "noise" for anyone to reasonably exploit. But if I throw up a server offering a service then I can con people into uploading the information in a form I can sell to advertisers. THAT is what I think the concern is - the uploading of information from MLS to "outsiders" - the possibility of taking information that was to be for "church purposes only" and risk having it fall into other's hands.

Personally I see a bigger consistancy issue in that on one hand we've been asked not to upload information to 3rd party servers and yet a stake has received permission to use the ymyw.org website.

RussellHltn wrote: Personally I see a bigger consistancy issue in that on one hand we've been asked not to upload information to 3rd party servers and yet a stake has received permission to use the ymyw.org website.

I've never used ymyw.org, so correct me if I'm wrong, but I was under the impression that it required manual data entry and did not require the upload of data from any Church system.

Brad O. wrote:I've never used ymyw.org, so correct me if I'm wrong,

Nor have I, so we're in the same boat.

Brad O. wrote:but I was under the impression that it required manual data entry and did not require the upload of data from any Church system.

I could be wrong, but don't think it's the method of uploading as much as where the information comes from. If people are entering their own information, that's fine. It's when someone (like a church leader) enters the information (on members) from a MLS print-out we have a problem.

RussellHltn wrote:Personally I see a bigger consistancy issue in that on one hand we've been asked not to upload information to 3rd party servers and yet a stake has received permission to use the ymyw.org website.

Actually there are now two stakes (if you were referring to my stake). I am in a brand-new stake and we took the precedent from one of the stakes from which we were formed. So both the parent and the child stake are going off the original advice received from the parent.

I had thought that I had read on this forum that ymyw.org and scouting.org were viewed as okay, and not a violation of the Church's policy. But I'm new here and I skimmed over a lot of material on this site so I might have misread it or be off.

However, at least two stakes are happily going forward (and have been). Since we already have permission, there's no way that we're going to ask again. You don't look a gift horse in the mouth.

Brad O. wrote:I've never used ymyw.org, so correct me if I'm wrong, but I was under the impression that it required manual data entry and did not require the upload of data from any Church system.

It is manual entry. But as mentioned, how the data gets in should not be relevant. Rather, whether the data stored is deemed confidential enough that the Church wants it kept off public servers should be the key. The data you put into ymyw.org generally includes

* adult: name, position, e-mail and phone
* youth: name, birthday, e-mail and phone

You don' t have to put in all that information, and you could use initials to substitute for names. Birthday is somewhat important as it keys into the youth's progress through the quorums/YW classes.

tortdog wrote:It is manual entry. But as mentioned, how the data gets in should not be relevant.

Yes!

http://tech.lds.org/forum/showthread.php?t=576&page=4

I think the former First Presidency message of Dec 13, 2004 (quoted earlier) covers these topics pretty well. If they would like to make an exception for ymyw.org, or any other site, then they are certainly entitled to do so. Even on a case by case basis. I have every trust in their judgment.

The problem with 3rd party websites is that no matter how secure they think they are, stuff happens. Every single week there are reports of personal confidential information being exposed to the public. Medical records, personnel files, educational histories, even military records. Some are exposed by accident, some by negligence, some by hackers.

Don't forget there are also website owners and administrators that will have unlimited access to the entire gammit of information stored on their website. Do you even know who these people are? Do you trust them? Can you be certain they aren't in the data harvesting business, or (heaven forbid) predators? Do they REALLY take data security seriously, or just give lip-service with a wonderfully written Privacy Policy?

My point is, once the information gets stored outside of the Church's careful watch, they have little or no control over it's safekeeping, but might still be liable for protecting it. That's not a good situation to put yourself in and I can fully understand their concern.

Brethren,

I would like to point out a perspective that has been completely overlooked in this new round of discussions on this post I started long ago.

In addition to the desires, guidance and rules put forth by the first presidency we must comply with the rule of law. Regardless of how the data gets to a third party site the key is not how it got there. Instead it is what the data contains.

Information uploaded, by whatever means, is limited by law to public record information (name, address, and maybe a phone number.) Keep in mind that this is permitted without written consent for adults because this is public record information.

However, for minors it is a violation of federal law to share their information without an auditable record of written consent by the individual and their parents/guardians. So with that being said let's remember that YM who participate in Scouts join the scouting program and this membership may cover Boy Scouts of America. As for ymwm.org they are not covered in any way. Ymyw.org is violating federal child privacy laws and certain interpretations of church policy.

There are variations from state to state and country to country as you might imagine. In my prior research I uncovered that Pennsylvania will not permit any information about minors posted anywhere regardless of whether permission has been granted.

So my personal recommendation is that any leaders planing to use and/or already using ymyw.org contact the church's legal department about instructions to protect the church from inadvertant legal transgressions.

daddy-o wrote:for minors it is a violation of federal law to share their information without an auditable record of written consent by the individual and their parents/guardians.

Are you referring to COPPA or something else?

daddy-o wrote:Brethren,

I would like to point out a perspective that has been completely overlooked in this new round of discussions on this post I started long ago.

In addition to the desires, guidance and rules put forth by the first presidency we must comply with the rule of law. Regardless of how the data gets to a third party site the key is not how it got there. Instead it is what the data contains.

Information uploaded, by whatever means, is limited by law to public record information (name, address, and maybe a phone number.) Keep in mind that this is permitted without written consent for adults because this is public record information.

However, for minors it is a violation of federal law to share their information without an auditable record of written consent by the individual and their parents/guardians. So with that being said let's remember that YM who participate in Scouts join the scouting program and this membership may cover Boy Scouts of America. As for ymwm.org they are not covered in any way. Ymyw.org is violating federal child privacy laws and certain interpretations of church policy.

There are variations from state to state and country to country as you might imagine. In my prior research I uncovered that Pennsylvania will not permit any information about minors posted anywhere regardless of whether permission has been granted.

So my personal recommendation is that any leaders planing to use and/or already using ymyw.org contact the church's legal department about instructions to protect the church from inadvertant legal transgressions.

daddy-o:

That is a good point. At my job, we create promotional marketing websites for other companies. We are not allowed to collect any child's information that is under 13 years of age. Before a person is allowed to enter his or her information on any of our sites, he or she must confirm that they are 13 or older.

daddy-o wrote:Ymyw.org is violating federal child privacy laws and certain interpretations of church policy.

It's certainly good to be aware of privacy laws. But I don't see how you can make a blanket statement about this site violating those laws. That site does not make the information public to anyone except those who are authorized within the ward or stake. Also, that information is not necessarily any more than a name, or initials -- it depends on how the leaders use it.

We can discuss the security of the servers that host it, transmission protocols, etc., and these are all good questions. But I think you'd have to show specific legal violations to back up that claim. I'm not saying that I know there are none, but I certainly haven't yet seen any evidence of any.

Just a thought question -- how does ymyw.org differ from the local unit web sites? With LUWS, the names, addresses, and phone numbers of hundreds of minors per stake are listed on a web site. Thousands of people (all the stake members, but not the general public, of course) can see this information. Although any member can opt out of his/her information being listed, by default it is listed. We only have the security of the site protecting the entire world from seeing all that private information. Now I know who the Church is, and I know they are working very hard to have a secure site. But ymwy.org would have even less private information. From a legal standpoint, what's the real difference?

boomerbubba wrote: You question whether there is significant need to communicate confidential information. I think there is a large need, and wards are already using conventional email in ways that are outside the bounds of tomw's simple example of welfare. That generalizes to other topics. Many communications that a bishop might have with the RSP, EQP, Welfare Committee, etc., would be held behind closed doors if conducted in person. And many -- including tomw above -- say such content should not be transmitted by email because it is insecure.

Please be aware that I was just giving examples and certainly not setting any kind of precedence or policy. I'm trying to point out that there may be occasions where email may not be the best tool to share confidential information. With a lack of clear policy direction, it is up to the ecclesiastical leaders in the local units to use prudence and the guidance of the Spirit in their decision as to what to share and how.

Tom

Alan_Brown wrote:It's certainly good to be aware of privacy laws. But I don't see how you can make a blanket statement about this site violating those laws. That site does not make the information public to anyone except those who are authorized within the ward or stake. Also, that information is not necessarily any more than a name, or initials -- it depends on how the leaders use it.

...
Just a thought question -- how does ymyw.org differ from the local unit web sites? With LUWS, the names, addresses, and phone numbers of hundreds of minors per stake are listed on a web site. Thousands of people (all the stake members, but not the general public, of course) can see this information. Although any member can opt out of his/her information being listed, by default it is listed. We only have the security of the site protecting the entire world from seeing all that private information. Now I know who the Church is, and I know they are working very hard to have a secure site. But ymwy.org would have even less private information. From a legal standpoint, what's the real difference?

The violation is taking information without consent and using it. Accessibility and security of the data is important but has nothing to do with violating the law in this regard. The church is allowed to have this kind of information on their websites because we are members of the church.

RussellHtn had asked if this was covered by COPPA. Not entirely. You see COPPA covers children 13 years and younger. This law is geared to making children safe from preditors. It does add specific requirements to web administrators which ymyw.org does not advertise as having in place. If those requirements are not there then ymyw.org has violated COPPA. What I had referred to earlier is public record laws. There are federal laws and then specific ammendments that will vary from state to state. These laws determine what can be used with consent and how. These are the laws the leaders using ymyw.org have violated.

My local congressman is on some of the key committees that involve protecting children. I learned a lot by writing to his office. So again my recommendation is that leaders using and/or planning to use ymyw.org contact the church's legal department about instructions to protect the church from inadvertant legal transgressions.

If you could be more specific as to the laws you are referring to (chapter and verse) it would most helpful to the discussion. The only laws I'm familiar with (including COPPA) only deal with websites for profit. Most non-profit online organizations including ymyw.org, scouting.org, lds.org, etc., are exempt.

These laws were put into place to prevent unfair marketing practices targeting young people.

Mike

As far as I can tell, COPPA only applies to the taking of information from children younger then 13, not about children younger then 13.

Still, the legal issues are a valid concern. If anone knows of specific laws, particularly local laws, I'm sure the Church would like to be aware of that. Trying to keep up with all the local laws must be quite a challenge and it could be that something has slipped though.

Mikerowaved wrote:The only laws I'm familiar with (including COPPA) only deal with websites for profit. Non-profit online organizations including ymyw.org, scouting.org, lds.org, etc., are exempt.

Not completely, from the link I gave before: "Most recognized non-profit organizations are exempt from most of the requirements of COPPA. However, the Supreme Court ruled that non-profits operated for the benefit of their members' commercial activities are subject to FTC regulation and consequently also COPPA."

I don't think that changes anything as far as the church is concerned, but the standard "I'm not a lawyer" disclaimers apply.

RussellHltn wrote:Not completely, from the link I gave before: "Most recognized non-profit organizations are exempt from most of the requirements of COPPA. However, the Supreme Court ruled that non-profits operated for the benefit of their members' commercial activities are subject to FTC regulation and consequently also COPPA."

Thanks for the clarification. I went back and added the word "Most" to my post. Yeah, this legal stuff is not my forte either.

I do not have or want to have any more detail. Contact your local district attorney or lawmaker for more info on this. I just want to re-emphasize that we should take care to not confuse COPPA which is a predatory protection law from information privacy laws that cover everything including the internet.

daddy-o wrote:I do not have or want to have any more detail. Contact your local district attorney or lawmaker for more info on this.

Hummm.,, Your other postings seem to imply you had specific knowledge of some important legal info that we were not aware of. I must have been mistaken.

daddy-o wrote:I just want to re-emphasize that we should take care to not confuse COPPA which is a predatory protection law from information privacy laws that cover everything including the internet.

I hate to sound disagreeable, but COPPA (Children's Online Privacy Protection Act) was not written to specifically stop predator-type people, rather is was designed to regulate unfair and deceptive acts and practices in connection of collection and use of personal information from and about children on the Internet.

Mikerowaved wrote:Hummm.,, Your other postings seem to imply you had specific knowledge of some important legal info that we were not aware of. I must have been mistaken.

I hate to sound disagreeable, but COPPA (Children's Online Privacy Protection Act) was not written to specifically stop predator-type people, rather is was designed to regulate unfair and deceptive acts and practices in connection of collection and use of personal information from and about children on the Internet.

Mikerowaved, I do have experience I collected by working with knowledgeable subject matter experts like my congressman's office as I mentioned previously.

Let me clarify that the definition of predator in the context I was referring to includes pedophiles as well as people who commit unfair and deceptive acts relating to children.

daddy-o wrote:I do not have or want to have any more detail. Contact your local district attorney or lawmaker for more info on this. I just want to re-emphasize that we should take care to not confuse COPPA which is a predatory protection law from information privacy laws that cover everything including the internet.

As everyone can see from this discussion, the issues are complex. This is why the Church does have a policy and unfortunately there are some gray areas still left.

I appreciate everyone's comments.

Tom

This thread has narrowed to discussing child privacy issues and the law. While I agree there are complex threads to the issue of privacy and children, the thread has narrowed the discussion from the original issue of authorized and unauthorized web sites. I am quite interested in the overall issue originally posted by daddy-o. Since this narrowing of focus happened as a result of questioning the use of ymyw.org I am also curious about the ymyw.org site. I did a quick scan of the site without registering. I was then prompted to ask a few pointed questions using their 'contact us' link. I am hoping to get a response that will help clarify the structure, use, and availability of information at that site. This is what I sent throught that link.

Your web site has come up in a thread in LDS Technology Forums (lds.org) as being a site violating Church policy regarding authorized web sites.
What is it about your web site that you think does not violate this policy? How do you ensure someone registering as an "Advisor, Ward Admin, Stake Advisor, or Stake Admin" is who they say they are?
I am my stake's technology specialist and must advise my stake president on these matters. Before I can advise him I need to know the answers to these questions and others to ensure we will be following Church policy regarding authorized web sites.

I am hoping to get a better understanding of their site from their point of view. Maybe they have not considered the issues brought up in this thread. If there is interest I will share what I get from them.

Thanks for bringing us back on topic, JD. I think many of us are curious about the response you get.

I attempted to register on the site, but was told our unit was already registered, so I was told an email was sent to [they provided the first name only] and I must wait for approval. I'm attempting to contact several people in my unit with that name hoping to explain why I would like to take a look around on the "inside" of this website.

Mike

Mikerowaved wrote:I attempted to register on the site, but was told our unit was already registered,

And, aside from the other issues discussed, that is another problem. Did the person who is registered at the site have permission to represent the ward or stake? While it is not the site's responsibility to know, if there was a problem, would the site be willing to accommodate the authorized user?

Difficult questions, even for a site that seems to be providing a desired and worthwhile service.

lajackson wrote:And, aside from the other issues discussed, that is another problem. Did the person who is registered at the site have permission to represent the ward or stake? While it is not the site's responsibility to know, if there was a problem, would the site be willing to accommodate the authorized user?

Difficult questions, even for a site that seems to be providing a desired and worthwhile service.

The questions seem to be rather easily answered. The site doesn't make any attempt to make sure that the people who register for the site have permission, but I don't see why it would need to. Here's the basic process:

• A person registers with the site using the unit number.
• That first person becomes the defacto administrator for the ward.
• Any subsequent users have to be authorized by that person, or by someone designated by that person as an administrator.
• So access is not granted by the site, but by another member of the ward who has administrator privileges.
• Since the ward members who would be using the site are known to each other, it's not really likely that a stranger could ask for authorization and have it granted.
• Any ward that is using the site can easily set policies for who is an administrator and who grants access.

I suppose if you are worried about risks, you could consider the scenario that a stranger is the first to register. But that would quickly be discovered as actual ward members start to register and receive communication from a stranger.

So the basic technique of passing authorization among ward members, with a very small number of administrators authorized by the bishop, seems safe enough to me. The set of users will be small and well known to the ward administrator(s).

Alan_Brown wrote:...
I suppose if you are worried about risks, you could consider the scenario that a stranger is the first to register. But that would quickly be discovered as actual ward members start to register and receive communication from a stranger.
...

That scenario is the most obvious (to me, at least) risk. I don't know that site. How would ward members know it was a stranger who was communicating with them and not someone pretending to be the administrator assigned to that ward from the site? If by email address, the imposter could have an email address like Somewhereville1stWardAdmin@domain.tld where "domain.tld" is one of the many domains where anyone can register for a free email address.

rmrichesjr wrote:That scenario is the most obvious (to me, at least) risk. I don't know that site. How would ward members know it was a stranger who was communicating with them and not someone pretending to be the administrator assigned to that ward from the site? If by email address, the imposter could have an email address like Somewhereville1stWardAdmin@domain.tld where "domain.tld" is one of the many domains where anyone can register for a free email address.

Maybe I wasn't clear. The administrator is inown by name and e-mail address on the site. It is a member of the ward (except in this fantasy scenario). The list of users from the ward is available to any administrator for the ward. I don't see how someone could pretend to be a member of the ward, having a name of someone in the ward, with that someone having conversations in person with other members of the ward about the site. It just wouldn't happen.

If this site is to be implemented in the ward, there will be organization, and discussion, and assignments made. No one can sneak in unknown into the list of users. I mentioned the scenario for the sake of completeness and to show that there really is no risk there. If by chance some stranger registers first, as real ward members try to use the site, that stranger would not authorize them as administrators, but if he did, they would quickly figure out that it was an imposter during the council meetings where the site is discussed. In such a rare case (I don't see the motivation for a stranger being the first to register for a ward), I'm sure it can be worked out with the site owners to remove the stranger.

I think the real question in the "stranger" scenario, is could the impostor be discovered before damage was done? It's possible they could con someone into uploading information prior to the next meeting. If they got a list of names and contact info, that might have been all they wanted.

RussellHltn wrote:I think the real question in the "stranger" scenario, is could the impostor be discovered before damage was done? It's possible they could con someone into uploading information prior to the next meeting. If they got a list of names and contact info, that might have been all they wanted.

So you're saying that all the following could happen:

1. A stranger registers with the ymyw.org site, supplying a valid unit number. But if they even know about the site, how will they know the unit number? Why would they have any reason to assume that that unit would ever use the site?
2. A member of the ward (let's call her "Molly") at some later date is authorized by the bishop to register with ymyw.org as an administrator. Alternatively, Molly is not authorized, but is just checking out the site.
3. Molly attempts to register, but is told something along the lines of "John is your ward's administrator, but you can request that John activates your account."
4. Molly thinks nothing of that being odd, even though she is supposedly the first person to register, and she doesn't know who John is. Why would Molly not worry about this? Why would she register with a mysterious ward administrator?
5. "John" authorizes Molly to join. I suppose if all the completely improbable preceding events have happened, we're assuming John would do this.
6. Molly does not ask to be an administrator, or she asks to be an administrator but doesn't have the curiosity to see who John is. In the most likely scenario, she went to the site expecting to be an administrator, but she gives up on this without a second thought?
7. Molly uploads contact information. But if she wasn't authorized to use the site by the bishop, why is she uploading contact information? If she is that careless, she could just as easily be posting the information on some totally public site. In that case, it makes no sense to criticize ymyw.org, which at least is password protected. If she was authorized, then why was she so foolish as to upload information when there was a surprising turn of events where an unknown person was the ward administrator but no one was expected to be registered before Molly?

Frankly, I see this as improbability multiplied by improbability. I find it hard to get past step 1. But in any case, if a ward is being at all serious about this, they will do it deliberately, and assign people to be the administrators and advisers. Any of my objections in steps 4, 6, and 7 would stop any abuse, but you think that all 4 improbabilities would happen?

When evaluating threat models, it's good to be creative and consider all the posibilities, but I don't understand how this particular threat is at all credible.

Alan_Brown wrote:So you're saying that all the following could happen:

1. A stranger registers with the ymyw.org site, supplying a valid unit number. But if they even know about the site, how will they know the unit number? Why would they have any reason to assume that that unit would ever use the site?
2. A member of the ward (let's call her "Molly") at some later date is authorized by the bishop to register with ymyw.org as an administrator. Alternatively, Molly is not authorized, but is just checking out the site.
3. Molly attempts to register, but is told something along the lines of "John is your ward's administrator, but you can request that John activates your account."
4. Molly thinks nothing of that being odd, even though she is supposedly the first person to register, and she doesn't know who John is. Why would Molly not worry about this? Why would she register with a mysterious ward administrator?
5. "John" authorizes Molly to join. I suppose if all the completely improbable preceding events have happened, we're assuming John would do this.
6. Molly does not ask to be an administrator, or she asks to be an administrator but doesn't have the curiosity to see who John is. In the most likely scenario, she went to the site expecting to be an administrator, but she gives up on this without a second thought?
7. Molly uploads contact information. But if she wasn't authorized to use the site by the bishop, why is she uploading contact information? If she is that careless, she could just as easily be posting the information on some totally public site. In that case, it makes no sense to criticize ymyw.org, which at least is password protected. If she was authorized, then why was she so foolish as to upload information when there was a surprising turn of events where an unknown person was the ward administrator but no one was expected to be registered before Molly?

Frankly, I see this as improbability multiplied by improbability. I find it hard to get past step 1. But in any case, if a ward is being at all serious about this, they will do it deliberately, and assign people to be the administrators and advisers. Any of my objections in steps 4, 6, and 7 would stop any abuse, but you think that all 4 improbabilities would happen?

When evaluating threat models, it's good to be creative and consider all the posibilities, but I don't understand how this particular threat is at all credible.

Step 1 is easy to get past. Let's say John is anti-LDS and wants to cause trouble by getting a list of youth names and contact info. Let's say he has several unit numbers from his cohorts. Let's say he has heard a rumor that a unit for which he has the unit number is going to register on the site soon. That's the threat I'm considering.

For steps 4, 6, and 7, I'm thinking John could try to pass himself off to Molly as being an official representative of the site assigned to help that ward get registered. I understand there are people skilled at social engineering who can call up a business, pretend to be "IT Support" and convince people to divulge their passwords. Is there anything in the headers/footers sent with messages between site users that would prevent John, skilled at social engineering, from getting valuable information from a hypothetical naive/gullible Molly?

As for Step 1, ymyw.org tells you how. Look on the left side of the link. What they're telling you to do is to search for the LUWS page and pick it out of the URL. Note that you need not log into a ward to find it's Unit Number.

The rest is just social engineering. Perhaps registering with a name like "President". And when contacted the first thing "President" says is to go ahead and upload the information. I think it's quite likely that anyone stumbling across the site will register and explore first, and report in a meeting later. A clever social engineer can con the user into uploading before that first meeting.

While the possibility for success may not be high, a predator only has to get lucky once to get a list. He may do all the units within his area and hope that one will fall for it.

Someone made a blanket statement that ymyw.org violates federal child privacy laws. The only federal child privacy law that I am aware of is COPPA.

http://www.ftc.gov/ogc/coppa1.htm

Granted, I'm a tax attorney and might be missing something. If so, just tell me. But reading that law, ymyw.org clearly is not in violation since it is not:

* an operator of a website or online service directed to children, or

* an operator that has actual knowledge that it is collecting personal information from a child.

The website is not directed to children. It's directed to the advisers and parents of children. The websites that the feds are attempting to regulate are webkinz, facebook, and those type of sites - not sites collecting information on scouting/DTG progress. I don't know many kids who would EVER be inticed to join ymyw.org because it was a neat place to hang out on (enabling predators to contact them). (It's hard enough to persuade the ADULTS to participate, let alone believe that the youth would be all over it.)

Second, the children are not the ones who set up the information for each unit. It's an adult administrator. Further, you have to find "actual knowledge" which is a heightened standard. You aren't going to be able to prove that the operator of ymyw.org has "actual knowledge" even if a youth is the one who "collects the information."

I think that it would be advisable to inform the parents of the youth what the ward is doing in setting up the site. And if they object to speak up and leave that youth off. Or maybe even go further and only permit tracking of DTG/PP for those youth that parents authorize in writing. But in real life you would do that anyway. The DTG program works BECAUSE the parents are involved. Without the parents it will fail.

In our stake, ymyw.org is being rolled out to all ward units. So that eliminates this theoretical predator who fakes out a ward ymyw.org setup. Since there can only be one per ward, a predator is locked out of harming anyone in our stake (since we have already taken all the units online). And we personally know the administrators.

In our rollout, we are reaching out to the PARENTS and asking them to become involved in their children's lives via personal interviews on a weekly basis to track DTG/PP with each youth. And we ask that they track this progress through the web site, with the wards filling in the gaps only as needed, e.g., parents who aren't web savvy or lack access.

RussellHltn wrote:The rest is just social engineering. Perhaps registering with a name like "President". And when contacted the first thing "President" says is to go ahead and upload the information. I think it's quite likely that anyone stumbling across the site will register and explore first, and report in a meeting later. A clever social engineer can con the user into uploading before that first meeting.

Regardless of the probability of the scenario you put forth, I believe this thread is discussing if websites not owned by the Church can be used 1) under Church policy; and 2) responsibly and safely. I'm sure anyone would acknowledge that the Church's own local unit web sites can easily be abused if people are careless with information and naive about threats. We can also imagine entire sites set up by predators, careless use of public sites, and a host of other threats.

But the basic question in this instance is really: Can ymyw.org be used responsibly and safely? I believe so. But wards do have to have a reasonable plan for implementing it, and that is easily done.

• The bishop assigns someone to be ward administrator.
• The administrator is assigned to register with the site and report back before any information is uploaded.
• The administrator makes sure he is the only one on the site to start with.
• The bishop designates who will then tell the administrator who may have access to the site, and which rights they should have.

A reasonable ward implementation is thus not vulnerable to the threat being discussed. On the other hand, if there is an ad hoc approach to using this site, then there is some risk of abuse (a very low probability, but I will grant that it is nonzero). But anyone who takes that kind of cavalier attitiude towards confidential data is subject to a wide variety of threats on many other sites.

Alan_Brown wrote:...I believe this thread is discussing if websites not owned by the Church can be used 1) under Church policy; and 2) responsibly and safely.

The question I have is your #1 above, which I believe is the core question. Regardless of everything else, if it's an "approved" site by the Church, then I think we should be promoting it as such and encourage other units to participate. However, If it's not a site approved by the Church for LDS use, then we should make that known also. I just don't have the answer (yet).

Mikerowaved wrote:The question I have is your #1 above, which I believe is the core question. Regardless of everything else, if it's an "approved" site by the Church, then I think we should be promoting it as such and encourage other units to participate. However, If it's not a site approved by the Church for LDS use, then we should make that known also. I just don't have the answer (yet).

There are sites and programs available for the LDS community to use but many times the Church will not officially endorse them. These forums are a great place to find such sites and product. Not every product or site will the Church provide guidance on.

Tom

I am reminded of my mission president who once expressed exasperation with those elders who asked for his blessing on everything that they did, as opposed to those who sought to understand the rules and policies and implemented them as they felt best.

I highly doubt that SLC wants to command in all things.

There's a difference between being commanded in all things and moving out on your own in areas forbidden by the First Presidency. This is where my concerns are.

Mikerowaved wrote:There's a difference between being commanded in all things and moving out on your own in areas forbidden by the First Presidency. This is where my concerns are.

I am certainly a strong proponent of following policy set by the Church. But the letter you referenced forbids units from having their own web sites. It says nothing about using other sites. It seems to me that the question discussed in this thread turns on issues of privacy and the security of confidential records.

I can see how some people could read the letter and say it forbids units to sponsor web sites, but that other sites (such as returnandreport.org or ymyw.org) can be used. I can also see how the letter might be interpreted more broadly to prohibit the use of any sites for ward purposes. But since either reading is possible, it seems to me that it becomes a local decision. If the Church wants to clarify the policy one way or the other, we would all comply with the new clarification, but as it stands now, it is a matter of local policy unless it directly goes against the Church policy.

I'm for informing oneself on the policies, seeking understanding on them, and asking questions as appropriate. But not continuing to ask and ask when the people who set the policy are not specific - in essence demanding specifics when perhaps the authorities would rather we use judgment.

I think that when we pester people enough, we end up with a response that no one is happy with.

I doubt that anyone is suggesting that a person ignore the First Presidency. Remember, the stake from which my stake was split from did inquire and was given a nod of approval to go forward. Given that word, our current stake doesn't see a need to ask again.

(Kind of reminds me of children who keep asking parents for approval, almost guaranteeing a no in the end.)

tortdog wrote:I'm for informing oneself on the policies, seeking understanding on them, and asking questions as appropriate. But not continuing to ask and ask when the people who set the policy are not specific - in essence demanding specifics when perhaps the authorities would rather we use judgment.

Well said.

Tom

Just before the roll out of ymyw.org to the new stake, the SP put it on hold. He wants confirmation from the presiding seventy for explicit approval of ymyw.org, as opposed to relying on the permission granted to the prior stake by LDS Scouting Relationships.

So I will advise once I hear.

For the wards that came from the prior stake that used ymyw.org, it's kind of awkward. Those units are still using it for the time being, but depending on what Elder Anderson says they might have to stop using it.

I don't feel that I'm at liberty to disclose who stated this. But in connection with our stake's request for a "ruling" on ymyw.org the following was received from a general authority:

The official web site for the Church is lds.org. However, if stakes feel that they would like to use other web sites and it is cleared by their stake presidents, then they are okay. There are so many out there now, the Church is unable to monitor them all. Just encouraged to use your discretion via your stake president. There is no official position.

So we now wait for our SP to rule.

Hopefully that was communicated writing (rather then verbal).

Via e-mail!

tortdog wrote:I don't feel that I'm at liberty to disclose who stated this. But in connection with our stake's request for a "ruling" on ymyw.org the following was received from a general authority:



So we now wait for our SP to rule.

If that is, in fact, an official Church stance, that information needs to be communicated to all Stake Presidents. Stake Presidents only have the restrictive letters posted previously in this thread.

Brad O.

tortdog wrote:Via e-mail!

Print it out and stick it where you can find it - like in the back of your CHI.

Well, regarding a new "official" letter, the advice coming from this one GA could easily be read so that ymyw.org would not be a prohibited site under the original "official letter," since that original letter was never changed or revoked.

That was one of the points that was mentioned on this very thread - that sites similar to ymyw.org are not under the intended reach of that "official" letter prohibiting LDS web sites other than lds.org.

RussellHltn wrote:Print it out and stick it where you can find it - like in the back of your CHI.

Yeah, but the only thing that will matter is the decision of our SP - which we await. Is it wrong to pray for the "right" guidance on his behalf?

While I am only recently familiar with ymyw.org, I can certainly see its draw and why others have used it.

tortdog wrote: While I am only recently familiar with ymyw.org, I can certainly see its draw and why others have used it.

Get familiar with returnandreport.org as well.

It's my understanding that since the Church came out with their own stake/unit web sites that all other web sites that had been created and were being referenced as "official", were to be removed. The issue here is "official".

If I wanted to create my own web site that contained information about the church, including my own testimony, etc, etc. and post a disclaimer that the site wasn't officially associated with the Church, I could do that.

They simply want to control the official voice of the Church, which I can completely understand and support. Seems clear to me.

For those of us trying to read the tea leaves of church policy and guidance, this development answers few questions. There is no indication of why a stake president might choose to allow this web site. The only principle that one might generalize is that, at least within the reach of this GA's authority -- which tortdog may know but the rest of us do not -- stake presidents are free to interpret policy with no further guidance except inspiration.

Informed speculation in this forum has seemed to say that ymyw.org is allowable because it is not sponsored by a church unit, does not purport to represent the Church, and does not include data directly exported from MLS. But this guidance makes no reference to any of those principles.

Not to leave this completely in the dark, the advice comes from the General YM Presidency, as opposed to the priesthood authority, i.e., Seventy. Just as the YM is an "auxiliary" of the Church as opposed to a quorum with keys and such, I'm assuming the same for the General YM Presidency.

If this had come from the presiding authority over our area, then I think we could "cement" it down as policy - at least for the geographic area over which that Seventy presides and directs. (Speaking of which, the stake from which we came received direction for LDS Scouting Relations which similarly is not a priesthood authority.)

All in all, I'm assuming these people at the "higher" echelons of the Church are on good speaking terms with the priesthood authorities and that they know of what they speak. I think the statement is clear evidence that the Church is not going to start giving us a checklist of acceptable/non-acceptable web sites and that we should use our own judgment as supplemented/governed by local Church leaders.

Get familiar with returnandreport.org as well.

I had a look there, but it seems to just be a "numbers" tool - and sending out reminders by e-mail. We emphasize reporting on situations - text based. For example, I want a tool that allows me to track HOW a family is doing and the family's specific needs, which can then be reported to the quorum presidencies/leaders.

Am I missing something?

tortdog wrote:
I had a look there [at the Return and Report web application], but it seems to just be a "numbers" tool - and sending out reminders by e-mail. We emphasize reporting on situations - text based. For example, I want a tool that allows me to track HOW a family is doing and the family's specific needs, which can then be reported to the quorum presidencies/leaders.

Am I missing something?

I don't use RAR, but I have perused it. IIRC there is a free-form text field on the web form for the home teacher, which as I understand it sends an email to the presidency but does not store this text in a database. The form cautions against including "confidential" information, whatever that is, in the text.

Personally, that's about as far as I would want a reporting application to go. Just as I think the Church left such notetaking functions out of MLS deliberately, I think we also have to be careful about building systems that compile dossiers on members. So I would not want to see that institutionalized in a third-party application like this, either.

boomerbubba wrote:I don't use RAR, but I have perused it. IIRC there is a free-form text field on the web form for the home teacher, which as I understand it sends an email to the presidency but does not store this text in a database. The form cautions against including "confidential" information, whatever that is, in the text.

Personally, that's about as far as I would want a reporting application to go. Just as I think the Church left such notetaking functions out of MLS deliberately, I think we also have to be careful about building systems that compile dossiers on members. So I would not want to see that institutionalized in a third-party application like this, either.

How is that any different than what ymyw.org is doing? As I understand it, ymywg.org collections more information about a person than RAR does.

The reason the form cautions against entering confidentail information in the "Comment to Presidency" field is that anything confidential that needs to be communicated to the Presidency should be done so in person. The "Comment to Presidency" field is for things like, "This person has moved to xxx address." or "My phone number or the person who I'm teaching's phone number has been changed." or "We taught this person last week and brought a gift and he/she was very receptive to the message."

Brad O.

tortdog wrote:Not to leave this completely in the dark, the advice comes from the General YM Presidency, as opposed to the priesthood authority, i.e., Seventy. Just as the YM is an "auxiliary" of the Church as opposed to a quorum with keys and such, I'm assuming the same for the General YM Presidency.

If this had come from the presiding authority over our area, then I think we could "cement" it down as policy - at least for the geographic area over which that Seventy presides and directs. (Speaking of which, the stake from which we came received direction for LDS Scouting Relations which similarly is not a priesthood authority.)

All in all, I'm assuming these people at the "higher" echelons of the Church are on good speaking terms with the priesthood authorities and that they know of what they speak. I think the statement is clear evidence that the Church is not going to start giving us a checklist of acceptable/non-acceptable web sites and that we should use our own judgment as supplemented/governed by local Church leaders.

I had a look there, but it seems to just be a "numbers" tool - and sending out reminders by e-mail. We emphasize reporting on situations - text based. For example, I want a tool that allows me to track HOW a family is doing and the family's specific needs, which can then be reported to the quorum presidencies/leaders.

Am I missing something?

I think you are. This tool does allow you to track how a family is doing. You can either have your teachers use the free-form text field as mentioned previously or you can set up "Custom Contact Types." In addition to Visited and Not Visited, you can create additional Contact Types that "Count As" either Visited or Not Visited. For example, you could create a contact that indicates, "Needs Presidency Visit" if you want your teachers to inform you that a person would like the Presidency to visit them. It is extremely customizable.

Brad O.

Regarding R&R, the customization features are nice. And it will take some time for me to get familiar with it to see how it works.

Going back to the danger of information, though, the main stuff that I want to transfer (specifics on the family) are likely the most sensitive information out there. That info has to get transferred (and does via e-mail), but I could see a reluctance to have this information stored on a 3d party server (though e-mail does just that).

Even I have some reluctance there. But I want the tool to allow for it.

tortdog wrote:Regarding R&R, the customization features are nice. And it will take some time for me to get familiar with it to see how it works.

Going back to the danger of information, though, the main stuff that I want to transfer (specifics on the family) are likely the most sensitive information out there. That info has to get transferred (and does via e-mail), but I could see a reluctance to have this information stored on a 3d party server (though e-mail does just that).

Even I have some reluctance there. But I want the tool to allow for it.

I'd prefer it to be stored on Church servers, but that is not possible right now.

tortdog wrote:Going back to the danger of information, though, the main stuff that I want to transfer (specifics on the family) are likely the most sensitive information out there. That info has to get transferred (and does via e-mail), but I could see a reluctance to have this information stored on a 3d party server (though e-mail does just that).

Even I have some reluctance there. But I want the tool to allow for it.

My qualms in this case are not about a third party-server, but about compiling this stuff in a database. As I said, my surmise is that the Church left this functionality out of MLS quite deliberately.

To be clear, my issue is not with Return and Report. If I understand its functionality correctly, then I think this app gets the balance between privacy and need-to-know about right because it does not accumulate confidential notes in a database.

boomerbubba wrote:My qualms in this case are not about a third party-server, but about compiling this stuff in a database. As I said, my surmise is that the Church left this functionality out of MLS quite deliberately.

To be clear, my issue is not with Return and Report. If I understand its functionality correctly, then I think this app gets the balance between privacy and need-to-know about right because it does not accumulate confidential notes in a database.

As of this moment, it does store the "comments to the presidency" in the Activity Log in case something goes wrong with the Emails to the Presidency, but those comments are not supposed to be confidential. Adding Email queueing would eliminate the need to store this data in the log, so if doing this would make people feel more comfortable with confidentiality, I'd make that change.

tortdog wrote:I think the statement is clear evidence that the Church is not going to start giving us a checklist of acceptable/non-acceptable web sites and that we should use our own judgment as supplemented/governed by local Church leaders.

Which is fine if we had some guidelines to follow such as what the privacy concerns are.

boomerbubba wrote:My qualms in this case are not about a third party-server, but about compiling this stuff in a database. As I said, my surmise is that the Church left this functionality out of MLS quite deliberately.

Now we're stepping of the "tech" side and getting to the overall policy. When I was EQ Pres, I was frustrated by the lack of background information on families. We send a home teacher into a home without being able to advise of issues that he should be aware of to be of greater service. To prevent that in the mission field, the areas often have "area books" that let the new elders/sisters know what has gone on before. It saves us time and allows us to leverage on a body of knowledge.

So why not something similar with the families in our HT districts? It might make us uncomfortable that somewhere out there is a database (whether on paper or digital) with our information. But in reality, isn't that what we have for all of us in the eternity? 'Course, God is perfect and his recordkeeping is pretty secure. Ours? Not so much.

So the goal of mine has been to leave behind a "legacy" of information to allow the next EQ Pres and HTer know where we've been. But . . .

tortdog wrote:Now we're stepping of the "tech" side and getting to the overall policy....

So the goal of mine has been to leave behind a "legacy" of information to allow the next EQ Pres and HTer know where we've been. But . . .

I admit it is not an easy question, and hold my own opinion subject to wiser counsel. I do not purport to be a Church policymaker.

I do think there is a qualitative difference somewhere between ad hoc files for an EQP, similar to the "area book" concept you describe, and an institutionalized database that would be more permanent and presumably shared across top callings. Somewhere there is a line, and the creation of such a free-form database is where I get queasy. A tool like that can be misused, if just because no one remembers to purge old or inaccurate "information."

I was talking about this issue with my bishop, who said he recalls a time when such notes were passed down to successive ward leaders on paper as a routine practice, which has since been discontinued. I think the omission of such a database within MLS was no accident.

tortdog wrote:... in the mission field, the areas often have "area books" that let the new elders/sisters know what has gone on before. It saves us time and allows us to leverage on a body of knowledge.

So why not something similar with the families in our HT districts?

My high priests group leader has an "area" book. So does the elders quorum president. Their counselors and assistants keep one, as well. There is not a lot in it. (Just as there usually was not a lot in a missionary area book.) But the important information (at least to that priesthood leader) is in his notes, and we review it each month during our stewardship interview.

And personally, I think that is how it ought to work.

Part of me agrees - for if it's paper it's a little harder to duplicate and paper has a tendency of not lasting too long. That is why I have always been hesitant to enter this type of data in an electronic journal (or database) of some sort.

RonaldF, agreed. Times have changed considerably since this thread began. In today's world leaders, without consent, are giving away the privacy of others on bsa.org, facebook.com, youtube.com, etc.. without the consent of the individuals or the Bishop.

However, you need to learn more about ReturnAndReport.org (RAR) and how it works as it does not use MLS data.

The leaders are asked to seek approval from their Bishop who is the steward for the data. See RAR's about page.

Next they must build files to upload to RAR on their own. The information is limited to the household names. Phones #'s are optional.

So provided the Bishop's approval has been given and the information is limited to what is publicly available and does not contain any privileged data.

daddy-o wrote:RonaldF, agreed. Times have changed considerably since this thread began. In today's world leaders, without consent, are giving away the privacy of others on bsa.org, facebook.com, youtube.com, etc.. without the consent of the individuals or the Bishop.

However, you need to learn more about ReturnAndReport.org (RAR) and how it works as it does not use MLS data.

The leaders are asked to seek approval from their Bishop who is the steward for the data. See RAR's about page.

Next they must build files to upload to RAR on their own. The information is limited to the household names. Phones #'s are optional.

So provided the Bishop's approval has been given and the information is limited to what is publicly available and does not contain any privileged data.

Thanks for the information. Yes, I need to find out more about RAR. I was told that it used MLS info. I would still question its use if the information entered came from MLS in what ever form it was derived from. I question the posting of any church data on a non church server that is not approved by the individuals involved. Again just my opinion.

RonaldF wrote:Thanks for the information. Yes, I need to find out more about RAR. I was told that it used MLS info. I would still question its use if the information entered came from MLS in what ever form it was derived from. I question the posting of any church data on a non church server that is not approved by the individuals involved. Again just my opinion.

ReturnAndReport.org does not encourage or require uploading data from any official Church system. ReturnAndReport.org requires that those who use it agree to remove an individual's information upon their request.

Brad O.

Brad O. wrote:ReturnAndReport.org does not encourage or require uploading data from any official Church system. ReturnAndReport.org requires that those who use it agree to remove an individual's information upon their request.

Brad O.

That seems backwards to me. It shouldn't be put into the system unless the individual first agrees.

Ronald,

I'm telling you what RAR requires of you. You may take it a step further if you wish. Like someone said earlier, RAR only accepts public record data, so as long as information is removed upon request, I see no problem with it.

Brad O.

Brad O. wrote:Ronald,

I'm telling you what RAR requires of you. You may take it a step further if you wish. Like someone said earlier, RAR only accepts public record data, so as long as information is removed upon request, I see no problem with it.

Brad O.

The problem is that the members have no way of knowing that their information is being posted to a non church server. They trust that the church is protecting their information. I know that I am being very picky about this, especially considering the amount of information that is available online about all of us. We as church members and leaders should conduct ourselves at a higher standard. Just because the world does something doesn’t mean we should do it. If the leadership of the church says RAR is Ok, then I would be all for it. It appears to be a great tool. I guess every one has to do what they feel comfortable with.

RonaldF wrote:The problem is that the members have no way of knowing that their information is being posted to a non church server. They trust that the church is protecting their information. I know that I am being very picky about this, especially considering the amount of information that is available online about all of us. We as church members and leaders should conduct ourselves at a higher standard. Just because the world does something doesn’t mean we should do it. If the leadership of the church says RAR is Ok, then I would be all for it. It appears to be a great tool. I guess every one has to do what they feel comfortable with.

If you do not feel comfortable with your ward using RAR, you can feel free to ask them to discontinue it or, better yet, ask them to remove your name from it. However, I believe that the benefit far outweighs any concerns about privacy -- especially since we're only dealing with public record information. Anyone who does not want to participate does not need to use the system. Participation is totally optional.

In the 4 years that RAR has existed, I have only heard of 2 cases where a person did not like their name being stored on the website. In those cases, their names were promptly removed. The only other complaint I've heard was from 2 other individuals who felt that the name of the website was blasphemous. No matter what you do, you can't please everyone.

ReturnAndReport.org is not for everyone, but I continue to maintain it for those who are excited about it and continue to benefit from it.

Brad O.

Interesting on this conversation, as I have seen one instance on this forum in which a person has asked to "opt out" of the online LDS directory. Kind of the same deal, and just let people opt out if they want.

Using the updated guidelines (Church Internet policy, Handbook 2: Administering the Church (2010), 21.1.22), I would like to create a website (not a blog) to help me manage my group (or aux.). I was wondering if anyone the Church had webhosting capabilities or if anyone could recommend a good one (that's free).
Personal Internet Use

When you use blogs, social networks, e-mail, or other Internet technologies:

• Mention the Church and link to approved Church materials when appropriate. You may share or copy Church media—including images, videos, and text found on official Church websites—if permission to do so is indicated on the website. Typically a “share” button or link is provided to indicate that you may share content. You may also refer to the site Terms of Use for further details. You may ask for permission to use other Church media online by sending an e-mail to permissionrequest@ldschurch.org.
• Express your personal witness of the restored gospel as you feel impressed to do so, led by the Spirit. The message should be personal and not given as if you were speaking for the Church. Go to LDS.org and click Menu at the top middle of the page. Under The Church, click Sharing the Gospel Online for helpful information.
• Develop your own materials that effectively convey your message.
• Do not form groups or develop websites or blogs that give the impression that they officially represent or are sponsored by the Church.

Personal Internet Use in Church Callings

When used appropriately, electronic communication, such as e-mail and Internet postings, can help Church members coordinate the work of the Church, strengthen faith, and minister to the needs of others. However, electronic communication should not replace opportunities for in-person contact, such as interviews and stewardship reports.
The following guidelines apply if you create a personal website or blog or use other Internet tools as part of your Church calling:

• State that it is not an official Church website.
• Include your name and contact information as the person responsible for the website.
• Refer, as appropriate, to your calling and the name of the Church, along with the name of the local unit and organization in which you serve. However, do not state or imply that the website or the information is sponsored or endorsed by the Church.
• Place links, as appropriate, to official Church websites on your personal websites. These links may contain graphics with Church logos. However, do not imitate or use the Church logo in other ways.
• Obtain proper permission before using artwork, music, or other materials if permission is not indicated on the website you take it from.
• Understand and comply with privacy laws in the area where you live. Privacy laws typically require that people be notified and that they grant express permission before their personal information may be collected, shared, or used in public settings.
• Use personal information found in stake and ward directories or other Church records only for Church purposes. This information should be shared carefully and only with those who need to access it to fulfill Church callings and assignments.
• Store or display others’ personal information on your website, blog, social network, or other publically visible software application only after notifying each person and obtaining his or her express permission.
• Safeguard personal information. It should not be included in electronic messages, such as e-mail, text messages, or instant messages.

Hi everyone,
I found an App that improves home teaching reporting and gives us on line links to the home teaching message each month. One a family has been visited it even have a template to use for emailing home teaching reports.

Here's the thing it is not sanctioned by the church, yet if it was I am 100%coifident it would be a great success.

It goes with A of F 13. So I want to know will the church allow us to use such apps.

Regards
Tony

This is a very old thread and some things have changed. You can read the current policy at https://internet.lds.org. Pay attention to item #6 "Other people’s personal information must never be displayed."

There's also the matter of Meetinghouse Technology Policy, section 4.9.3 and 4.9.4.

Personally, I think inputting information about other members without their consent into a non-church website is a bad idea no matter what the motive.

Thank you for your feedback it is greatly appreciated.