Security and Privacy Concern about Logos4 Phonning Home

Core interface technology of L4 seems to be an increasing integration of Logos based computers interacting with private computers.  The only thing that guarantees privacy is trust toward the ethical  behavior of Logos employees and their technology.   The price for increased bells, whistles, and pretty technology maybe a theoretical problem called privacy.   If one wants to understand corporate benevolence try to sell your license.

Jim Towler said:

Others have spoken of their concerns about their study notes, prayer lists, or specific search needs getting uploaded to Logos, when that content may be extremly private, and with the ability to cause harm to a third party.

I am one of those Jim, who have raised this and value my private data.

I wouldn't put any plain text into any PC/ElectronicGizmo "with the ability to cause harm to a third party" even if it had no internet connection

Should you decide to, then I can only suggest you adopt a personal cyper, as once coded ( only you know about your code) you could put "Spoke to Bob Smith about his "Lifestyle Choices", if anyone gained access they would be clueless as to what exactly you mean.. and if thats not enough could be recorded as some other innocuous thing: "Ice Cream Cravings","Fishing Tackle","Train Set","Painting" or whatever , but likewise only you know the REAL decode key.

If its that private, I personally would not be recording it except  in a private paper journal, and even there if its really sensitive it would be coded..

However, having had a harddrive die on me, the fact I am was able to get back up-to-date data immediately when reinstalling was a great benefit, it is also very helpful especially when you travel.

The sad reality is the danger is more likely to come from your local data, someone you know who also knows Bob Smith, accessing your PC when you walk away leaving it unprotected (to get your coffee, restroom, wc, etc), rather than the Logos (server) end

Whilst I also agree NO should mean NO, have come round to seeing the benefits of the cloud.. especially when mobile..

Jim Towler said:

1) Run the command "Update Now"
2) Command "Sync Now"
3) Go to the Home Page (to change your prefered Bible)

Why would you run the commands if you didn't want to over-ride your global Internet setting? It's unlikely that you could run these commands by accident.

I agree that the Home Page should be restricted from using the internet if that setting is off, if an homepage can't be generated without Internet then a message to that effect should be displayed. As a work-around you can change the top bible on your priority list and that will do the same as using the tool on the home page.

Jim Towler said:

I am almost at the point I am considering adding a firewall rule so I can place a 100% block on the program(s) used by Logos4. I can then enable/disable the rule as required.

This seems like a reasonable solution. If I had privacy concerns in my use of any program, I would pursue this route (especially in the case of missionaries in closed countries). Even if Logos said that the Use Internet switch shut of all network access, it's a prudent decision to have a second layer of security in the firewall.  Plus it would give you more fine-grained control than I suspect Logos would considered implementing themselves (for simplicity's sake).

Jim Towler said:

Sadly, that model fails at some point. We are called to a higher standard sometimes. Don't tell anyone, no matter what!

P.S. Logos is in fact a great model of a company that one can trust, and YES, you can sell and transfer your Logos license. Really: They are a great company. But this is NOT what my original post is about.

Jim, Although many may think your concerns extreme, they are still valid concerns if you happen to be a Pastor using your Logos software to help counsel -per your fictional example. Logos does go further than many banking institutions in securing your privacy. I also believe Logos employees are, on the whole, trustworthy. But it only takes one failure in the wall of security to facilitate a loss. Other corporations have lost millions of private records in one security breach.  But realistically any thieves or snoopers will be looking for a way of financial gain and most juicy gossip is worthless unless it can be used for blackmail purposes. This would not lessen the pain from loss of trust and privacy. So for total security you either need to avoid synching at all (unreasonable due to the software design) or avoid putting any personal identifiable information in your notes(difficult.) 

Check out this for a little reassurance about Logos security: http://www.logos.com/about/sitesecurity
And your privacy: http://www.logos.com/about/privacy

Chuck P. said:

If I had very personal counseling/prayer records on my computer I would use something very simple, like Notepad to keep them.   I would not put those type of records/data in Logos anymore than I would put them in Facebook.....but, that's just my opinion....

<rant>I watch these threads with some amount of astonishment at the total lack of understanding about the meaning and importance of privacy in our lives. I suspect this is going to hit home at some point in the future, but it's going to take a lot more than a few lectures on a board to convince people just how important this stuff is. It would be a good exercise for every pastor on this board to read a good security blog on a regular basis--for instance, Bruce Schneier.</rant>

Now, let me point out a specific answer to the suggestion above--just don't keep private data in the software. Let me ask--what, specifically, do you classify as "private data?" Did you include the metadata as well as the data? Let me throw out an example. You're the pastor of a large church. Someone sees Sally walk into your office. An hour later, she walks out with tear stains running down her face. This person contacts someone else, who happens to, somehow, have access to your logos layout snapshot. Looking at these, they find the verses you've referenced during Sally's visit all relate to adultery.

So what's private about when Sally walks into and out of your office? And what's private about what you looked up in your Bible software? This is the slippery slope of metadata. And this is where google, for instance, makes their living; collecting metadata about you, and turning it into actionable information.

Ah, but Logos would never release such information. Which is just saying that we have to trust Logos, which is just saying we have to trust people.

Ah, but no-one would ever go to this sort of trouble to find something out. Really? If you think this, you totally underestimate the level of evil resident in human beings.

Look, folks, I know most of you won't take this seriously. I know most people think, "if I've done nothing wrong, I've nothing to hide." Great, but remember that hiding doesn't always have to do with "doing something wrong." Or those who say, "I'm willing to die for my faith." Great, but are you willing to live for your faith, even if it means hiding your faith so you can reach and teach others?

Let's not poo-poo these privacy concerns.

Russ

Richard DeRuiter said:

For this and other reasons, I don't use Logos' prayer list

I suspect most of us who know enough about computers know about the importance of care in storing data, the only information anyone will get if they hack into my synchronised files will be ideas and thoughts and as I'm not planning a major book and I'm also not sure how original they are the risk for me is pretty low.

There is however a contradiction between an EULA that says:

Richard DeRuiter said:

DO NOT
STORE HIGHLY CONFIDENTIAL INFORMATION IN THE SOFTWARE

And a software package that includes a prayer list.

I don't think that it would be unreasonable to assume that a lot of Pastors could miss the statement in the EULA and fall into the 'trap' that Jim has described.

Richard DeRuiter said:

My point is that confidentiality is primarily a user issue.

Which is why I don't let anyone use my personal user on my personal PC because when all is said and done the biggest risk for anything confidential that I store on my PC is it falling into the hands of someone who can make sense of it and the reality is that someone who knows me is more likely to make sense of it than someone in Bellingham!