November 2012 - arrl-odv - reflector.arrl.org

[arrl-odv:21170] Re: Potential Security Issues With Apple iOS
by G Widin 05 Nov '12

05 Nov '12

The concerns about data privacy raised by Dick Isely are sensible--but there is nothing about the QST application that makes it different from the thousands of other iOS applications available. Moreover, iOS is considerably less vulnerable than the millions of PCs around running various editions of Windows. Necessary details mentioned in this thread should be checked on. Kay's message strikes the right balance, I think. We definitely want to inform any user running an application we recommend about any use of their data, along with preferences that can allow or limit that. But if iOS users upgrade to v 6 (free) then they will be using a system with very few holes. iOS 6 is also what is required for users to download QST issues and retain them to be read offline. Like Cliff, I believe that Board involvement on this issue is unnecessary at this point. I note that none of this discussion so far includes any idea of involving our own IT folks, who are well aware of the issues and who could probably give us a balanced account of the facts of the situation, if we only asked. -- 73, Greg, K0GW On Fri, Nov 2, 2012 at 10:36 PM, Cliff Ahrens <cliff.ahrens(a)gmail.com>wrote: > I agree that Nxtbook should clarify the information which Harold requested > in [arrl-odv:21157]. If Nxtbook verifies that there is no personally > identifiable information tracked and that the information is standard web > analytics such as pages visited, then I am comfortable with going forward > with the iOS Digital QST app. This feature is in great demand among > members. The app will allow iPad/iPhone users to save the QST to their > devices so that it can be read when not connected to the Internet. Reading > the digital QST on a tablet such as the iPad is much more popular than > reading it on a computer screen!**** > > ** ** > > I agree that the tracking feature and the ability to disable it needs to > be clearly explained to users. Members are entitled to know what, if any, > information is obtained, and to be reassured that no personally > identifiable information is tracked. Members should also be given specific > instructions on how to disable tracking in the iOS Settings by going to > Settings/ QST/ and setting “Disable Tracking” to ON. (or whatever wording > staff thinks is the the most clear instructions).**** > > ** ** > > The original contract with Nxtbook included the specific Nxtbook charges > for the iPad/iPhone app (Exhibit A). As I recall it was $1500 one-time > setup, and $100 per issue. Harold can give you the specific details. > This contract was approved by the A&F committee under the authority > delegated by the Board. The minutes of the April 14, 2012 A&F meeting > included an update at minute 15, in the COO’s Operating Report, that > applications for the iPhone and iPad were expected by the October issue. > The digital QST app has been beta tested and works great. When the > privacy concerns are resolved, I think we should promptly release it. I > see no need for further Board action.**** > > ** ** > > Cliff K0CA**** > > ** ** > > *From:* arrl-odv-bounces(a)reflector.arrl.org [mailto: > arrl-odv-bounces(a)reflector.arrl.org] *On Behalf Of *dick(a)pobox.com > *Sent:* Friday, November 02, 2012 5:47 PM > *To:* arrl-odv(a)arrl.org > *Subject:* [arrl-odv:21167] Potential Security Issues With Apple iOS... > Details (long) > *Importance:* High**** > > ** ** > > 2 NOV 2012 - 1747 CDT > > To all ARRL Officers, Directors, and Vice Directors: > > Even though I am a heavy user of Information Technology, I have never been > a user of Apple devices of any type. Therefore, it has taken more time > than > I planned to research the potential security issues with the Apple iOS > digital QST application. > > This message consists of two parts; a brief discussion of the issues, > followed with a series of questions that should be answered before any > decision is made to publicly release and support the use of *our* Apple > iOS digital QST application. > > *Potential Security Issues With Apple iOS Digital QST Application > > *1. According to Harold Kramer, the Apple iOS QST App does send tracking > information to somebody. It is assumed that this information is > de-identified, only includes the current geographic location of the > user, and is sent to Apple.Com, or an Apple contractor. Without a > verified, detailed description (from Apple?) *of all of this data*, > there is no way of making a proper judgement of the user's data > security when using this application. > > 2. I understand the default setting of this "data tracking feature" is ON. > It can be turned OFF, but the labeling and wording used to control this > "feature" is not clearly understood. At the least, I suggest the > default setting for this tracking process should be OFF with a warning > displayed when the user chooses to activate it. > > 3. When the user stops using this QST App, it is still active and could > continue to send data as long as the user's device is turned on. I > think most iOS users do not know this is going on. > > 4. There is at least one Apple iOS hacking program available at > http://www.iphonetracker101.com/iphone-tracking-app > <http://www.iphonetracker101.com/iphone-tracking-app%A0>that can be > used to view and record keystrokes and phone audio. I suspect there > are also one or more Apple iOS hacking programs that enable the > insertion of program (trojans) that will command the targeted Apple > iOS device send specified data to anonymous third party(s) without > the knowledge of the device user. > > *Questions That Should Be Answered Before Releasing the Apple iOS Digital > QST Application > > *1. Harold Kramer told me that Chris Imlay has vetted this contract, but > I still don't know who is the contractor. Who is the contractor? > What are we paying for this application? > > 2. What data is being collected? I can understand pages-read data that > would be of used by ARRL staff to improve magazine content. The same > goes for clicks on active links to track advertising response. > > But if things like the reader's current location, the reader's use of > other applications, any financial or personal transactions by the > reader, > the reader's keystrokes, etc. are being sent out... the ARRL should not > be receiving this information. We already have the user's ARRL > membership > and ham radio license data. What more do we need? > > 3. Is this application is sending data to third parties - without the > user's > knowledge or agreement? Depending on the data being sent, the ARRL > could be held liable for damages. > > 4. Is there a clearly worded, easily accessed, option allowing the user to > permanently stop this data collecting? > > I have probably missed some points and I welcome comments and suggestions > on these issues. Here is one final question for my fellow directors. > > 5. Do you think the ARRL Board of Directors should formally approve this > IT project? In view of our past IT problems, I believe we should vote > on releasing *and* supporting this Apple iOS digital QST application. > > 73 - Dick Isely, W9GIG > > > > **** > > _______________________________________________ > arrl-odv mailing list > arrl-odv(a)reflector.arrl.org > http://reflector.arrl.org/mailman/listinfo/arrl-odv > >

3 2

[arrl-odv:21173] Re: Potential Security Issues With Apple iOS... Details (long)
by Chris Imlay 05 Nov '12

05 Nov '12

Dick, you raise good questions, a few of which I can provide some information about. The bulk of them should be answered by HQ staff. I did review and offer a number of edits to the Nxtbook contract a year ago that provided for web hosting of digital QST. It had at the time optional services that we could request for Apple applications. My review of that contract was not with respect to the deal points, which were negotiated by others, but with respect to protecting ARRL contractually. There is a need for an online privacy policy to supplement ARRL's general privacy policies that we have had in place for some time. I am working on that now with Bob Inderbitzen, Maria Somma, Mike Keane, Harold Kramer and Magdalena Owczarska. They tell me that the information collected is as follows: Cookies o “Session cookies” are used to store information as users navigate the online store (i.e. adding items to the shopping basket), membership application, and many other forms and applications used throughout the site. Session cookies are removed at the end of the activity…such as completing an online publication order. Some of our website services will not work at all unless a user permits the use of session cookies. o “Persistent cookies” are used to help the website ‘remember’ user information and settings when visited in the future. While users can delete these cookies from their computer or device at any time, any settings such as stored username and login information will have to be reentered when they return to the site. · Individual IP addresses are collected and used in aggregate for website analytics. These are never associated with any personal information. This data makes it possible for ARRL to measure, understand and optimize web usage. We use Google Analytics for much of our website analytics. With that understanding we have created an online privacy policy draft that is now being modified and reviewed for accuracy. We can send it round to the Board for review before putting it online if you wish. 73, Chris W3KD Christopher D. Imlay Booth, Freret, Imlay & Tepper. P.C. 14356 Cape May Road Silver Spring, Maryland 20904-6011 (301) 384-5525 telephone (301) 384-6384 facsimile W3KD(a)ARRL.ORG -----Original Message----- From: dick <dick(a)pobox.com> To: arrl-odv <arrl-odv(a)arrl.org> Sent: Fri, Nov 2, 2012 6:47 pm Subject: [arrl-odv:21167] Potential Security Issues With Apple iOS... Details (long) 2 NOV 2012 - 1747 CDT To all ARRL Officers, Directors, and Vice Directors: Even though I am a heavy user of Information Technology, I have neverbeen a user of Apple devices of any type. Therefore, it has taken moretime than I planned to research the potential security issues with the Apple iOS digital QST application. This message consists of two parts; a brief discussion of theissues, followed with a series of questions that should be answered beforeany decision is made to publicly release and support the use of ourApple iOS digital QST application. Potential Security Issues With Apple iOS Digital QSTApplication 1. According to Harold Kramer, the Apple iOS QST App does sendtracking information to somebody. It is assumed that thisinformation is de-identified, only includes the current geographic locationof the user, and is sent to Apple.Com, or an Applecontractor. Without a verified, detailed description (from Apple?) of all ofthis data, there is no way of making a proper judgement of the user'sdata security when using this application. 2. I understand the default setting of this "data trackingfeature" is ON. It can be turned OFF, but the labeling and wording used tocontrol this "feature" is not clearly understood. At theleast, I suggest the default setting for this tracking process should be OFF witha warning displayed when the user chooses to activate it. 3. When the user stops using this QST App, it is still active andcould continue to send data as long as the user's device is turnedon. I think most iOS users do not know this is going on. 4. There is at least one Apple iOS hacking program available at http://www.iphonetracker101.com/iphone-tracking-app that can be used to view and record keystrokes and phone audio. Isuspect there are also one or more Apple iOS hacking programs that enablethe insertion of program (trojans) that will command thetargeted Apple iOS device send specified data to anonymous third party(s)without the knowledge of the device user. Questions That Should Be Answered Before Releasing the Apple iOSDigital QST Application 1. Harold Kramer told me that Chris Imlay has vetted this contract,but I still don't know who is the contractor. Who is thecontractor? What are we paying for this application? 2. What data is being collected? I can understand pages-read datathat would be of used by ARRL staff to improve magazinecontent. The same goes for clicks on active links to track advertisingresponse. But if things like the reader's current location, thereader's use of other applications, any financial or personal transactionsby the reader, the reader's keystrokes, etc. are being sent out... the ARRLshould not be receiving this information. We already have theuser's ARRL membership and ham radio license data. What more do weneed? 3. Is this application is sending data to third parties - without theuser's knowledge or agreement? Depending on the data beingsent, the ARRL could be held liable for damages. 4. Is there a clearly worded, easily accessed, option allowing the userto permanently stop this data collecting? I have probably missed some points and I welcome comments and suggestions on these issues. Here is one final question for my fellowdirectors. 5. Do you think the ARRL Board of Directors should formally approvethis IT project? In view of our past IT problems, I believewe should vote on releasing and supporting this Apple iOS digitalQST application. 73 - Dick Isely, W9GIG _______________________________________________ arrl-odv mailing list arrl-odv(a)reflector.arrl.org http://reflector.arrl.org/mailman/listinfo/arrl-odv

1 0

[arrl-odv:21172] Joyce and Bill
by Sumner, Dave, K1ZZ 04 Nov '12

04 Nov '12

I know you are all concerned about our Board colleagues and members in the area impacted by Sandy. In a note to Hudson Division members that I released a couple of hours ago Joyce reported that "Vice Director Hudzik and I have no power in our homes, but we are grateful that we have not sustained any major damage." Their Internet services also have been disrupted. 73, Dave K1ZZ in Ho Chi Minh City

1 0

[arrl-odv:21167] Potential Security Issues With Apple iOS... Details (long)
by dick＠pobox.com 03 Nov '12

03 Nov '12

2 NOV 2012 - 1747 CDT To all ARRL Officers, Directors, and Vice Directors: Even though I am a heavy user of Information Technology, I have never been a user of Apple devices of any type. Therefore, it has taken more time than I planned to research the potential security issues with the Apple iOS digital QST application. This message consists of two parts; a brief discussion of the issues, followed with a series of questions that should be answered before any decision is made to publicly release and support the use of our Apple iOS digital QST application. Potential Security Issues With Apple iOS Digital QST Application 1. According to Harold Kramer, the Apple iOS QST App does send tracking information to somebody. It is assumed that this information is de-identified, only includes the current geographic location of the user, and is sent to Apple.Com, or an Apple contractor. Without a verified, detailed description (from Apple?) of all of this data, there is no way of making a proper judgement of the user's data security when using this application. 2. I understand the default setting of this "data tracking feature" is ON. It can be turned OFF, but the labeling and wording used to control this "feature" is not clearly understood. At the least, I suggest the default setting for this tracking process should be OFF with a warning displayed when the user chooses to activate it. 3. When the user stops using this QST App, it is still active and could continue to send data as long as the user's device is turned on. I think most iOS users do not know this is going on. 4. There is at least one Apple iOS hacking program available at http://www.iphonetracker101.com/iphone-tracking-app that can be used to view and record keystrokes and phone audio. I suspect there are also one or more Apple iOS hacking programs that enable the insertion of program (trojans) that will command the targeted Apple iOS device send specified data to anonymous third party(s) without the knowledge of the device user. Questions That Should Be Answered Before Releasing the Apple iOS Digital QST Application 1. Harold Kramer told me that Chris Imlay has vetted this contract, but I still don't know who is the contractor. Who is the contractor? What are we paying for this application? 2. What data is being collected? I can understand pages-read data that would be of used by ARRL staff to improve magazine content. The same goes for clicks on active links to track advertising response. But if things like the reader's current location, the reader's use of other applications, any financial or personal transactions by the reader, the reader's keystrokes, etc. are being sent out... the ARRL should not be receiving this information. We already have the user's ARRL membership and ham radio license data. What more do we need? 3. Is this application is sending data to third parties - without the user's knowledge or agreement? Depending on the data being sent, the ARRL could be held liable for damages. 4. Is there a clearly worded, easily accessed, option allowing the user to permanently stop this data collecting? I have probably missed some points and I welcome comments and suggestions on these issues. Here is one final question for my fellow directors. 5. Do you think the ARRL Board of Directors should formally approve this IT project? In view of our past IT problems, I believe we should vote on releasing and supporting this Apple iOS digital QST application. 73 - Dick Isely, W9GIG

3 2

[arrl-odv:21166] IN-News
by Kustosik, Lisa, KA1UFZ 02 Nov '12

02 Nov '12

IN-Newsletter Vol. 35, No. 44 October 31, 2012 -- Covers the period October 21-27. Upcoming Meetings and Events Director/Vice Director Elections November 16 Administration and Finance Committee: November 17 @ 8:30am - Newington CT Membership & Volunteer Programs Reported by Dave Patton, NN1N DXCC Branch Applications Paper/Fieldcheck Processing Time 4 Weeks W1AW On Wednesday October 24, Matt Strelow, KC1XX, and Andrew Toth, of XX Towers <http://www.xxtowers.com/> Inc., were on hand for the autumn antenna and tower inspections. In addition to the annual autumn inspections, they also repaired some of the antennas at W1AW. Strelow and Toth replaced the 160-meter dipole located atop the Rohn 65 (120') tower. The antenna - used for both station broadcasts and visitor operations - was damaged in a windstorm a few weeks ago. The center insulator on the station's 80-meter cage also required replacement. The old insulator shorted internally when one of the choke's ferrite beads inside the insulator became saturated. A donated quadrifilar antenna for 137 MHz was installed on the North tower. This antenna replaced the 137 MHz turnstile antenna used for NOAA satellite reception. The station's 70 cm crossed-yagi satellite antenna - a Cushcraft 416TB - also required attention. Specifically, the coaxial baluns and phasing lines had to be replaced. Since these parts are no longer readily available, Joe contacted Cushcraft and was supplied with the lines' technical data. From this data, he constructed new baluns and lines. In addition to constructing new balun/phasing lines for the Cushcraft 416TB antenna and readying materials for the antenna installations, he also constructed a simple 10-meter groundplane antenna and 80-meter dipole for use at HQ station W1HQ. Joe worked the early afternoon/night shifts on Monday and Tuesday for the vacationing Scott Gee. Field Organization/Public Service Team During the past week, SKYWARN and ARRL Field Organization members and ARES teams (among many others) including Emergency Coordinators, Section Managers and Section Emergency Coordinators across the U.S. East Coast heeded warnings to get ready for Hurricane Sandy. Several Headquarters Staff members were also involved in storm preparation activities and relayed information related to storm preparations to our News Editor. An Amateur Radio operator from the East Bay Section completed requirements to become an Official Observer this past week. Harassment was reported on a 20 meter net, and another case was noted on 75 meters. More investigation is underway. Interference to a 2 meter repeater near Kansas City, MO, was reported. This is being checked out by local OOs. Regional OOs were also alerted. Complaints regarding 14313 kHz and interference to a 20 meter DX net were forwarded to Laura Smith at the FCC. We learned that jamming has been occurring on 2 meter repeater in Alabama. More monitoring is underway. So far, reports seem to indicate that a case of interference on 7245 kHz has been mutually resolved. Chuck Skolaut answered questions dealing with the Novice class license, operating overseas and antenna restrictions were handled. Chuck also handled one morning code practice run at W1AW and conducted one tour of headquarters. Education Services Reported by Debra Johnson, K1DMJ Education & Technology Program Nathan McCray K9CPO and Mark Spencer WA8SME represented Education Services at Pacificon. They reported a constant stream of visitors at the booth and plenty of engaging discussions about new ETP curriculum. Forums on Getting Started with PIC Programming, Exploring Our World through Remote Sensing and Ham Radio, and Wireless Technology Literacy in the Classroom were very well attended. We are receiving quite a few requests to be added to our notification list for the 2013 Teachers Institute schedule. Since these are coming from teachers who are not hams we are assuming the recent article about the ETP in the National Science Teachers Association journal have generated at least some of this interest. Continuing Education Program We announced changes to qualifications and requirements of Field Instructors and Online Mentors serving our Amateur Radio Emergency Communications training program. We also announced changes to the pre-requisites for the Public Service and Emergency Communications Management course (EC-016). We edited all website materials to reflect these changes and developed the administrative tools we'll need to support the new requirements. In addition we completed an editing overhaul of the EC-016 course and re-published it on the ARRL website. ARISS The story about the ARISS contact at Northland Preparatory school in Flagstaff, AZ in November QST (p. 75) has attracted a lot of attention. We will be reprinting the article to use a promotional piece for the program. October contacts have included contacts in Turkey, Malaysia, Italy, Spain, and Luxembourg. Contacts with US schools/organizations were the following: Oct 13: Pacificon, Santa Clara, CA via telebridge with Akihiko Hoshide, KE5DNI. Oct. 19: Wattsburg Area School District, Erie, PA via telebridge with Sunita Williams, KD5PLB Oct. 20: National Scouting Museum, Irving, TX via telebridge with Sunita Williams, KD5PLB Oct. 26: East Falmouth Elementary School, East Falmouth, MA, direct with Sunita Williams KD5PLB. Oct. 30 South Florida Science Museum, West Palm Beach, FL, direct with Akihiko Hoshide, KE5DNI. Oct. 30: Southern Tier Catholic and Archbishop Walsh Academy, Olean, NY via telebridge with Sunita Williams, KD5PLB. Oct. 30 Cumberland Elementary School, West Lafayette, IN direct with Kevin Ford KF5GPP. Activity Counts: August Sept. New License Class Listings 41 29 New License Instructor Registrations 23 31 New Teacher Registrations 5 2 EC-001 Field Exam Sessions 3 1 EC-001 Online Student Enrollments 31 28 Sincerely Compiled by, Lisa Kustosik, KA1UFZ Assistant to the CEO Hamfest/Member Contact/ARRL Representative/Meetings/Vacations Holiday 11/22-11/23 Holiday Holiday 12/24-12/25 Holiday Leona Adams 11/2 Vacation Steve Ford 11/26 Vacation Scott Gee 11/9-11/15 Vacation `` 12/21-12/26 Vacation Joel Hallas 10/31 Vacation Dan Henderson 11/16-11/21 Indiana Section Convention, Ft. Wayne, IN / Vacation Amy Hurtado 11/1-11/2 Vacation `` 12/17-12/21 Vacation Gail Iannone 11/2-11/6 Sick leave `` 12/21-12/31 Vacation Bob Inderbitzen 11/21 Vacation Harold Kramer 11/5 Vacation Barry Shelley 11/20-11/21 Vacation `` 12/17-12/19 Vacation Dave Sumner 10/30-11/10 IARU Region 3 Conference & Administrative Council meeting. Larry Wolfgang 11/7-11/21 Sick leave

1 0

[arrl-odv:21157] QST Dedicated iOS App -- Status Update
by Kramer, Harold, WJ1B 01 Nov '12

01 Nov '12

Hi, Here's an update on the launch of the dedicated QST app for Apple iOS devices. We will not be launching to our target group of 10,000 members until the beginning of next week. There are a couple of reasons for this. The storm set us back a day or so in our work. The membership and publications sales support staff are busy dealing with publication and membership orders that have accumulated over the last few days. We need these entered as quickly as possible, so we do not want the staff dealing with launch app support issues at the same time. Also, it is not smart to launch a new product at the end of the week since member support staff is not here during the weekend. In addition, because of concerns that have been raised, we are still seeking answers from Nxtbook about the tracking features of the iOS app. We need clarification from them about exactly what they are tracking. We believe that there is no personally identifiable information tracked and that the information is standard web analytics such as what pages were visited. It is common for publishers to track user traffic patterns, page views, click-through rates, and search terms that users enter into a search utility to monitor the flow of traffic and make improvements to the publisher's content. The tracking feature can be easily disabled by the user but the wording on the app setting is confusing. [Disable Tracking needs to be ON]. We will not launch to the general membership until we clarify this issue. We will also alert our members about this when we send the launch emails. We will place information about the tracking feature in the text of the email along with a link to a web page that explains how it is used. We will also be adding language from the ARRL Privacy Policy to the app. This policy will require revisions as we publish more digital content. The app itself is working well for those who are using it on their iPhones, iPads and iTouch. The app is of course, optional. Members can always view, but not download, digital QST through the Safari (or any other) browser on an iOS device. Nxtbook has also improved access to the magazine on a mobile web browser-delivering a native-app-like experience. We'll send out more detailed information next week. In the meantime, please feel free to informally let members know that the QST app is available in the Apple Apps Store. We don't have a problem with that as long as it is not in a written "public" communication just yet. 73, Harold Harold Kramer, WJ1B Chief Operating Officer ARRL -the national association for Amateur Radio 225 Main Street Newington, CT 06111 (860) 594 -0220

4 3

[arrl-odv:21163] ARRL - Request from KA2ANF - NNJ
by Joyce Birmingham 01 Nov '12

01 Nov '12

Good Morning, For those of you close to the east coast, please can I ask a favor? We have had several emails from folks who would like to 'self-deploy' to NNJ and SNJ. My SEC in NNJ is being inundated with emails from all over from folks wanted to help. I know that there is a message on the ARRL Website that has the information below about deployment to disaster affected areas, but I don't think that many people are reading it or can read it. Please use whatever means you can to get the word out that anyone who is interested in helping must coordinate efforts through following means: (See below): If you are able to use any other means of communications, such as TWITTER, please do so. Thanks, Joyce KA2ANF - Director Hudson Division FROM ARRL.org website: The ARRL is recommending two websites to those radio amateurs who want to volunteer for response-and-relief efforts for Hurricane Sandy:

1 1

[arrl-odv:21162] Re: QST Dedicated iOS App -- Status Update
by dick＠pobox.com 01 Nov '12

01 Nov '12

31 OCT 2012 - 2325 CDT I have been reading the various messages concerning the Apple ipad/iphone application (app) for reading digital QST. I support making digital QST available for users of these devices. However, I have serious reservations about inherent user information privacy and security issues with this current unreleased ipad/iphone app for downloading and reading digital QST. Until these issues have been thoroughly discussed and resolved, this app should not be released for any reason. We caught hell from many of our members when we switched to our new ARRL web site before it was truly ready for use. It appears to me that we are about to make another IT mistake. This application, in its present configuration, will make users vulnerable to loss of privacy, identity theft, and even financial loss. I regard this as a potential breach of our fiduciary responsibility. I plan to post a message detailing these issues tomorrow evening. In the meantime, I ask that the discussion be continued on ODV and the release of this app be delayed until the entire board has voted to release it. Dick Isely, W9GIG

1 0