A possible privacy issue with EPANET-Z
EPANET-Z is a modified version of EPANET which displays online maps/imagery as a background. This is a very useful tool which expands the capabilities of EPANET. The program, from Zonum Solutions, is downloaded about 30 times a month from this blog only.
It is clear that in order to fetch the background images the program must communicate with the the mapping services (Google, Yahoo and Virtual Earth) so an Internet connection is needed for the program to work. These mapping services have their privacy policies which usually nobody reads (see Google’s privacy policy for example). However, what is the privacy policy of Zonum Solutions? Well, you can find them here. This policy is about the privacy issues of the website but what about the software application like EPANET-Z?
Back in 2008, when I started to use EPANET-Z I know that some data is transferred to the mapping services but I also knew that they serve images (EPANET-Z is like a web-browser showing images) and the water distribution network is drawn in the application on-top of these images. Last week a colleague told me that EPANET-Z is not working well and there is an error message showing. When I ran the program I saw the following error message:
As can be seen in the URL field of this message, the program is accessing a web page over at Zonums server. This web page (opens in a new tab) loads the background images to the browser embedded in EPANET-Z. I guess there are some technical reasons why the program is communicating with Zonums server and not directly with the mapping services but this raises some privacy questions such as: what data is being sent to the server? what is collected? who has access to this data?
As far as I was able to check via web traffic monitoring tools, the water distribution network data is not transferred to the Internet. The program will mainly send the server the map coordinates needed to be shown. On the server side some data is being collected via Google Analytics and anther web statistics service (I think it’s by Yahoo). For those interested in browser privacy check out the Electronic Frontier Foundation’s (EFF) browser uniqueness tool.
I have communicated with the software author and was told that indeed maps communication is done through Zonum’s website since the maps services API’s key must match the developers domain. This is usually true for the free use tier. Additionally, anonymous usage statistics are collected.
As for the bug which started all this, it seems that Yahoo discontinued their map services in the previous form so the program can not load Yahoo maps. The author replaced the Yahoo maps with Bing Maps by Microsoft so now when the user selects Yahoo maps it’s actually Bing maps that are being shown.
Looking into the future, the author of EPANET-Z told be that a new version of the program is scheduled in the next few month. I recommend that a full disclosure regarding the data transfer and collection will be made.
The bottom line is that I will be continuing using the program but everyone should make their own choices.
To make request to the background tiles provider (Google, Bing maps, OSM, …) program must fetch data about coordinates of the map area bounding box. On every zoom&pan request must be done again. The program you are using must do it by design. Basicaly the php program is only reading your bounding box in EPANET, sending it to the map tiles provider and forwarding them back to EPANET as background image.
Regards, Alen
Alen, yes this is what I understand too. However, it would be better not to have this intermediate web site.
Elad:
Appreciate very much you thoughts on this. I have not “programmed” in at least 20+years, so I pose this question/issue from a conceptual/practical standpoint. When I have been involved in WDS analyses wherein “true/actual/real-world” coordinate identification may/can pose security issues, we have resorted to “coordinate shifts” thereby resorting in a “mathematical coordinate system” (i.e., 0 —> 100,000 m; 0 –> 1,000,000 ft) for display of hydraulic appurtenances and results. Could this same approach not be used here?
Morris, shifting the networks coordinates is easy. The problem is with the background maps. When you ask the maps provider for the maps you must give him the actual coordinates (at least the range requested).
Thank you! Much appreciate the explanation