Encrypt and password-protect the blank form definition on the device

Ideas
1

What high-level problem are you trying to solve?

When a form is downloaded from the server (ODK Central or KoboToolbox) to a tablet running Collect, the blank form is stored on the device as plain XML. Anyone with physical access to the device can copy that XML off via USB or a file manager and read the full form logic. For organisations that invest heavily in form design, that XML is intellectual property.

Any ideas on how ODK could help you solve it?

The ideal outcome: a form can be transmitted encrypted from the server to the device and remain encrypted and password-protected at rest on the tablet, so that a copy pulled off the device is unreadable without the password.

  • Mark a form as "protected" on the server (a setting in Central / the XLSForm settings sheet).
  • The form definition is encrypted in transit and stored encrypted in Collect's storage, rather than as plain-text XML.
  • Collect decrypts the form into memory only at runtime, gated by a form-level password (entered once per session, or configured via a QR code / managed configuration so enumerators don't handle the password directly).
  • A copy of the on-device file is therefore ciphertext and useless without the key.
2

ODK is open source and freely sharing our work with others is at the core of what we do so this kind of protection is unlikely to become a key focus for us. In general, we encourage organizations to share their forms and expertise so that we can all get to better outcomes together.

As you mentioned at Prevent form copy off device - #5 by Rusti, a recommended approach currently would be to issue devices that you control to data collectors so that you can lock them down.

This may strike you as overly idealistic but perhaps you could see if there is an opportunity to deliberately share the forms in a way that can help position you as an expert and expand your reach. Some examples:

If none of these ideas match your needs, you could consider adding a way to block access to form definitions in a fork of ODK since it is available for you to extend as you wish.

That said, we do agree that there is a need for greater protection of captured data and Entities as @Stephen_K_ojwang mentioned at Prevent form copy off device - #10 by Stephen_K_ojwang and that's an aspect we're actively exploring options for.