Congregation Sharing is an optional feature that can be enabled inside New World Scheduler by a Congregation Administrator. It allows you to automatically share and synchronize all New World Scheduler data with other appointed brothers in your congregation.
Congregation Sharing does NOT store confidential information online. Congregation Sharing is fully compliant with sfl.
Congregation Sharing is compliant with EU GDPR, UK GDPR and other similar Data Protection Regulations.
Congregation Sharing is used by tens of thousands of Jehovah’s Witnesses worldwide, including elders, pioneers, missionaries, Bethelites and even Branch Committee members.
- Is Congregation Sharing safer than email?
- Is Congregation Sharing safer than Google Drive, OneDrive or Dropbox?
- Is Congregation Sharing safer than SMS, WhatsApp, Viber or similar?
- Is Congregation Sharing safer than online programs or web-based apps?
Does the Branch ‘approve’ of New World Scheduler and Congregation Sharing?
Is Congregation Sharing safe?
Yes, Congregation Sharing is very safe.
Congregation Sharing uses the latest and best-practice security, including Client Authorization, Two-Factor Authentication (2FA), End-to-End Encryption (E2EE), Secure Data Encryption, Strong Passwords, Data Transfer Security, Server Security and Data Retention and Expiry policies.
NW Scheduler and NW Publisher app are much safer than email, SMS, web-based systems, Google Drive, OneDrive, Drop Box, WhatsApp, Viber, Google Sheets, etc.
Is Congregation Sharing safer than email?
Yes, NW Scheduler Congregation Sharing is much safer than email.
Emails and Mail Servers are generally an insecure and unsafe way to transfer data, and we recommend brothers be very cautious about sharing congregation information via email, for at least the following reasons:
- Emails and Mail Servers is almost always not encrypted. All data is freely viewable.
- For example, Gmail, Hotmail, Outlook do not use encryption
- Email is by default sent from server to server in clear text that can be read by anyone while in transit.
- Mail Server data can be easily accessed by any Server or Email Admin, at any time.
- For example: Gmail, Hotmail, Outlook have thousands of Server and Email Admins that can access this data.
- Email and Mail Server data is usually permanently kept on a mail server, even if you delete the data.
- For example: Most large companies have data retention policies that require keeping data for many years.
- Most Email and Mail Servers have built-in “backdoor access” for government agencies. This means they can very easily access any data at any time.
Is Congregation Sharing safer than Google Drive, OneDrive or Dropbox?
Yes, NW Scheduler Congregation Sharing is much safer than Google Drive, OneDrive or Dropbox.
Google Drive, OneDrive and Dropbox are not considered safe and secure locations to store data, for at least the following reasons:
- Data stored is not encrypted, and does not use end-to-end encryption.
- Data stored is permanent. Even if you delete the data, it is not really deleted, but remains on their servers for an indefinite amount of time.
- The worldly companies who own these cloud storage services are primary interested in making money. They usually have very poor security and privacy practices.
- The default security settings on most cloud services do not enforce 2-factor authorization, device verification or other best-practices.
- Cloud storage services have built in “backdoor” access so governments can access the data.
- Consumer based cloud storage services are regularly hacked using a variety of means, e.g. phishing attacks, social engineering attacks, viruses, bad links, etc.
Is Congregation Sharing safer than SMS, WhatsApp, Viber, etc?
Yes, NW Scheduler Congregation Sharing is much safer than SMS, WhatsApp, Viber, etc.
Some messaging applications are more secure than others, and some even offer end-to-end encryption.
However, message applications are much less secure than NW Scheduler for at least the following reasons:
- Metadata from your messages are not encrypted (e.g. the who, when, where). This data sent, kept and analyzed by parent companies, who use this information to make money.
- The worldly companies who own messaging applications are primary interested in making money. They usually have very poor security and privacy practices.
- E.G. Facebook owns WhatsApp. The majority of their revenue comes from selling users data.
- Most messaging applications collect a lot of data about you. Even if you just install and open it once, it will collect data such as your operator, the unique identifier of your phone, your location, what apps you have installed, etc.
- Most messaging applications have backups which are not encrypted.
- Most messaging applications do not permanently delete your messages, even if you “delete” them. They are permanently stored on their servers and can be retrieved even years later.
- Most messaging applications have built in “backdoor” access so governments can access the data.
Is Congregation Sharing safer than online programs or web-based apps?
Yes, NW Scheduler Congregation Sharing is safer than online programs or web-based apps.
While web-based applications are convenient, we recommend brothers be cautious about using web-based or cloud-based apps to store congregation information.
Web-based applications store all congregation and person data permanently online and generally do not use end-to-end encryption.
Web-based applications by nature must allow any website administrators, developers and potentially support personnel full access to everyone’s data. This means they can potentially access every single persons data in every single congregation. We do not feel comfortable with this, nor do we feel this complies with the principles and direction in sfl.
Web-based applications are also much more prone to hacking or data theft. They provide a single point for a hacker to attack and obtain every single persons data in every single congregation.
Web-based applications also rely on the honesty and integrity of worldly hosting companies, sometimes located in countries with poor data integrity records.
Web-based applications can even be subject to government or company subpoenas, whereby the software company or hosting company must provide access to everyone’s data.
New World Scheduler is not web based. All data is stored on your local computer, and we use end-to-end encryption. This means your data is truly safe. It cannot be opened or accessed by our developers, support staff, or anyone else.
Does the Branch 'approve' of New World Scheduler and Congregation Sharing?
New World Scheduler is not an official app or program created by the Watchtower Society. Therefore, New World Scheduler is obviously not “endorsed by”, “recommended” or “officially approved” by the organization.
This makes sense. The organization does not and will not create a list of books, songs, movies, websites, programs or apps we can or cant use. (see w14 7/15 14)
World Headquarters (WHQ) has been in contact with us several times over the years NW Scheduler has been in operation. They are fully aware of New World Scheduler and has no objections to its use, nor any objections to the use of Congregation Sharing.
New World Scheduler and our NW Publisher app are both used by hundreds of thousands of Jehovah’s Witnesses worldwide every single day.
This includes elders, pioneers, missionaries, Bethelites and even Branch Committee members.
Please feel free to read the comments of many spiritually mature elders around the world, including in your local area.
Data Sharing Security
New World Scheduler contains an optional feature called Congregation Sharing that can be enabled by your local elders if they choose to do so. By default, Congregation Sharing is disabled, but it can be enabled in just a few minutes.
Congregation Sharing automatically shares and synchronizes data between approved brothers, allowing all appointed brothers to quickly and easily keep up-to-date with what is happening in the congregation.
Congregation Sharing does not store sensitive or confidential information online, therefore is fully compliant with sfl. Rather, if you choose to enable Congregation Sharing, non-confidential data strings are saved online for distribution to other appointed brothers in your congregation.
World Headquarters (WHQ) has been in contact with us several times over the years NW Scheduler has been in operation. They are fully aware of New World Scheduler and has no objections to its use, nor any objections to the use of Congregation Sharing.
Security Overview
Congregation Sharing implements the following best-practice security processes:
- Congregation Sharing uses OAuth 2.0 authorization, including Access Tokens and Refresh Tokens, to provide secure credentials to approved brothers in your congregation.
- Congregation Sharing uses Two-Factor Authentication (2FA) to ensure the person connecting is authorized.
- New World Scheduler uses both data obfuscation and data encryption to ensure any transferred data strings are meaningless unless viewed inside New World Scheduler.
- New World Scheduler uses end-to-end encryption (E2EE), which means your data is fully secured before it is transferred to other appointed brothers and cannot be opened by anyone outside your congregation.
- New World Scheduler uses strong passwords to generate your 256-bit encryption key.
- A random and unique 128-bit Initialization vector (IV) and 128-bit salt are used for each piece of data transferred, each time the data is transferred.
- New World Scheduler developers or support personnel do not and can not access your encryption keys or congregation data. It is therefore technically impossible for them to decrypt, view, see or edit your data under any circumstances.
- Data transfer uses secure and encrypted TLS 1.2 connections.
- The only “data” that ever leaves your local computer are randomised and meaningless strings.
- Each congregation can choose which sharing server they use and where it is located. Data is only ever transferred to and from this one server to approved brothers in your congregation. Data on the sharing server you select is not backed up, saved or transferred anywhere else. Data on the sharing server cannot be accessed by anyone outside of your congregation.
- After selecting a server location, each congregation is assigned a unique and obfuscated storage location to transfer the encrypted data strings. Access to this location is restricted to approved Shared Persons who must first authenticate using your unique Congregation ID, Congregation Sharing Password, 2-Factor Authentication and OAuth 2.0 authorization token.
- If you Disable Sharing, the meaningless encrypted strings are immediately and permanently removed from the sharing server.
Authorization
Congregation Sharing uses OAuth 2.0 authorization, including Access Tokens and Refresh Tokens, to provide secure credentials to approved brothers in your congregation. This means only authenticated users with the correct credentials can access your encrypted data strings.
Secure credentials only allow access to your congregation, meaning authenticated users cannot even access another congregations encrypted data strings.
Two-Factor Authentication (2FA)
Congregation Sharing uses Two-Factor Authentication (2FA). This means in addition to knowing the Sharing Region, Congregation ID and Congregation Sharing Password, a persons Email address is also used to identify and verify they are allowed to connect to the congregation.
A Congregation Administrator will create Person records and enter these brothers Email addresses into New World Scheduler. Next, they add the brothers to Congregation Sharing as Shared Persons.
These brothers can now connect using a 3-step process:
- Connect. The brother must have the correct Sharing Region, Congregation ID and Congregation Sharing Password to connect to your Congregation.
- Identify. They must use their Email to Identify who they are. This must exactly match their Person record.
- Verify. Their computer must be Verified with a Verification Code sent to their Email.
This is very similar to the security processes of jwpub.org and is an extremely secure system.
End-to-End Encryption
End-to-End encryption is the gold standard for securing sensitive data in digital communications.
Data is encrypted on your local device before being sent, then remains encrypted the entire time during transfer, and is only decrypted by the other computer.
Encryption keys are stored on your local device only. They are never transferred and never seen by any servers.
Most computer systems and programs do not use end-to-end encryption, but both NW Scheduler and NW Publisher do.
Secure Data Encryption
NW Scheduler uses end-to-end (E2E) symmetric encryption. The encryption algorithm is Advanced Encryption Standard (AES) with a password-based key derived by the Argon2id algorithm in conjunction with SHA-256.
Encryption key length is 256-bit.
A random and unique 128-bit Initialization vector (IV) and 128-bit salt are generated by RandomNumberGenerator for each piece of data transferred, each time the data is transferred.
Strong Passwords
Strong Passwords of at least 12 characters, including lowercase, uppercase, numbers and symbols are enforced and required.
Congregations may choose how often to rotate passwords and how long before existing devices must re-verify.
Data Transfer Security
Data is transferred using TLS 1.2.
Both TLS 1.0 and TLS 1.1 are disabled.
Server Security
Server Locations
- North America East: Located in South Carolina, USA
- North America Central: Located in Oklahoma, USA
- North America West: Located in Los Angeles, USA
- Europe North: Located in Frankfurt, Germany
- Europe South and Africa: Located in Zurich, Switzerland
- Asia Pacific: Located in Sydney, Australia
- South America: Located in São Paulo, Brazil
How does Congregation Sharing work?
Here is a real-world example of how Congregation Sharing works:
Elder A
- Elder A opens New World Scheduler on his own computer and schedules a Christian Life and Ministry Meeting part.
- Your local New World Scheduler obfuscates the data so it has no meaning outside of New World Scheduler.
- New World Scheduler encrypts the obfuscated data using a unique encryption key generated by your own computer. This creates a set of seemingly random and meaningless strings.
- New World Scheduler creates a secure connection to your selected transfer server.
- New World Scheduler uploads these randomised strings to your secured congregation folder on the transfer server.
Elder B
- Elder B opens New World Scheduler on his computer. His computer authenticates with the transfer server using the Congregation ID, Congregation Password and his Member PIN.
- If authenticated, his computer creates a secure connection to your congregation folder and checks for any updated strings.
- If any updated strings are detected, they are retrieved from the New World Scheduler transfer server.
- New World Scheduler uses his unique locally generated encryption key to decrypt the randomised strings.
- New World Scheduler interprets the data converting it back into meaningful information.
Does New World Scheduler share data using Email?
New World Scheduler does not use Email or a Mail Server to share or transfer data.
Using Email or a Mail Server to transfer data is relatively insecure and unsafe.
We recommend brothers be very cautious about sharing congregation information via email, for at least the following reasons:
- Emails and Mail Servers is almost always not encrypted. All data is freely viewable.
- For example, Gmail, Hotmail, Outlook do not use encryption
- Email is by default sent from server to server in clear text that can be read by anyone while in transit.
- Mail Server data can be easily accessed by any Server or Email Admin, at any time.
- For example: Gmail, Hotmail, Outlook have thousands of Server and Email Admins that can access this data.
- Email and Mail Server data is usually permanently kept on a mail server, even if you remember to click Delete.
- For example: Most large companies have data retention policies that require keeping data for many years.
- Most Email and Mail Servers have built-in “backdoor access” for government agencies. This means they can very easily access any data at any time.
- For example, google “Edward Snowden”.
“Email by default is not and was never intended to be a secure mechanism for sending data,” says Dr. Catherine J. Ullman, Senior Information Security Analyst for UB. “Although you need credentials to log in and access the e-mail in your mailbox, email is by default sent from server to server in clear text that can be read by anyone while in transit.”
New World Scheduler does not use Email or a Mail Server to share or transfer data.
Is New World Scheduler web-based? Does it share data via web servers? Can the data be accessed online?
New World Scheduler is not web-based. It must be installed locally on your computer.
We recommend brothers be cautious about using web-based or cloud-based apps to store congregation information. While web-based applications are convenient, we personally feel the direction and principles found in sfl do not permit web-based applications to store congregation data.
Web-based applications store all congregation and person data permanently online and generally do not use end-to-end encryption.
Web-based applications by nature must allow any website administrators, developers and potentially support personnel full access to everyone’s data. This means they can potentially access every single persons data in every single congregation. We do not feel comfortable with this, nor do we feel this complies with the principles and direction in sfl.
Web-based applications are also much more prone to hacking or data theft. They provide a single point for a hacker to attack and obtain every single persons data in every single congregation.
Web-based applications also rely on the honesty and integrity of worldly hosting companies, sometimes located in countries with poor data integrity records.
Web-based applications can even be subject to government or company subpoenas, whereby the software company or hosting company must provide access to everyone’s data.
New World Scheduler is not web based. All data is stored on your local computer, and we use end-to-end encryption. This means your data is truly safe. It cannot be opened or accessed by our developers, support staff, or anyone else.
Data Retention and Expiry
New World Scheduler strictly follows the branch Congregation Records Retention Policy (see sfla).
Obsolete data is removed as per sfla direction. This is automatically performed on January 1.
Old and unused congregations are automatically removed after 4 months of inactivity.
Data Removal and Deletion
NW Scheduler users can immediately and permanently delete all local data by clicking the Delete Congregation button and then uninstalling NW Scheduler.
- Note: You will need to manually delete any backups you have saved elsewhere.
Congregation Administrators can immediately and permanently delete all shared data by either Disabling Congregation Sharing, or clicking the Delete Congregation button and ticking “Remove from Congregation Sharing”.
Unused congregations are automatically deleted from Congregation Sharing after 4 months.
Data Removal and Deletion
NW Scheduler users can immediately and permanently delete all local data by clicking the Delete Congregation button and then uninstalling NW Scheduler.
- Note: You will need to manually delete any backups you have saved elsewhere.
Congregation Administrators can immediately and permanently delete all shared data by either Disabling Congregation Sharing, or clicking the Delete Congregation button and ticking “Remove from Congregation Sharing”.
Unused congregations are automatically deleted from Congregation Sharing after 4 months.
EU GDPR, UK GDPR and other similar Data Protection Regulations
Congregation Sharing is compliant with EU GDPR, UK GDPR and other similar Data Protection Regulations.