"Hide" a publicly shared item in AGO?

Question

Hey all!

I'm wondering if there's a way to "hide" or limit the public's ability to find an item that's shared publicly in AGO.

For context, we created a S123 form to be used internally within our company, but not all employees have an AGO account. Thus, it needs to be shared publicly. I know it's not likely, but the company is worried about receiving throwaway submissions from the public.

I've heard that it may be possible to implement a CAPTCHA to try to deter bot activity, but is there any way to kind of "unlist" the form or make it hidden from AGO so that it's inaccessible without a direct link? I've heard that removing/excluding tags and keywords could help prevent the item from showing up in search results, but I'd love to know if there's any other method to prevent people from finding the form without a link.

Any help or suggestions are appreciated!

ODWC_GIS · Answer

No problem!  That was my solution after discussing with two other organizations that had similar problems and similar solutions.  The weird part of this workaround it that it does seem to work.  The main drawback being that it isn't impossible for the public to stumble upon the form.

A publicly-findable form isn't a major problem for us, save that some information uses technical terms that may be mistaken for other terms.  And I have been yelled at for using the term "endosperm" while discussing seeds -by someone who mistook the terminology for 'Patriarchal chauvinism' (?); I really don't understand some most people and their reactions to assumed inferences.

Your Survey123 Form may appear to be another random form hosted in the cloud.  You don't necessarily need to include any identifiable information.  You could URL encode the title of your organization into the link used by your staff to access the form- it'd be blank for anyone else accessing the document.  At that point, it'd be more like a survey template that is given form solely based on URL-encoded values passed to it each time the official URL gets used.  ...Brainstorming a bit there at the end.

But, Please Do pass this idea on to your team!  I know it can be improved upon!  My ham-handed proof of concept worked just well enough for my needs.

NikkiKuriata · Answer

Very clever way to filter out any unwanted submissions!!! I'll have to take this idea to my team and see what we think. Unfortunately isn't sounding like there's a way to actually limit the public from finding the form, but if we could at least identify responses we do vs don't want to consider, that seems like a type of win to me!

Thank you for sharing!!

ODWC_GIS · Answer

To the best of my knowledge, that isn't exactly possible.  "Security Through Obscurity" ...isn't really an option within the ESRI framework wherein you share an item with Everyone in AGOL.

If you don't mind your Survey Form/Questions being visible, but want to limit valid submissions to your own organization, I have a suggestion: a secret password.  It can't be "Swordfish," as that's the first thing I try when I see a password field.  ...And to discourage the general public from trying "Swordfish" too, we'll need to hide the password field as well.

What happens here is a Publicly-accessible Survey123 form created in Survey123 Connect:

Valid Users access the Form via a URL (with an encoded URL parameter) that loads in a predetermined "secret password."  Valid Users' submitted forms may be separated out from other form submissions.

Place the valid-access URL link inside your organization somewhere.  I use an intranet-type page.

Basic Blueprint:

In Survey123 Connect, open up the XLSForm.

Create a Text Field, and name it whatever you want.  Anything.  L337c0d3, as an example.

Set the field appearance to hidden.  Also make the field Read-Only AND Required.

In this example, I'm going to say that the correct password is Swordfish.

At the tail-end of the eventual hyperlink that allows access to your survey, just add &field:L337c0d3=Swordfish

Results:

Publishing the form for the world to see creates a few things. Within your own Survey-_____ AGOL Folder, there’ll be a Form and a Feature Layer (hosted) that show world/public sharing status; there may also be a Feature Layer (hosted, view) of submitted record locations just for AGOL. The Feature Layer (hosted) has a glowing blue crayon next to it, signifying that it is approved for “Public data collection.”
   The Feature Layer (hosted) that is used to collect survey response locations can be used to create hosted Views. A View is a re-interpreted item, subject to the limitations specified when building the initial View; changes may be made afterwards, if needed.
   Any Hosted Views may be updated from the Settings tab to include a filter that removes non-official values of L337c0d3.

I've used this basic structure for a couple of in-house critter surveys, and it seems to work pretty well so far.  Submitted responses are not visible to the world, and if we wanted to get creative, we could assign unique passwords to individual groups of employees to further group the responses (since it is a public survey, we didn't ask for who submitted the record; assigning passwords by region would allow us to see how wide-ranging each division collected information).  The creation of a final Hosted View to filter out all but Valid Users of the Survey is just the final QA/QC step.  While it is possible for a determined member of the public to find and fill the hidden L337c0d3 field, that last filter will catch those.

Eventually, I suppose I'll get around to posting some sterilized documentation of all of this.