Can source data be extracted from a VTPK?

[KansasDASC]

Posting this here because I can't seem to find any answers anywhere. If I use a shapefile at the desktop level that contains sensitive data and publish it as a VTPK to our AGO and then make it public so that it's visibile in a web app, can someone extract the source data from it? Esri says that the VTPK is a vector representation of the data, but that doesn't answer: "Where does the data go?", "Can someone with some know-how hack the VTPK to get at the data?".

I have not seen anything that tells me that someone can not extract the data nor are they able to extract it. Just want to know whether the data is published with it or not.

[jcarlson]

Not really, no. When the data is tiled, a single feature may be represented by multiple different tiles, and it will be cut by any tile lines, so lines and polygons are not likely to retain the correct geometry.

Further, only attributes that are specifically requested will included in the vector tile pack. If your lines or polygons include labels, then the label field would be there. Attributes that are configured as "highlighted" in the field configuration in Pro will also be included.

Otherwise, though, your vector tiles are devoid of any of the source data. And it's worth noting that Esri publishes vector tiles at a deprecated version of the Mapbox vector tile style spec, and when it packages your features, it's not retaining your attributes as key/value pairs. Symbology styles are stored as "_symbol", not as the attribute/expression, and no actual value, just a number.

Now, to your other question: can someone with know-how "hack" the data out? Kinda sorta, but again, they'll only be able to see the data you're loading into the tiles. Here's me loading a vector tile layer in QGIS and looking at a specific feature.

I can select, copy, and paste features from the tiles. But given that the tiles have cutlines, and the scale at which I copy the feature will completely change what I get. The short version is that getting useful data out of vector tiles would be a lot of work, and most likely is not worth the effort.

[DavidPike]

I believe attributes can now be copied across to some property of the VTPK on publishing but I can't say I've done it myself.  I don't think any attributes are copied unless specifically selected, however I can't give you a reassuringly definitive answer.

You can browse the individual bundles by opening the .VTPK in 7Zip File Explorer or similar.  If you know the bundle encoding I guess you could search the files for some attribute strings etc. but I wouldn't say that's going to be conclusive either.    

[KansasDASC]

Thanks for the responses. They're not definitive, but they do help in revealing whether our concerns are justified. At least one of the layers in question in the VTPK is a point layer which wouldn't be split due to tiling as in your example, but the other layers are polylines. We do have labeling on and thus those attributes would be packaged which is at least partially concerning. It looks like we might need to end up authenticating if we want to include these data.

Thanks!