System type and location.
So how does Flurry Analytics work? I don't know, but I can make a wild guess.
On casual inspection, the Browser User Agent string (unless changed or obscured) will give you a reasonable idea of the browser and OS being used, and the IP address of the device/NAT gateway will in give away the identity of the company for anyone who has a fixed IP range registered with IANA (Apple appear to own the class A address "17", and with a little digging, it should be possible to work out which of several probable gateways on the "17" network a device is connecting from).
This will allow you a good guess of company, location and device type. If you happen to have access to a web site that is being visited (say, Google, or one of the banner advert sites), then you can drop tracking cookies in the browser to make a stab at tracking individual systems.
OK, I admit that this is a simplistic view, but this is the result of a five minute think over a cup of tea. If someone with real forensic networking skills applied all of their knowledge, I'm sure that you could get much more information, and this is without dropping a single piece of code on the system. Allowing yourself to use a java applet (OK, not on an iPad) would almost certainly allow you to find out much more about the system running the code.
Chances Steve is just p*ssed about his developers not obscuring the User Agent string!