Zoom

The Federal Trade Commission finalized a settlement with Zoom Video Communications, Inc., over allegations it misled consumers about the level of security it provided for its Zoom meetings and compromised the security of some Mac users.

The FTC complaint alleges that the company was less careful with sensitive consumer and small-business data than it let on. Since 2016, Zoom allegedly deceived consumers by telling them that the company used 256-bit end-to-end encryption—a security system that employs a highly complex security key to prevent communications from being read by anyone but the sender or the recipient.

In its proposed five-count complaint, the Commission alleges that Zoom violated Section 5(a) of the Federal Trade Commission Act. First, the proposed complaint alleges that Zoom misrepresented to users since at least June 2016 that they could secure all Meetings with end-to-end encryption. End-to-end encryption is a method of securing communications where an encrypted communication can only be deciphered by the communicating parties. No other person—not even the platform provider—can decrypt the communication because they do not possess the necessary cryptographic keys. Contrary to its representations to users, Zoom did not provide end-to-end encryption for all Meetings because Zoom's servers maintained the cryptographic keys that could allow Zoom to access the content of its customers' Meetings.

The Federal Trade Commission today announced a settlement with Zoom Video Communications, Inc. that will require the company to implement a robust information security program to settle allegations that the video conferencing provider engaged in a series of deceptive and unfair practices that undermined the security of its users.

As of July 2019, Zoom had approximately 600,000 paying customers, and approximately 88% of those customers were small businesses with ten or fewer employees.[11] In securing these customers, the Commission charges that Zoom made express representations regarding its encryption offerings that were false. Yet, the proposed order does not require Zoom to take any steps to mitigate the impact of these statements we contend are false. Zoom is not required to offer redress, refunds, or even notice to its customers that material claims regarding the security of its services were false. This failure of the proposed settlement does a disservice to Zoom's customers, and substantially limits the deterrence value of the case.

Videoconferences lacked the end-to-end encryption that the company promised to consumers

In its complaint, the FTC alleged that, since at least 2016, Zoom misled users by touting that it offered “end-to-end, 256-bit encryption” to secure users’ communications, when in fact it provided a lower level of security. End-to-end encryption is a method of securing communications so that only the sender and recipient(s)—and no other person, not even the platform provider—can read the content.

10. To be clear, I am not suggesting that Zoom's conduct giving rise to this matter and Facebook's order violations are equivalents. Nor do the companies share similar business models. But in terms of the importance of consumer privacy, hundreds of millions of users are entrusting Zoom with some of their most sensitive interactions, and they are doing so from their homes.

Zoom installed software, called ZoomOpener, on Mac users’ computers. This software bypassed a Safari browser security setting and put users at risk — for example, it could have allowed strangers to spy on users through their computer’s web cameras. Or hackers could have exploited the vulnerability to download malware onto — and take control of — users’ computers. If users deleted the Zoom app, the ZoomOpener remained, as did these security vulnerabilities. Zoom could re-install the app without the user’s permission and without letting them know. (Apple removed the ZoomOpener web server from users’ computers in 2019.)

Most weekday mornings, my two elementary-age children log on to school through Zoom. Their faces, voices, and occasional silliness are all captured in the Zoom classroom. I try not to dwell on what might occasionally float through in the background of their camera or microphone, but, like many families, we've had moments in our home where we are very much live. After my older kids settle in for class, my own workday begins in earnest and typically involves a series of confidential discussions often made possible through a Zoom meeting. My experience is not unique: Zoom expanded from 10 million daily users last December to over 300 million daily participants this spring. Zoom's overnight expansion from a modest video conferencing company to a company providing critical infrastructure for business, government, education, and social connection raises important questions for the Commission's obligations to protect consumer security and privacy.

The FTC just announced a case against videoconferencing service Zoom about the security of consumers’ information and videoconferences, also known as “Meetings.” The FTC claimed that Zoom failed to protect users’ information in a variety of ways:

The FTC also alleged that the company compromised the security of some users when it secretly installed software, called a ZoomOpener web server, as part of a manual update for its Mac desktop application in July 2018. The ZoomOpener web server allowed Zoom to automatically launch and join a user to a meeting by bypassing an Apple Safari browser safeguard that protected users from a common type of malware. Without the ZoomOpener web server, the Safari browser would have provided users with a warning box, prior to launching the Zoom app, that asked users if they wanted to launch the app.

Zoom's Practices

FTC Gives Final Approval to Settlement with Zoom over Allegations the Company Misled Consumers about Its Data Security Practices

Third, the proposed complaint alleges that Zoom misrepresented that, for users who opted to store recordings of their Zoom Meetings in Zoom's secure cloud storage (“Cloud Recordings”), Zoom would process and store such recordings in Zoom's cloud “once the meeting has ended.” Contrary to its representations to users, Zoom kept Cloud Recordings on Zoom's servers for up to 60 days, unencrypted, before transferring them to Zoom's secure cloud storage, where they are then stored encrypted.

Zoom increased security and privacy protections in its videoconferencing platform to settle a Federal Trade Commission complaint that the company misled consumers about those features, the FTC announced.

Fourth, the proposed complaint alleges that Zoom violated Section 5 when it installed a local hosted web server (called “ZoomOpener”) on 3.8 million users' Mac computers. In July 2018, Zoom updated its application for Mac desktop computers by secretly deploying a web server onto users' computers. The ZoomOpener web server was designed to circumvent a security and privacy safeguard in Apple's Safari browser. Apple had updated its Safari browser to help defend its users from malicious actors and popular malware by requiring interaction with a dialogue box when a website or link attempts to launch an outside App. As a result of the new browser safeguard, users who clicked on a link to join a Zoom Meeting would receive an additional prompt that read, “Do you want to allow this page to open ` zoom.us' ?” If the user selected “Allow”, the browser would connect the user to the Meeting, while clicking “Cancel” would end the interaction and prevent the Zoom application from launching. The ZoomOpener web server was designed to avoid this extra prompt. It also remained on users' computers even after users deleted the Zoom application, and would automatically reinstall the Zoom app—without any user interaction—if the user clicked on a link to join a Zoom Meeting or visited a website that had a Zoom Meeting embedded in it.

As set forth in the Commission's complaint, Zoom engaged in a series of practices that undermined the security and privacy of its users. First, we allege Zoom made multiple misrepresentations about its use of encryption. As charged in the complaint, Zoom made false statements about its encryption being “end-to-end,” the level of encryption that it offered, and the time it took to store recorded meetings in an encrypted server.1

Zoom Video Communications, Inc. will be required to implement a robust information security program to settle FTC allegations that the video conferencing provider engaged in a series of deceptive and unfair practices that undermined the security of its users.

In 2021, Zoom agreed to pay $85 million in a class action suit for sharing user data with unauthorized third parties such as Facebook, Google, and LinkedIn and misrepresenting the strength of its end-to-end encryption protocols.

Video-conferencing firm Zoom has agreed to pay $86m (£61.9m) to settle a class action privacy lawsuit in the US.

"You agree to grant and hereby grant Zoom a perpetual, worldwide, non-exclusive, royalty-free, sublicensable, and transferable license and all other rights required or necessary to redistribute, publish, import, access, use, store, transmit, review, disclose, preserve, extract, modify, reproduce, share, use, display, copy, distribute, translate, transcribe, create derivative works, and process Customer Content and to perform all acts with respect to the Customer Content .... for the purpose of product and service development, marketing, analytics, quality assurance, machine learning, artificial intelligence, training, testing, improvement of the Services, Software, or Zoom’s other products, services, and software, or any combination thereof."

A recent change to the app's terms of service added language asking users to agree to share their data to train AI.

Does anyone read software services’ terms and conditions? Lawyers do, but even their eyes have been known to glaze over. So until recently, no one had noticed that Zoom had changed its Terms of Service (ToS) in March 2023. Under its new terms, Zoom claimed the right to use your video, audio, and chat data for its artificial intelligence (AI) programs.

In the letter, obtained by NPR, Brown said Zoom had made "deceptive" claims to users that their communications would remain private. Brown said Zoom incorrectly suggested its service offered end-to-end data encryption, which means that communications couldn't be accessed by anyone other than the sender and the recipient at any point.

Zoom has responded to the particular criticism of its security with multiple public efforts to address the concerns. After initially claiming that its platform provides end-to-end encryption for all its conversations, Zoom later said some encryption was in fact absent from some online messaging tools. “While we never intended to deceive any of our customers, we recognize that there is a discrepancy between the commonly accepted definition of end-to-end encryption and how we were using it,” wrote Oded Gal, the chief product officer for Zoom Video, in an April 1 blog post.

An Apr. 3 report by The Citizen Lab, a research organization at the University of Toronto, found a number of shortcomings in Zoom’s security, including some that made it particularly vulnerable to China. It found that Zoom’s encryption scheme “has significant weaknesses,” including routing some encryption keys through Chinese servers, and that its ownership structure and reliance on Chinese labor could “make Zoom responsive to pressure from Chinese authorities.”

A powerful Senate Democrat is asking the Federal Trade Commission to investigate Zoom for deceptive practices, adding to the growing chorus of concerns over the popular video chat software's privacy and security flaws.

Zoom, the widely used teleconferencing service, has been receiving a lot of scrutiny for the way it handles the digital privacy and security of its users. A flurry of new revelations in recent days could make some consumers second-guess whether they want to use the platform at all.

The video-conferencing firm has long been criticised for its approach to its security.

On Tuesday, Zoom CEO and founder Eric Yuan announced that the company would be cutting nearly 15% of its entire workforce, saying goodbye to roughly 1,300 employees.

In addition to these unfair and deceptive practices, which the Commission charged as law violations, there has been extensive public reporting on several other Zoom practices that raised serious privacy concerns. For example, Zoom business customers who subscribed to a service called “LinkedIn Sales Navigator” had access to LinkedIn profile data about other users in a meeting—even when the other user wished to remain ( printed page 72657) anonymous.[5] Additionally, Security researchers found that Zoom-meeting video recordings saved on Zoom's cloud servers had a predictable URL structure and were thus easy to find and view.[6] And of course there was widespread coverage of “Zoom-bombing,” in which uninvited users crashed Zoom meetings.[7] Zoom took steps to address these vulnerabilities after they surfaced by changing naming conventions, permanently removing the LinkedIn Sales Navigator app,[8] and requiring meeting passwords as the default setting for more Zoom users,[9] but these problems suggest Zoom's approach to user privacy was fundamentally reactive rather than proactive.

Zoom Chief Operating Officer Aparna Bawa disclosed the changes to staff in Jan. 29 memo, stating that the company “recognized that we need to change the way we approach both DEI and learning and development” and would be “partnering closely with well-established and well-regarded DEI firms who work closely with tech companies.”

In an internal note to employees, chief operating officer Aparna Bawa claimed that, in lieu of an internal team, Zoom would bring on DEI consultants who would focus on inclusion. Per Bloomberg, Bawa also said that Zoom had to “change its approach to DEI.” In a statement to Fast Company, a Zoom spokesperson said, “Zoom remains committed to DEI and ensuring its principles remain firmly rooted in our DNA across our entire company.”

The company reacted quickly to those issues, but bad privacy news has continued to mount, with Zoom users filing a class-action lawsuit in California concerned about the Facebook sharing, the New York state attorney general looking into alleged security lapses, and several researchers reporting software vulnerabilities that could put consumer information at risk.

Last week, Consumer Reports found that Zoom’s privacy policy seemed to leave the company free to use video and other user content for targeted advertising and other business purposes. Over the weekend, the company revised its privacy policy to say that’s off-limits. It also removed commonly used Facebook tracking software from its mobile app, in response to an article published on the tech news site Motherboard.

Several security vulnerabilities have been reported. One problem could compromise Windows passwords, while a problem with Zoom’s “Company Directory” setting could cause the platform to share personal email addresses inadvertently with other users—potentially hundreds or thousands of them. Another researcher pointed out a bug that could allow an attacker to take over the camera and mic on a Mac. A similar flaw was fixed last year.

Zoom has agreed to pay $150 million to put to rest investors' allegations that the videoconferencing provider misled them by stating that it offered end-to-end encryption, according to proposed terms of a deal filed in California federal court Tuesday.

At Zoom, birthing parents now get 18 weeks of paid parental leave, down from 22 to 24, and non-birthing parents get 10 weeks, down from 16, a spokesperson for the video-conferencing company confirmed to Business Insider.

Zoom Video Communications Inc. has met with regulators from the US, European Union and other jurisdictions to outline concerns about allegedly anticompetitive behavior by Microsoft Corp.

Zoom stores a plethora of user information critical to forensic investigations.