Privacy and security issues
Zoom has been criticized for "security lapses and poor design choices" that have resulted in heightened scrutiny of its software.[57][4] The company has also been criticized for its privacy and corporate data sharing policies.[58][59][60] Security researchers and reporters have criticized the company for its lack of transparency and poor encryption practices. Zoom initially claimed to use "end-to-end encryption" in its marketing materials,[61] but later clarified it meant "from Zoom end point to Zoom end point" (meaning effectively between Zoom servers and Zoom clients), which The Intercept described as misleading and "dishonest".[62]
In March 2020, New York State Attorney General Letitia James launched an inquiry into Zoom's privacy and security practices;[63] the inquiry was closed on May 7, 2020, with Zoom not admitting wrongdoing, but agreeing to take added security measures.[64] In the same month, a class-action lawsuit against Zoom was filed in the United States District Court for the Northern District of California. According to the lawsuit, Zoom violated the privacy of its users by sharing personal data with Facebook, Google, and LinkedIn, did not prevent hackers from disrupting Zoom sessions, and erroneously claimed to offer end-to-end encryption on Zoom sessions. Zoom settled this lawsuit for $86 million.[65]
On April 1, 2020, Zoom announced a 90-day freeze on releasing new features, to focus on fixing privacy and security issues on Zoom. On July 1, 2020, Yuan wrote a blog post detailing efforts taken by the company to address security and privacy concerns, stating that they released 100 new safety features over the 90-day period. Those efforts include end-to-end encryption for all users, turning on meeting passwords by default, giving users the ability to choose which data centers calls are routed from, consulting with security experts, forming a CISO council, an improved bug bounty program, and working with third parties to help test security. Yuan also stated that Zoom would be releasing a transparency report later in 2020.[66][67][68]
In May 2020, the Federal Trade Commission (FTC) announced that it was looking into Zoom's privacy practices.[69] The FTC alleged that since at least 2016, "Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers' meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised."[70] On November 9, 2020, a settlement was reached, requiring the company to implement additional security measures.[71]
In December 2020, Zoom announced that it was under investigation by the U.S. Securities and Exchange Commission (SEC) and the United States Attorney for the Northern District of California and that it had received a subpoena in June 2020 from the United States Attorney for the Eastern District of New York requesting information on the company's interactions with foreign governments and political parties. Both federal prosecutors also sought information and documentation about security and privacy matters regarding Zoom's practices.[72]
On December 19, 2020, a former Zoom executive was charged by the U.S. Department of Justice with conspiracy to commit interstate harassment and unlawful conspiracy to transfer a means of identification. The charges are related to the alleged disruptions to video meetings commemorating the 1989 Tiananmen Square protests and massacre.[73] Federal prosecutors in Brooklyn, New York, said that Xinjiang "Julien" Jin, then 39, was a San Jose, California–based company's main liaison with intelligence and law enforcement agencies of China. Zoom later acknowledged it was the company in question. It said in a statement that it had terminated Jin's employment for violating company policies and was cooperating with the prosecutors. Jin is not in custody because he is based in China.[74][75]
In February 2021, Zoom announced a new feature called Kiosk Mode, which will allow people visiting offices to check in with a receptionist virtually on a kiosk, without any physical contact.[76] A month later, Zoom announced that from August 23, 2021, Zoom would stop selling new and upgraded products directly to customers in mainland China.[77][78] Zoom agreed to pay $85 million to settle a class action lawsuit over the company's alleged sharing of data with Facebook, Linkedin, and Google that year.[79]
