Zoom is seeing a surge in new users as the coronavirus (COVID-19) outbreak forces more and more employees to work from home.
However, new users should be aware of the company's privacy practices. Looking through the privacy policy and some of the support documents, you quickly discover that Zoom allows your boss to monitor your attention during calls, shares the copious data it collects with third parties, and already has a major security vulnerability.
We believe it is important for those using Zoom for work during the pandemic to be aware of these issues, which you will read in detail below. Finally, we will offer some suggestions on what you can do to protect yourself while using Zoom.
Zoom knows if you're paying attention to the call
Whenever you’re on a call, you have the option to enable Zoom’s attention tracking feature. This feature notifies the call host whenever someone on the call “doesn’t have focused attention on the Zoom Desktop Client or Mobile App for more than 30 seconds.” In other words, if you’re on a call on Zoom and click somewhere else, the call host will be notified after 30 seconds, regardless of whether you minimized Zoom to take notes, check your email, or answer a question in another app.
This feature only works if someone on the call is sharing their screen. It's unclear whether call participants are notified if someone is using attention tracking on a call.
Of course, just because you can't see the screen on Zoom doesn't mean you're not paying attention to your work. Additionally, this feature can't always be relied upon to tell you if you've clicked outside of the call. It only works on Zoom apps version 4.0 or later, and it's not as reliable if you're watching the Zoom call via a web browser rather than an app.
You should also be aware that if a host decides to record the call so that it can be played back later, Zoom saves a TXT file of the chat messages from the meeting and shares it with your manager. According to its support page on the subject, “the saved chat will only include messages from the host and messages received by all participants.”.
Maximizing privacy in your data
Zoom not only tracks your attention, it also tracks you.
According to the company’s privacy policy, Zoom collects information about you, including your name, physical address, email address, phone number, job title, and employer. Even if you don’t create an account with Zoom, it will collect and retain data about the type of device you use and your IP address. It also collects information from your Facebook profile (if you use Facebook to log in) and any “information you upload, provide, or create while using the service.”
In its privacy policy, under the question “Does Zoom sell personal data?” the privacy policy states “It depends on what you mean by sells.” It goes on to say that they do not sell personal data for money to third parties, but they do share personal data with third parties for “business purposes.” And that may include passing your personal information to Google.
The camera bug
Last year, security consultant Johnathan Leitschuch discovered that Zoom created a local web server on Mac device that allowed Zoom to bypass security features in Safari 12. This web server was not mentioned in any of Zoom’s official documents. It was used to bypass a pop-up that Safari 12 would display before activating your device’s camera.
However, this remote web server wasn't sufficiently secure. Almost any website could interact with it. The result was that Zoom allowed malicious websites to take over your Mac's camera without ever notifying you.
This led the Electronic Privacy Center to file an FTC complaint against Zoom, alleging that Zoom “intentionally designed the video conferencing service to bypass browser security settings and remotely activate a user’s camera without the user’s knowledge or consent.”
While Zoom has since removed these remote web servers, the fact raises doubts about the trust we can have in the app.
How you can protect your data
As Zoom becomes the standard video conferencing tool, there are some steps you can take to keep your data secure.
- Use two devices during Zoom calls: If you're watching a Zoom call on your computer, use your phone to check email or chat with other call participants. This way you won't trigger the attention tracking notification.
- Don't use Facebook to log in: It may save you time, but it's a bad security practice and dramatically increases the amount of personal data you've given to Zoom.
- Keep your Zoom app up to date: The remote web server was recently removed from the latest versions of apps . If you recently downloaded Zoom, you don't need to worry about this particular vulnerability.
We recognize that working from home will require a reconfiguration of how companies, offices, and employees operate. However, employee privacy should not be sacrificed in this transition.
