A Must For Millions, Zoom Has A Dark Side — And An FBI Warning

Apr 3, 2020
Originally published on April 6, 2020 12:16 pm

Updated at 11:22 a.m. ET

Dennis Johnson fell victim last week to a new form of harassment known as "Zoombombing," in which intruders hijack video calls and post hate speech and offensive images such as pornography. It's a phenomenon so alarming that the FBI has issued a warning about using Zoom.

Like many people these days, Johnson is doing a lot of things over the Internet that he would normally do in person. Last week, he defended his doctoral dissertation in a Zoom videoconference.

He had a big audience — he estimated it was about 40 people, including "my closest friends, family and my classmates and my dissertation committee" at California State University, Long Beach, he said.

Johnson is the first member of his family to graduate from college, let alone get a doctorate. He wanted to share the moment with them.

He said he was in the middle of presenting when someone started drawing male genitalia on the screen. At first, Johnson said, he was not sure what was happening.

"I'm like, 'Whoa!' And then I freeze, and everyone who's watching the screen freezes," he said.

It got worse. The attacker scrawled a racial slur that everyone on the Zoom call could see.

Johnson was horrified. The organizers blocked everyone's screen until they could remove the intruder from the meeting. But, Johnson said, they were not able to identify that person.

Although he was shaken, Johnson managed to finish his presentation. But what should have been a triumphant celebration was ruined.

"The moment they [told] me, 'Congratulations, Dr. Dennis Johnson,' and it's all over and I leave the Zoom meeting, everything sets in," he said. "I couldn't even, like, communicate. I had to just walk out [of] my house. ... I didn't want to talk or see anybody."

Zoombombers have disrupted an Alcoholics Anonymous meeting in New York, Sunday school in Texas, online classes at the University of Southern California and a city meeting in Kalamazoo, Mich.

With schools closed and millions of people working from home, Zoom has become wildly popular. The company said 200 million people used the app on a daily basis in March, up from just 10 million in December. But that newfound popularity is bringing new scrutiny.

The FBI is warning schools, in particular, to be careful.

"The FBI has received multiple reports of conferences being disrupted by pornographic and/or hate images and threatening language," the bureau's Boston office said this week.

As concerns have arisen, Zoom has worked to address them. It published a guide last month on how users can protect meetings. It also changed settings for accounts used by schools and universities to make their meetings more private by default.

New York Attorney General Letitia James has sent a letter to Zoom asking about its security and privacy protections.

"Things you just would like to have in a chat and video application — strong encryption, strong privacy controls, strong security — just seem to be completely missing," said Patrick Wardle, a security researcher who previously worked at the National Security Agency.

He and other researchers have turned up flaws in Zoom's software that could let hackers spy through a computer's webcam or microphone. Zoom says it released fixes for these issues on Wednesday.

The website Motherboard found that Zoom was sharing data with Facebook, even data on people who are not Facebook users.

Zoom says that was a mistake and that it stopped sharing that data in March, but it's now facing a class action lawsuit.

Wardle says Zoom may be easy to use, but he is wary of its track record.

"This product was designed to prioritize things other than privacy and security," he said.

Zoom CEO Eric Yuan said in a blog post Wednesday that the company is freezing work on new features to focus on fixing its privacy and security problems.

"We recognize that we have fallen short of the community's – and our own – privacy and security expectations," he wrote. "For that, I am deeply sorry, and I want to share what we are doing about it."

Editor's note: Zoom is among NPR's sponsors.

Copyright 2020 NPR. To see more, visit https://www.npr.org.

STEVE INSKEEP, HOST:

Just a few weeks ago, I'd never heard of Zoom. Then, as Americans began working from home, I heard of meetings held on Zoom. Eventually, some colleagues and I had lunch on Zoom. The video conferencing service is popular and also, we should disclose, a funder of NPR, about which we will nevertheless tell you the whole truth. The FBI is warning schools about using the software. New York's attorney general is asking questions about its security and privacy. NPR tech correspondent Shannon Bond has more.

SHANNON BOND, BYLINE: Like many people, Dennis Johnson is doing a lot of things he would normally do in person over Zoom. Last week, that meant defending his doctoral dissertation via computer screen to a big audience.

DENNIS JOHNSON: There's, like, over 40 people who are watching. They are my closest friends, family and my classmates and my dissertation committee.

BOND: Johnson is the first member of his family to graduate from college, let alone get a doctorate. He wanted to share the moment with them. He says he was in the middle of presenting when someone started drawing male genitalia on screen.

JOHNSON: And I'm like, whoa. And then I freeze. And everyone who's watching - the screen freezes.

BOND: It got worse. The attacker scrawled a racial slur. And all of this was being broadcast to everyone on the Zoom call. Johnson was horrified. The organizers blocked everyone's screen until they could remove the intruder from the meeting. But, he says, they weren't able to identify who had done it. Johnson was shaken, but he managed to finish his presentation. Still, what should've been a triumphant celebration was ruined.

JOHNSON: The moment they tell me, congratulations, Dr. Dennis Johnson, and it's all over and I leave the Zoom meeting, everything sets in. Like, you want to talk about depression? I couldn't even, like, communicate. I had to just walk out my house and just walk because I didn't want to talk or see anybody.

BOND: Johnson fell victim to a new form of harassment known as Zoombombing. Intruders hijack video calls and post pornography and hate speech. They've disrupted an Alcoholics Anonymous meeting in New York, a Texas Sunday school, online classes at the University of Southern California. Here's Mayor David Anderson of Kalamazoo, Mich., after a city meeting was attacked.

(SOUNDBITE OF ARCHIVED RECORDING)

DAVID ANDERSON: If we're going to sit here as a hundred people take advantage of this opportunity to anonymously, you know, spew some venom out there, I'm not going to be comfortable with that.

BOND: With schools closed and millions of people working from home, Zoom is exploding. Two hundred million people used the app on a daily basis in March, up from just 10 million in December. And Zoombombing is not the only problem the company is grappling with as it adjusts to its new popularity.

PATRICK WARDLE: Things you just would like to have in a chat and video application - strong encryption, strong privacy controls, strong security - just seem to be completely missing.

BOND: Patrick Wardle is a security researcher. He and others have turned up flaws in Zoom's software that could let hackers spy through the computer's webcam or microphone. There are also concerns about privacy. The website Motherboard found Zoom was sharing data with Facebook, even on people who aren't Facebook users. The company says that was a mistake. But it's now facing a class-action lawsuit. Wardle says Zoom may be easy to use, but he's wary of its track record.

WARDLE: I really believe that it's just this product was designed to prioritize things other than privacy and security.

BOND: Zoom CEO Eric Yuan wrote a blog post this week apologizing for falling short. He says the company is freezing work on new features to focus on fixing its privacy and security problems.

Shannon Bond, NPR News, San Francisco. Transcript provided by NPR, Copyright NPR.