Zoom sued for overstating, not disclosing privacy, security flaws

https://uk.reuters.com/article/us-zoom-video-commn-privacy-lawsuit/zoom-sued-for-overstating-not-disclosing-privacy-security-flaws-idUKKBN21Q10V

by laurex • 6 years ago

391 157 6 years ago

uk.reuters.com

tmpynews• 6 years ago

Will be interesting if Zoom is compelled to disclose their security architecture. On the same page can they be forced, in court, to make a statement on the interference by the Chinese government?

xenonite3• 6 years ago

on the latter issue: a company can not speak for each individual employee.

xenonite3• 6 years ago

I don't get why this is downvoted? Maybe I was too concise. Then: even if the company may say what they do, the company cannot check and tell what each employee does. This doesn't have to be a malicious intent of the employee, but it can be.

tensor• 6 years ago

What interference by the Chinese government?

dontbenebby3• 6 years ago

Is having keys compelled a surprise?

Chinese servers, operating in China legally, will usually have this issue.

It's serious yes, but I'm confused if it only applied to users in China?

I'm more concerned about the technical issues TBH - I assume most software sanctioned in China had to turn over keys.

fnord1233• 6 years ago

Seeing as encryption is illegal in China, I don't think they will need to give up any keys.

bdowling• 6 years ago

If the lawsuit gets past the pleadings stage, then relevant information would be subject to discovery. So the plaintiffs would be able to get and use that info in court, but Zoom would probably ask the judge for a protective order so that it doesn’t become public.

whoisjohnkid• 6 years ago

Not surprising. Crazy how zoom in the beginning of the crisis was hailed for helping folks get together, but now with all the highlighted security concerns they are receiving a ton backlash. Hopefully they can recover and learn from this.

runawaybottle2• 6 years ago

I’m more shocked that this massive tech industry has like one decent solution to remote video conferencing. Maybe we really have gone too far down the road of making bullshit apps, and stopped solving real problems.

Shame on us.

kevin_thibedeau2• 6 years ago

Shame on the telcos who prevent residential customers from using the internet as intended. If everyone was given an IPV6 address block and freedom to accept outside connections from anywhere, none of this would be an issue.

icelancer2• 6 years ago

MS Teams is pretty good, but it's Microsoft so people aren't using it as much. Which is understandable.

wyclif• 6 years ago

And yet, almost nobody has commented on this sad state of affairs. You'd think there would be plenty of healthy competition in this space, but there is none. Why not?

hinkley• 6 years ago

I've worked for a couple of companies where capacity planning was way out of whack with the sales side.

The worst case of this was when a manager came and told me we had just landed a big customer and my response was, 'Oh, fuck me'.

When your product isn't built for scale, you can sell the hell out of it to small and medium sized customers, or sit back and let organic growth bring you people by word of mouth, and they will all be happy. Invite yourself to the Big Show before your systems are ready and you're gonna have a bad time.

In this case, there is probably nothing Zoom could have done to avoid this level of scrutiny at this time. Handle that scrutiny better? Sure. But it was going to happen either way.

mzkply• 6 years ago

Apart from that FBI warning of Zoombombing, I don't know a single non-tech person that's actually aware of all these security concerns, including China privacy.

ModernMech• 6 years ago

Yeah, I've been seeing this all over. For example my sister in law hosted her wedding over Zoom this past weekend. Approx. 0% of the people who attended couldn't have cared less about encryption or security concerns. They just wanted the easiest way to join in on a video feed with their friends and family. It's even become a verb now: "zooming in" e.g. "Please zoom in to our meeting". That's the mark of something that's going to stick. Once searching on the web became "googling" in the general population it became impossible to unseat Google. I think the same will hold true for Zoom.

encoderer2• 6 years ago

Blows my mind that a shareholder might have a cause of action for this.

1) Buy volatile stock with recent IPO

2) Sue them for their volatility

3) ?????

tlbsofware2• 6 years ago

Zoom documentation claims that the app uses “AES-256” encryption for meetings where possible. However, we find that in each Zoom meeting, a single AES-128 key is used in ECB mode by all participants to encrypt and decrypt audio and video. The use of ECB mode is not recommended because patterns present in the plaintext are preserved during encryption.

https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto...

toomuchtodo3• 6 years ago

You know, I had never considered being a shareholder and using said standing to sue a company into security best practices when they lie about it, considering regulation has failed to create the appropriate incentives.

shanemhansen2• 6 years ago

Oh wow. ECB mode? That's horrifying.

detaro• 6 years ago

Shareholders can sue you for pretty much anything you do that damages your value that you didn't warn them about.

I.e. they put in their IPO prospectus that there might be a negative impact on their reputation from them having Chinese R&D, so they have a defense against that. They didn't put "We have misleading marketing materials that might become subject to widespread public attention" in there I think.

encoderer2• 6 years ago

That doesn’t mean it’s a sound policy.

Public markets bid up a stock to an insane valuation in a matter of weeks and then the price comes down (due to technicals, fundamentals, whatever) and you have shareholders trying to weasel out of their gambling losses by suing company.

Let a customer who was actually harmed by this sue. Much more compelling to me.

cft• 6 years ago

This culture of biting the feeding hand has to stop somewhere.

xenonite3• 6 years ago

Well no, the shareholder is the feeding hand, giving money.

Actually, Zoom is accused of misbehaving and biting the feeding hand. And yes, this shouldn't have happened.

judge2020• 6 years ago

Note that the lawsuit is a class action for shareholders of Zoom stock.

Filing: https://i.judge.sh/natural/Babs/1-main.pdf

ship_it• 6 years ago

Interesting that shareholders are the one to fill a lawsuit.

toomuchtodo3• 6 years ago

"Everything everywhere is securities fraud." [1] -- Matt Levine, Money Stuff

[1] https://www.bloomberg.com/opinion/articles/2019-06-26/everyt...

elliekelly2• 6 years ago

In the US lying to users is merely frowned upon while lying to investors is illegal.

wyxuan• 6 years ago

Shareholders sue companies all the time. Usually an enterprising law firm will cook up some claim and start collecting plaintiffs (shareholders) and then when they win the law firm collects their paycheck.

zarimba• 6 years ago

They aren't. The lawsuit is really being filed by lawyers hoping to get a windfall. They don't even need to have much of a case, at worst Zoom will pay their fees and more for the nuisance to go away.

However, they do need to pretend for the court that this more than just a lawyer led money grab and that they actually represent the interest of a plaintiff. Enters Michael Drieu. If you read the complaint [1] you'll see Michael Drieu claim damages of ... $300. He's basically enabling a shakedown out of either malice or stupidity but not greed.

So no, it is not as if the shareholders of Zoom were up in arms against the company, this is just ambulance chasing with a puppet plaintiff.

https://www.scribd.com/embeds/455562311/content?start_page=1...

dontbenebby3• 6 years ago

Is there a simple way for those of us who hold index funds to check if we are shareholders?

toomuchtodo3• 6 years ago

https://www.etf.com/stock/ZM

cat1992• 6 years ago

yes:

if you hold an index fund which holds zoom, you are not a shareholder, the fund managers are.

TheAdamist2• 6 years ago

Presumably the zoom user agreements include arbitration clauses, etc that prevent users from filing class actions or lawsuits.

It's a get out of jail free card they'd be dumb not to have included.

ajphdiv• 6 years ago

Shareholders don't sign user agreements.

sandov• 6 years ago

Does it count as lying when it's ridiculously obvious that you're lying?

smolder• 6 years ago

Yes, and it's not so obvious to almost everyone.

runawaybottle2• 6 years ago

Well, I mean, I’m sure it was a throw in claim made for sales. Sales is always a little sleazy. I just don’t think the company expected ... you know, the whole world to be using their product. Sleazy got caught :p

ajayyy• 6 years ago

No, but this is not obvious. Vitamin water claims that excuse and I don't believe they should either.

pjc50• 6 years ago

It's a bit odd how everyone's attacking Zoom when none of the other common solutions have proper e2e encryption either.

cblades• 6 years ago

Do the other common solutions claim to have e2e encryption?

Wowfunhappy3• 6 years ago

Yeah. The problem here is that Zoom lied about it.

And, like, why? Sure, if no one ever caught them, e2e could be a reason to choose Zoom—but it's like lying on a resumé. Which, I guess is also a thing that happens sometimes, but it's generally understood to be a bad idea.

stevenprentice• 6 years ago

Webex has optional e2e encryption, but naturally you lose some features such as network based recording.

https://help.webex.com/en-us/WBX44739/What-Does-End-to-End-E...

est• 6 years ago

Does e2e work with multi-party? The picture only showing host/client, the host is the server or conference host?

kevin_thibedeau2• 6 years ago

The odd thing is that EARN-IT pushers want to ban strong encryption "for the children" but they want to excoriate Zoom over weak encryption "for the children".

bhhaskin• 6 years ago

It's almost like it was never about the children..

fock4• 6 years ago

my employer currently signs up for zoom, apparently managed via our SSO-solution. so far so good.

Right now, I got an email from Zoom, not showing any relation to my employer or mentioning its name: "congratulations for signup, use your account now". Ok. Password reset yields an usable basic account. Seems like somehow Zoom created a personal account for me with my work email. As I didn't get the activation email I got on my private spam-account, I assume somehow they got/requested all the employees email-adresses and automatically created private accounts, not related to the actual business acc..

What the actual f* is that?!? And yeah, I think conceptually this is the same behavior as shown by the ad/malware/spam campaigns ca. 2003. I wonder what had happened if I had just typed a password when signing in with my account... Maybe they just grab the passwords of the illiterate users and check them by trying to login with the university website? (that's sooo userfriendly!)

jamiequint3• 6 years ago

I set up Zoom for our company and nothing like this happened. It seems much more likely (than your wild conspiracy theory) that your company added a "basic", rather than "licensed" account for you and you got an email as a result.

fock4• 6 years ago

no, don't know what kind of mess they made; the official login is via SSO (and works with <companyname>.zoom.us). to my understanding the account is typically created on login there (otherwise we would sync our whole list of employees with 100s of services...). and even if it was just a random invitation sent to an email they bought somewhere, it doesn't really explain how I could reset the password for my email then (without ever activating an account)?!

It might be a messup from someone but it's definitely strange and I just didn't sign up there, yet got spam and had a working basic account...

pastullo• 6 years ago

Am i the only one struggling to use Zoom properly since they introduced the latest security changes? The slack integration (write /zoom to start a meeting) was working ok-ish even though we always had problem with the meeting not starting unless the host of the meeting was logged in (gosh...why so complicated?)

Now they added this waiting room, there is no sound notification to let you know that people are waiting. Doing daily standup become a sufference. It's crazy how quickly they lost us as users with literally two badly implemented features.

Happy to hear if any of you also had the same struggle and if there is a good alternative.

Wowfunhappy3• 6 years ago

Maybe set a (strong) password instead of using the waiting room?

studmuffin650• 6 years ago

I think most of these are settings that can be changed in the advanced settings menu. Zoom changed the defaults, but you can still change the settings to what you prefer them to be

proverbialbunny2• 6 years ago

For our daily standup we use meet.google.com as it's more convenient than ZOOM. ymmv ofc

Wowfunhappy3• 6 years ago

My company has been trying to find a solution since the Coronavirus hit. (We're not used to working from home)

We were using Slack's built-in conferencing at first, but aside from the quality being generally bad, there was a 15 person limit, and we're ~ 17 people.

I didn't want us to use Zoom with everything that's going on, so I suggested Google Meet. We tried it, and it worked, but not well—people's voices would frequently break up and become hard to hear.

And so we tried Zoom this past Monday.

It was incredible. I could actually hear and see everyone. I'm not happy about all their issues, but damn their product is just really good.

novok• 6 years ago

I would think that meetings being company users only by default could side step a lot of these clunky security measures. You would only need them for external meetings. No zoom bombing or war dialing issues with that default permission set.

jedberg4• 6 years ago

The issue is that everyone with a gmail address is in the same "company", because they use your domain to determine what company you're in.

crazygringo• 6 years ago

I don't think this is likely to succeed -- Zoom can argue that the stock price has gone down because of "Zoombombing" and security/privacy concerns that have nothing to do with exact details of what was disclosed in privacy/security documents, which barely anyone reads anyways.

Also, it's awfully hard to argue losing shareholder value when the stock has still more than doubled in the end -- Zoom can easily make the plausible-enough case that it made the right tradeoffs in the end for shareholder value that allowed it to scale. (I'm not saying that's true, just that it's plausible.)

Could it be fined by the SEC for misstating key details in their public filing? Maybe, although these are tiny details. But a class-action suit by shareholders? This feels like a stunt to me. Also, since a suit by shareholders could depress the stock price further, this feels like a short-seller trying to profit, no?

JumpCrisscross• 6 years ago

Zoom can argue that the stock price has gone down because...

Two general steps to a securities suit.

First, show the company defrauded investors. That can be as simple as omitting or mis-stating material information. (Zoom publicly claimed to use certain encryption standards that it didn't.) So the battle, here, will be around materiality. Critically, this step does not typically require proving damages.

Once materiality is met, the second step is showing damages. At this point, the change in (and attribution of) stock prices comes into play.

Once fraud is shown, the company is in a bad place. Even if a particular investor faced no discernible loss, everyone who bought at higher prices will now sue. It also invites state and federal investigators to start pursuing management and senior staff.

this feels like a short-seller trying to profit, no?

No. You have to disclose your positions when entering into a shareholder lawsuit. Shareholder lawsuits are comically common. And there is limited precedent for short sellers doing this.

Disclaimer: I am not a lawyer. This is not legal advice. Don't buy or sell securities based on my internet comments.

seeTheAstroturf• 6 years ago

Can Apple be sued for the same? I'm reminded of their advertising against windows for security, but their products have had a myriad of security flaws over the years.

unlinked_dll2• 6 years ago

How many of Zoom's recent issues can be explained by just bad engineering?

Because my personal gripes with Zoom are mostly about its quality as a software product, which I find to be abysmal for my use cases.

arbitrage• 6 years ago

From a purely functional standpoint, that is -- does this software do what I need it to do?, I have had absolutely no problems with zoom.

What issues have come up for you?

unlinked_dll2• 6 years ago

I don't really want to go through the laundry list of issues I have because none are critical, just the software is very rough around the edges on Linux. It just feels less than flushed out, and I've had a million little problems and bugs that I've reported and never heard anything back (as a paying user!).

nkohari• 6 years ago

This nonsense happens all the time with public companies. All it takes is a law firm with the gumption to file a suit claiming that the company misrepresented something material which resulted in a significant change to share prices.

jy29474• 6 years ago

Don't know what is going on at Zoom, but I suspected at least part of it sneaky. For example, about 3 or 4 weeks ago I heard about this company, and learned that it has R&D in China per its SEC filing at IPO. However, checked its website, the career section led me to https://jobs.lever.co/zoom, and there was ONLY one opening at China per the website (I remember it was a position at marketing department). Then I searched the company in Chinese media, and saw that they were hiring all types of engineers. That made me feel uncomfortable in buying its stock. Interestingly, now you look at the same career website, and China is removed from the list of city dropdown - maybe they are cutting off or "decoupling" the Chinese R&D?

eythian• 6 years ago

It could be they advertise jobs in different regions on different systems, to get the closest reach to the potential hirees.

jy29474• 6 years ago

The R&D centers in China (I think there are 3 of them) are their competitive advantage - this can help them manage cost to be profitable from early on. I also think the engineering teams there can share with their peers of the other local Chinese tech firms. For example, China was literately put in lock down in February, and all of the business and schools went on-line in couple of days - that was a enormous achievement for anyone who participated the scaling infrastructure at the big tech companies in China, and I would not be surprised that the Zoom engineers in Chinese R&D learned couple of lessons from them. Zoom even has a feature that you can choose to "soften" your appearance to look "better" in the video conference, which has been feature of camera/image software popular in Asian market. So I suspect their product team may also have some connections there.

However, Zoom's biggest advantage is also its biggest risk, if they want to be part of the communication infrastructure of any business/government/university/etc in western countries, especially after so many security incidents that happened in the past years.

yibg• 6 years ago

Why is having engineers in China cause for suspicion? Lots of tech companies have engineers in China. Eg Microsoft.

jy29474• 6 years ago

What alerted me at that time was the discrepancy between their HR site at U.S of the Chinese opening (only one), and their job postings in Chinese job sites.

jy29474• 6 years ago

But if Microsoft has teams in China, Russia work on MS Teams, I will be very concerned. The same goes with Slack, that many companies now rely on to keep business going.

TechBro8615• 6 years ago

Because the CCP has no qualms about threatening an employee’s family to insert a backdoor or exfiltrate information, for one.

The decoupling has begun. Sentiment in the US toward China has never been as negative as it is now, from both sides of the aisle. I wouldn’t be surprised if we even see sanctions against China after the dust settles on this COVID fiasco.

president2• 6 years ago

I think OP was alluding to Zoom not showcasing the reqs on the US careers site. Most companies including Microsoft do display open positions in all countries including China on their US page.

cosmodisk• 6 years ago

I very much doubt Microsoft does any serious development of their core products in China. Localisation,some local support and other,less sensitive stuff.

sneak• 6 years ago

Anti-China sentiment is being stoked heavily in the US right now. Anything China-related is widely seen as evil and/or untrustworthy. Usually these opinions are expressed on China-sourced hardware.

nogabebop23• 6 years ago

Is it the same company? We have "employees" around the world, but that ranges from employed by the mother ship, employed by one of the various subsidiaries (all with very similar sounding names) or not officially employed but via a local agent (for both liability, regulatory and in certain regimes, mandated).

m_a_g• 6 years ago

Zoom is fully aware that associating themselves with China considering the latest developments would be catastrophic for them, whether its job listings or some of its servers being in China.

anoraca• 6 years ago

Unlikely IMO.

"Zoom, a Silicon Valley-based company, appears to own three companies in China through which at least 700 employees are paid to develop Zoom’s software. This arrangement is ostensibly an effort at labor arbitrage: Zoom can avoid paying US wages while selling to US customers, thus increasing their profit margin. However, this arrangement may make Zoom responsive to pressure from Chinese authorities."

https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto...

nilkn• 6 years ago

So Zoom is essentially a Chinese company with a formal outer shell in the US and 81% of its revenue coming from North America?

rayvd• 6 years ago

I mean, this is incredibly common. Is there a large software company that doesn't do this? Labor competition is a real thing.

zkid18• 6 years ago

What’s wrong with having R&D in China? The talent market is attractive and assuming Zoom founder is Chinese it seems more reasonable in some point compare to opening another office in US. Lots of big tech companies has strong R&D presence in China like MSFT, GOOGL.

Btw, I might be wrong but CCP banned Zoom about half a year ago.

A4ET8a8uTh0• 6 years ago

Good. There needs to be a serious crackdown on 'puffery' aka lying ( whether lying about product feature or anything else is irrelevant ). Fingers crossed and it will go beyond $2 credit on future Zoom services for affected users.

ballenf• 6 years ago

I'm betting the payout will be a custom emoji for affected users. Maybe a tinfoil hat. And the court will be ok with that so long as the lawyers get paid in hard currency.

pirocks• 6 years ago

Iirc this is a lawsuit by shareholders so I imagine users will get nothing.

philshem• 6 years ago

I guess investors who bought the wrong Zoom stock can’t get in on the class action? ;)

https://time.com/5792310/zoom-zm-stocks-coronavirus/

upofadown2• 6 years ago

Looking back, there isn't actually any evidence that Zoom is not, as they put it, "encrypted from end point to end point". But it is clear that Zoom itself is kind of confused about the whole thing. I don't think that Zoom is all that good with technical stuff...

To have any assurance that a video conferencing system is actually secure e2e you would have to have access to the verified source code of the client programs and verify the identity of each and every participant. That is likely impractical so I think it is safe to say that you should not use any video conference system provided by others to discuss secret things. If you absolutely must do so then you can set up a server under your physical control and then would not have to bother with e2ee at all.

stingraycharles• 6 years ago

Security audits are done all the time, for which access to the source is given. In Zoom’s case, going through an audit from a reputable firm, may just be the answer of getting the public’s confidence back.

And of course it’s fairly extreme to claim you should not use any video conference system for any sensitive discussions; security is not black and white, and each situation deserves an appropriate level of security; it needs to be balanced with convenience. There are a lot of situations where I would prefer “mostly” secure communication, rather than no communication at all.

upofadown2• 6 years ago

There are a lot of situations where I would prefer “mostly” secure communication, rather than no communication at all.

We are not talking about "mostly" here for the video conference case. We are talking about a situation where most providers have access to the data of their users without very much work. If you are actually willing to confirm the identity of your correspondent using verified binaries you can get end to end protected communications ... if someone claims that they have something easier then they are lying. You can't beat the law of logic. The fact that anyone is even suggesting that Zoom could of been e2ee in any way that mattered is kind of depressing. I think we have some education to do.

Security audits are pointless unless you can confirm that the software that was audited is the software actually running on your device.

SubiculumCode2• 6 years ago

I am beginning to get concerned also. The University of California has contracts with Zoom, and so many of us have moved over to using Zoom for all our research lab meetings, especially since the pandemic. We all know that China has pushed research espionage, with several convictions that I know about. The possibility of intimate ties with China raises the specter that Zoom is pushing video, or transcripts of that video through China, and hence through Chinese spy agencies, which would be really concerning.

Note: I love the Chinese people, and my Chinese colleagues. I do NOT like the oppressive, and frankly, evil and callous crimes committed by the Chinese government. Downvotes or upvote the comment as you will, won't change their crimes or my opinion..

apotatopot• 6 years ago

And I've heard nothing about TikTok https://www.vox.com/open-sourced/2019/12/16/21013048/tiktok-...

Zoom sued for overstating, not disclosing privacy, security flaws

Related Stories