New York attorney general questions Zoom privacy amid rising popularity

New York Attorney General Letitia James (D) wants to know what measures Zoom is taking to ensure users’ privacy as demand for the video conferencing app skyrockets amid stay-at-home orders spurred by the coronavirus pandemic.

In a Monday letter obtained by The New York Times, James calls Zoom “an essential and valuable communications platform” but noted that the company has been slow to address security flaws “that could enable malicious third parties to, among other things, gain surreptitious access to consumer webcams.”

Schools and workplaces are now using Zoom as a substitute for in-person meetings amid the pandemic. According to the FBI, the platform has also been subject to hijacking, or “Zoombombing,” as some call it, which has often involved pornographic images or hate speech.

My PhD defense was #zoombombed yesterday, so here are some suggestions for protecting your @zoom_us meetings. #virtualdefense #phdchat #ScienceTwitter 1/

— Ceri Weber (@ceri_weber) March 28, 2020

We are investigating the racist Zoom bombing of a meeting of UT students, staff & faculty. It was reprehensible. If the perpetrators are members of the UT community, they will be disciplined. We will also increase online security for all UT staff to prevent similar incidents.

— Greg Fenves (@gregfenves) March 31, 2020

James questioned whether Zoom’s current security measures can keep pace with the surge in users.

She said that her office is “concerned that Zoom’s existing security practices might not be sufficient to adapt to the recent and sudden surge in both the volume and sensitivity of data being passed through its network.”

“While Zoom has remediated specific reported security vulnerabilities, we would like to understand whether Zoom has undertaken a broader review of its security practices,” James added.

Zoom updated its privacy policy on Sunday after users reported concerns. On Monday, Eric S. Yuan, chief executive and founder of Zoom, posted a link on Twitter to a company blog item about the policy.

Zoom’s Privacy Policy. https://t.co/YAmu2dlBT0

— Eric S. Yuan (@ericsyuan) March 30, 2020

“We appreciate the New York attorney general’s engagement on these issues and are happy to provide her with the requested information,” the company said in a statement to the Times.