Zooming in on video conferencing

Worldwide usage of Zoom has increased 30-fold during the coronavirus pandemic, but the application has been plagued by security concerns. Boase Cohen & Collins Associate Joshua Tong and Trainee Jennifer Lee outline the safety measures which users of all video conferencing software should adopt.

Hong Kong, 7 May 2020: Covid-19 has led to a dramatic change in the lives of people all over the world. It has altered the way we work, communicate and socialise with each other. As companies and individuals are now enforcing the “work from home” policy, millions of individuals have turned to the Zoom application for video conferencing. The number of Zoom’s active users spiked from 10 million at the end of December 2019 to a staggering 300 million as of 22 April 2020.

The trend was also observed in Hong Kong where corporations and schools started using Zoom’s video conferencing services during the pandemic to minimise social contact. In the legal field, lawyers who wanted to hold meetings with clients were also asked to “Zoom” clients before the platform was exposed for its security risks and data privacy concerns.

Recently, a number of data and security breaches in the Zoom application were reported by its users across the world. These included “Zoombombings”, i.e. the intrusion of uninvited attendees and disruption of meetings by broadcasting profane images or videos, and a leakage of more than half a million login details on the dark web and hacker forums. As expected, governments including Singapore, the US and the UK have already reacted quickly to the security issues and effected measures to ban and limit the use of Zoom on their servers and devices.

In Hong Kong, the video conferencing application was equally affected. “Zoombombings” occurred during conference meetings and even university exams. Having regard to the latest security incidents, the Privacy Commissioner for Personal Data (“PCPD”) issued a media statement on 1 April 2020 to echo warnings about the risks associated with using the platform and recommended users who still choose to use Zoom to:

• Update the mobile app to the latest version;
• Sign in with an account specifically created for Zoom and avoid logging in with other existing accounts whenever possible to reduce the risk of personal data being transferred or leaked;
• Set a password for the meeting which (as well as its link) should be given to participants of the meeting only;
• Keep a close watch of any unusual activity on the account; and
• Document any damage incurred to facilitate any necessary follow-up action.

Zoom Video Communications Inc. has, since the security breaches, announced that it will implement a 90-day security plan, and is actively providing weekly blog updates about how Zoom is strengthening its security measures within the application. Yet, as the company has diligently patched up security vulnerabilities, numerous reports of its flaws continue to surface, prompting privacy concerns regarding possible surveillance and unauthorised viewing of recorded user videos.

The Judiciary’s approach to video conferencing – or, more accurately, remote hearing – is, fortunately, more conservative. Our Senior Partner Colin Cohen’s recent experience with a court case done via remote hearing suggests the Judiciary would only accept well-established video conferencing solutions. While there are many web-based applications and protocols that can be adopted, the Judiciary ultimately elected to use the Polycom platform and hardware to conduct remote hearings.

Other legal organisations have since turned to Cisco Webex, Microsoft Teams and Google Meet. As an increasing number of users implement video conferencing solutions to participate in meetings and socialise, users generally should always be aware of their rights to ensure no compromises are being made regarding their privacy and personal data.

Generally, in all video conferencing software, the PCPD advised in its response to media enquiries on the security issues in Zoom on 9 April 2020 that:

Staff using video conferencing software should:

• Monitor any inappropriate content shared by participants and remove inappropriate information and unidentified persons;
• Store all tracking data and records with encryption, and the personal data collected should be destroyed as soon as possible after the data has fulfilled the original purpose of collection;
• Check if any personal data could be accidentally captured on screen when the screen or video sharing function is activated;
• Establish guidelines for handling data breaches; and
• Understand the privacy policies and security measures of these software and platforms to minimise collection of data by service providers.

Participants should:

• Avoid using misleading names or online nicknames to make it easier for the host to identify;
• Keep a close watch of any unusual activity on the account; and
• Document any damage incurred to facilitate any necessary follow-up action.

Concluding remarks

While companies are quickly adopting video conferencing software solutions to conduct business meetings or run their operations, employers should ensure that the privacy policies and terms of use of the video conferencing software solution implemented would not in any way compromise the security, privacy and personal data of their employees.

At the same time, employers should always keep their systems up to date, minimise risk of exposure and seek professional advice to ensure that the solution adopted complies with data protection principles under the Hong Kong legislation.

Zoom’s headquarters in Silicon Valley, California. The company has been working hard to address security issues in its widely used video conferencing application.