Zoom settles charges with FTC over deceptive security practices

The FTC has a long security to-do list for Zoom.

Zoom reached a deal with the Federal Trade Commission to settle allegations it misrepresented its security and privacy protections for users, the FTC announced Monday.

In its action against Zoom, the FTC alleged Zoom “engaged in a series of deceptive and unfair practices that undermined the security of its users.” The FTC alleged that Zoom misled users when it claimed it offered end-to-end encryption — intended to protect user communications from external, unintended eavesdroppers — when Zoom actually didn’t offer that level of security, according to the complaint.

The FTC also alleged Zoom informed users it would store recordings of Zoom meetings in an encrypted format, when in reality they were kept unencrypted up to 60 days, and eventually were encrypted later.

Zoom compromised users’ security when it secretly installed ZoomOpener, software intended to help users join meetings more seamlessly, but which actually made users vulnerable to malware, according to the FTC. The FTC alleges that Zoom violated the FTC Act because it deployed ZoomOpener without user consent.

“Zoom’s misleading claims gave users a false sense of security, according to the FTC’s complaint, especially for those who used the company’s platform to discuss sensitive topics such as health and financial information,” the FTC said in a press release. “In numerous blog posts, Zoom specifically touted its level of encryption as a reason for customers and potential customers to use Zoom’s videoconferencing services.”

Zoom is now required to foster a “robust information security program” as part of the settlement, and is barred from misrepresenting its privacy and security practices, including security features and how it maintains or discloses personal information. As part of the settlement Zoom has agreed to a mandated vulnerability management program and a biennial assessment of its security program from an outside party. The company is also on the hook to implement a multi-factor authentication program and to annually document potential internal and external security risks, according to the settlement.

The FTC action against Zoom is just the latest blow for the San Jose-based video teleconferencing company. Ever since Zoom use skyrocketed amid the coronavirus pandemic, the company has been facing criticism for a series of security and privacy missteps that the FTC has said put users’ security at risk. Just since March, Zoom has been hit with a class-action lawsuit over the company’s alleged disclosure of users’ data, is alleged to have made users vulnerable to hackers trying to access webcams, and has faced repeated criticism for its planned rollout of end-to-end encryption. Zoom’s CEO has previously publicly apologized for its security issues and vowed to do better.

Zoom said in a statement it had already made several changes to the security practices detailed in the settlement announced Monday.

“We are proud of the advancements we have made to our platform, and we have already addressed the issues identified by the FTC,” a company spokesperson said in a statement. “Today’s resolution with the FTC is in keeping with our commitment to innovating and enhancing our product as we deliver a secure video communications experience.”

An FTC attorney on the settlement, Linda Holleran Copp, told reporters on a call Monday that “as a general matter, Zoom cooperated with our investigation.”

There will be significant civil penalties if Zoom violates the terms of the order, according to FTC lawyers.

Update, 11/9/2020: This story has been updated to include comment from Zoom and with additional details from the FTC.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure