Zoom Video Communications has agreed to tighten the security of its videoconferencing services after the FTC found the company had misled users about the extent of its protection of personal data. The company agreed to conduct an annual security assessment, implement a vulnerability management program and deploy safeguards such as multi-factor authentication, data deletion controls and blocking compromised user credentials.
In addition, Zoom personnel will be required to review any software updates for security flaws and must ensure the updates will not hamper third-party security features. It will be subject to biennial reviews by an independent auditor to ensure it meets the tenets of the agreement, and the company must notify the Commission if it experiences a data breach.
The FTC investigation was started this spring after the exponential rise in Zoom users when the coronavirus pandemic started. The company grew from 10 million daily users in December 2019 to 300 million in April.
Zoom acknowledged the security shortcomings itself already earlier this year, starting a major review of its operations in April. At the prompting of the New York Attorney General, Zoom made several changes in its software to protect users better, and the company continues to enhance encryption and other security features.
Zoom said in a statement that "the security of our users is a top priority" and it had already addressed the issues identified by the FTC.
The FTC investigation found several shortcomings in Zoom's security protocols going back to 2016. Notably the company's repeated claim of end-to-end 256-bit encyrption was false, as Zoom still held keys to access customer meeting data and a lower level of security was used for securing Zoom Meetings.
Furthermore, the company misled some customers about the immediate encryption of data stored in its cloud servers. In fact, some recordings remained unprotected on Zoom's servers for up to 60 days before being moved to the encrypted platform.
Another problem was an update of its software for Macs in July 2018 with the new feature ZoomOpener. This allowed the company to launch a meeting on the user's computer, bypassing malware protections in the Safari browser. The software remained on users’ computers even after they deleted the Zoom app, and would automatically reinstall the Zoom app, without any user action, in certain circumstances. The company did not adequately disclose the app's functions or that it would remain on the computer after deleting, the FTC found.
