The Federal Trade Commission is calling out Zoom for claiming it offered end-to-end encryption, when it didn’t. However, the agency is declining to fine the video conference provider for potentially misleading consumers.
Instead, the federal regulator has secured a commitment from Zoom for the company to routinely audit its products for vulnerabilities and safeguard its systems from potential cyber attacks, including Zoom bombings.
The FTC’s settlement represents the federal regulator’s attempt to hold Zoom accountable for several privacy and security lapses the company made in recent years, including its failure to offer end-to-end encryption as advertised.
Back in April, Zoom admitted it wasn’t actually providing the feature. In reality, the company held onto the encryption keys, meaning it could theoretically decrypt and spy on the video calls across the Zoom platform. But what really caused alarm was how security researchers noticed the company was also managing and storing some encryption keys on servers in China, a country with a notorious reputation for online repression.
The FTC points out Zoom had been touting the end-to-end encryption benefits since 2016. “Zoom also misled some users who wanted to store recorded meetings on the company’s cloud storage by falsely claiming that those meetings were encrypted immediately after the meeting ended,” the FTC added. “Instead, some recordings allegedly were stored unencrypted for up to 60 days on Zoom’s servers before being transferred to its secure cloud storage.”
In response, Zoom spent months developing an end-to-end encryption feature, which began rolling out for all users last month. However, the FTC’s complaint against the company also faults it for other security controversies, including its failure to stop Zoom-bombing incidents. Another point of criticism was the company’s decision to introduce a feature on the Mac-based version of Zoom that inadvertently allowed hackers spy on users.
Under the proposed settlement, Zoom is also prohibited from making misrepresentations about its privacy and security practices, including about how it collects, uses, maintains, or discloses personal information. But a glaring gap is the lack of a financial penalty against the company, which caused the two Democratic FTC commissioners to vote against the proposed settlement.
“Zoom is not required to offer redress, refunds, or even notice to its customers that material claims regarding the security of its services were false,” wrote Rebecca Slaughter in a dissenting statement. “This failure of the proposed settlement does a disservice to Zoom’s customers, and substantially limits the deterrence value of the case.”
However, the Republican commissioners on the FTC claim demanding more penalties against Zoom would’ve led to a protracted battle in court. “We feel it is important to put in place measures to protect those users’ privacy and security now, rather than expend scarce staff resources on speculative, potential relief that a court would not likely grant, given the facts here,” the commissioners wrote in their majority statement.
But as even Zoom points out, the company has already implemented the requirements outlined in the FTC’s settlement. In April, the video conference provider froze all feature development to focus on enhancing Zoom’s security and privacy features.
“We are proud of the advancements we have made to our platform, and we have already addressed the issues identified by the FTC. Today’s resolution with the FTC is in keeping with our commitment to innovating and enhancing our product as we deliver a secure video communications experience,” the company added.
Under the settlement, Zoom also neither admits nor denies any of the allegations the FTC brought against the company.
