Zoombombing

The term "Zoombombing" is derived from the teleconferencing application Zoom,[2] though the term has also been used in reference to similar incidents on other teleconferencing platforms, such as WebEx or Skype.[3] The increased use of Zoom during the COVID-19 pandemic as an alternative to face-to-face meetings resulted in widespread exposure to hackers and Internet trolls, who exploit and work around the application's security features.[2] In various forums such as Discord and Reddit, efforts have been coordinated to disrupt Zoom sessions, while certain Twitter accounts advertised passwords sessions that were vulnerable to being joined without authorization.[4] At educational institutions, some students were "actively asking strangers to Zoombomb or 'Zoom raid' their virtual classrooms to spice up their isolated lessons" and facilitating the raids by sharing passwords with the raiders.[5] CNET pointed out that simple Google searches for URLs that include "Zoom.us" could bring up conferences that are not password protected, and that links within public pages can allow anyone to join.[6] Hackers and trolls also look for easy targets such as unprotected or underprotected "check-in" meetings in which organizations meet with their employers or clients remotely.[7]

While a Zoom session is in progress, unfamiliar users show up and hijack the session by saying or showing things that are lewd, obscene, racist, or antisemitic in nature. The compromised Zoom session is then typically shut down by the host.[2][8] Those successful in disrupting sessions have posted video footage of those incidents to sharing platforms such as TikTok and YouTube.[9]

Zoombombing has caused a number of problems for schools and educators, with unwanted participants posting lewd content to interrupt learning sessions.[8][10][11] Some schools had to suspend using video conferencing altogether.[12] The University of Southern California called Zoombombing a type of trolling and apologized for "vile" events that interrupted "lectures and learning."[13] Zoombombing has prompted colleges and universities to publish guides and resources to educate and bring awareness to their students and staff about the phenomenon.[14] Zoombombing has left online lectures vulnerable to the intrusion of people looking to inflict harm. These crimes have brought attention not only to the lack of security on videoconferencing platforms, but also the lack in the universities. According to an article from The Guardian, the University of Warwick, in the midst of a rape-chat scandal, received criticisms for its weak cybersecurity.[15]

The problem reached such prominence that the United States Federal Bureau of Investigation (FBI) warned of video-teleconferencing and online classroom hijacking, which it called "Zoom-bombing."[16][17] The FBI advised users of teleconferencing software to keep meetings private, require passwords or other forms of access control such as "waiting rooms" to limit access only to specific people, and limiting screen-sharing access to the meeting host only.[16] Given the number of incidents of Zoombombing, New York's attorney general initiated an inquiry into Zoom's data privacy and security policies.[18] U.S. Senator Sherrod Brown (D-OH) asked the Federal Trade Commission to investigate into the matter, accusing Zoom of engaging in deceptive practices regarding user privacy and security.[19]

Amid concerns about Zoombombing, various organizations banned the use of Zoom. In April 2020, Google banned the use of Zoom on its corporate computers, directing employees to instead use its video chat app Google Duo.[20] The use of Zoom was also banned by SpaceX, Smart Communications, NASA, and the Australian Defence Force.[20] The Taiwanese and Canadian governments banned Zoom for all government use.[21] The New York City Department of Education prohibited all its teachers from using the platform with students, and the Clark County School District in Nevada disabled access to Zoom to its staff.[22] Singapore's Ministry of Education briefly banned all teachers within the country from using Zoom[23][24] before lifting the ban three days later, adding extra security features.[25] Some Zoombombers have shared their side of the story, claiming they aren't trying to cause harm. They claim it is a form of protest in response to the extensive amount of work given from teachers. Not all incidents are malicious, as many have shared some new pop culture, such as memes and TikToks, to bring some relief and fun during the pandemic.[1]

Zoom CEO Eric Yuan made a public apology, saying that the teleconferencing company had not anticipated the sudden influx of new consumer users and stating that "this is a mistake and lesson learned."[26][27] In response to the concerns, Zoom has published a guide on their blog on how to avoid these types of incidents.[28] On April 7, 2020, Zoom implemented user experience and security updates to the application. Such updates include a more visible "Security" icon for users to see and use, suppression of meeting ID numbers,[27] and a change in the default settings to require passwords and waiting rooms for sessions.[29] On April 8, 2020, Zoom announced that it had formed a council of chief information security officers from other companies to share ideas on best practices, and that it had hired Alex Stamos, former chief security officer of Facebook, as an adviser.[30] Zoom released its 5.0 version in April 2020 with security features that include AES 256-bit GCM encryption, passwords by default, and a feature to report suspicious users to its Trust and Safety Team for possible misuse.[31][32] In May 2020, Zoom announced it had temporarily disabled its Giphy (frequently used as a tactic in zoombombing) integration until security concerns could be properly and fully addressed. [33]

National authorities worldwide warned of possible charges against people engaging with Zoombombing.[34][35] On April 8, 2020, a teen in Madison, Connecticut, was arrested for computer crime, conspiracy, and disturbing the peace following a Zoombombing incident involving online classes at Daniel Hand High School; police also identified another teen involved in the incident.[36] In San Francisco, a man was arrested after being traced to pornographic videos that were streamed on Zoom.[37] As of May 2020, the FBI has received 195 incidents of Zoombombing involving child abuse,[38] while the United Kingdom's National Crime Agency has reported more than 120 such cases.[39]

St. Paulus Lutheran Church in San Francisco filed a class-action lawsuit against Zoom after one of its bible study classes was "Zoombombed" on May 6, 2020.[40] The church alleged that Zoom "did nothing" when it tried to reach out to the company.[41]

• Photobombing
• Email bomb
• Text message bomb
• Griefing
• Trolling