Zoom hit with allegations of enabling spying by China, hackers

Zoom is facing fresh allegations that its video conferencing platform is used to spy on people and invade their privacy, including by the Chinese government, hackers, and the company’s workers training new artificial intelligence tools.

New details are emerging about China’s alleged effort to infiltrate Zoom to monitor people and silence dissent.

The Chinese government’s push to interfere in the company’s work intensified during the COVID-19 pandemic, according to author Bethany Allen-Ebrahimian in the book “Beijing Rules,” published this month.

“The dramatic increase in the number of Zoom users in the early months of the pandemic coincided with increasingly stringent controls over the company’s internal workings and with demands from Chinese security agencies to immediately block any activities on the teleconferencing platform, anywhere in the world, that authorities deemed illegal,” Ms. Allen-Ebrahimian wrote.

Ms. Allen-Ebrahimian wrote that China’s Ministry of State Security tasked Zoom employee Julien Jin to monitor specific people outside China’s borders, and that the videoconferencing platform’s rapid growth gave China an unprecedented opportunity to use it to disrupt political activity.

The Justice Department charged Julien Jin, also known as Xinjiang Jin, in 2020 with conspiracy to commit interstate harassment and he remains wanted by the FBI.

Concerns about espionage on Zoom are not limited to China, however. Three U.K.-based researchers said this month that they discovered a successful way to use Zoom to spy on what people are typing on their computers.

In a paper detailing acoustic cyber threats, the researchers said they used machine learning tools to correctly classify 93% of keystrokes recorded through Zoom.

By recording the sounds of someone typing on a keyboard while using Zoom, researchers Joshua Harrison, Ehsan Toreini and Maryam Mehrnezhad said they discovered a way to reveal what the typists write.

“The ubiquity of keyboard acoustic emanations makes them not only a readily available attack vector, but also prompts victims to underestimate (and therefore not try to hide) their output,” the researchers wrote. “For example, when typing a password, people will regularly hide their screen but will do little to obfuscate their keyboard’s sound.”

The researchers said when pairing their machine learning tools with audio recorded from a phone’s microphone located near a computer, the accuracy of inferring people’s keystrokes rose to 95%.

Zoom is also facing allegations that it is monitoring people’s actions without their consent.

Software developer Alex Ivanovs spotted a change in Zoom’s terms of service that he said raised concerns that the videoconferencing platform may train its AI tools on people’s data without giving people the option of saying no.

“What raises alarm is the explicit mention of the company’s right to use this data for machine learning and artificial intelligence, including training and tuning of algorithms and models,” Mr. Ivanovs wrote on Stack Diary. “This effectively allows Zoom to train its AI on customer content without providing an opt-out option, a decision that is likely to spark significant debate about user privacy and consent.”