Zoom forced to upgrade security after making ‘deceptive’ encryption claims

Zoom has agreed to bolster its security after a US government investigation found it had misled users about whether their video calls were protected.

The Federal Trade Commission (FTC) settled a year-long probe that found Zoom had undermined people’s online safety by claiming video meetings were secured by end to end encryption.

As a result, the video calling company will be subjected to routine security reviews, and must examine future software updates for any flaws.

Zoom has soared in value to become a $125bn (£95bn) company during the pandemic as businesses, families and healthcare services turn to it to replace in-person meetings and as more than 300m people regularly use it. Its chief executive Eric Yuan’s net worth has climbed above $25bn. 

However, the company has been hit by multiple security controversies and its growing popularity has seen a wave of “Zoombombing” as people attempt to infiltrate meetings.

The FTC alleged that Zoom had claimed its calls were end-to-end encrypted, meaning that only those taking part in calls were able to observe them. In reality, the company often stored the encryption keys, in theory allowing meetings to be spied on. 

Zoom agreed to establish and implement a comprehensive security program, is prohibited from making privacy and security misrepresentations, and must implement other detailed and specific relief. 2/6

— FTC (@FTC) November 9, 2020

Some Zoom traffic travelled through China, raising concerns about a lack of encryption while signals were in transit. Zoom has recently started introducing end-to-end encryption and stopped routing calls through China.

The FTC alleged that the company “engaged in a series of deceptive and unfair practices that undermined the security of its users”. 

On Monday, Andrew Smith, the head of the regulator’s Bureau of Consumer Protection, said: “Zoom’s security practices didn’t line up with its promises, and this action will help to make sure that Zoom meetings and data about Zoom users are protected.”

A Zoom spokesperson said: “Today’s resolution with the FTC is in keeping with our commitment to innovating and enhancing our product as we deliver a secure video communications experience.”

The settlement was opposed by two of the FTC’s five commissioners. Rohit Chopra, one of the dissenting commissioners, said users should have been compensated by Zoom. " In my view, the evidence is clear that Zoom obtained substantial benefits through its alleged conduct. However, the resolution includes no monetary relief at all," he wrote.

Zoom shares were down 14pc on Monday, largely in response to positive news about a coronavirus vaccine that could mean less working from home in the coming months.