the Guardian Government and parliament were told by the intelligence agencies last week not to use the videoconferencing service Zoom for confidential business, due to fears it could be vulnerable to Chinese surveillance.
The quiet warnings to limit the technology came after the cabinet had used Zoom to hold a well-publicised meeting at the end of March, a decision that was defended at the time as necessary in “unprecedented circumstances”.
Parliament was advised last week by the National Cyber Security Centre, part of intelligence agency GCHQ, that Zoom should only be used for public business.
A parliamentary source said those involved were advised Zoom ought not be used for classified business and there was an explicit warning from NCSC “not use it to talk about things detrimental to the interests of China”.
But the warning was only shown to people directly engaged in the negotiations, and not shared more widely with MPs, including members of the foreign or other select committees who may want to conduct inquiries into China-related matters.
Senior parliamentary figures were also told that Zoom was safe to use for public business, and the technology was this week used as part of the proceedings in the House of Commons, including at prime minister’s questions.
Zoom has exploded in popularity during the coronavirus lockdown as a tool for communication for both social and business purposes, and is now used globally by an estimated 300 million people a day. The company’s success has prompted rapid responses from competitors such as Facebook, who announced on Friday a new feature letting up to 50 people join a Messenger video chat.
The Citizen Lab, a digital communications laboratory based at the University of Toronto, warned in early April about potential security risks. Security keys, which are supposed to encrypt conversations “in some cases, are delivered to participants in a Zoom meeting through servers in China” it said in a special report published earlier this month.
Zoom said this traffic was mistakenly routed through China. However, the government of Taiwan – a country not recognised by China – announced early this month that it would ban the use of products “such as Zoom” where there were security concerns.
The Citizen Lab said the popularity of the technology made it of “high priority interest to multiple governments” and would make “Zoom a high priority target for signals intelligence gathering and targeted intrusion operations”.
Zoom is based in California’s Silicon Valley, but it owns three companies in China that develop its software. The Citizen Lab said the structure allowed the company to lower its development costs, but added “this arrangement may make Zoom responsive to pressure from Chinese authorities.”
In response, Zoom has sought to beef up its security, releasing the new version 5 of its app with greater encryption and privacy controls and introducing controls to prevent “Zoombombing” where people have hacked into meetings – such as Alcoholics Anonymous sessions – to disrupt them.
A Whitehall source said that an alert about Zoom was circulated to government departments, who were asked to pass it on to quangos, because of the concerns about whether China might be able to listen in.
But they complained that the warning was not always being taken sufficiently seriously in parts of Whitehall, although Zoom is currently permitted for meetings where no confidential matters are being discussed.
A government spokesperson said that “Zoom is being used for unclassified communications in government under unprecedented circumstance” but added: “Other services are in place for more sensitive communications.”
The availability of these more secure services was being increased to meet the demand of more civil servants having to work remotely, the spokesperson added.
Zoom said its technology is being used by banks, universities and other government agencies around the world. It added the “routing issues described in Citizen Lab’s research were a temporary issue caused when Zoom failed to fully implement its usual geo-fencing best practices”. These were fixed, it said, and customers who pay to use Zoom can customise where the traffic is processed.
The software company said the software developers in China who work as subcontractors to the company were “largely managed by our engineering team in the United States” and said they did not have access to Zoom’s development environment in the US.
But a second Citizen Lab report on April 8 – five days after the first – said that while Zoom had taken actions to improve its security “we discourage the use of Zoom in cases where strong confidentiality and privacy is required” including for “governments worried about espionage”.
In response to Zoom’s success, Facebook announced on Friday the launch of Messenger Rooms, a new feature for the company’s Messenger app that allows up to 50 people to join a group chat – even if they don’t have a Facebook account, an unusual move for the company that mirror’s Zoom’s own attempts to prioritise ease of use.
The social network also doubled the number of people who could join an encrypted WhatsApp video call, from four to eight, and announced a raft of updates to Facebook Live, which lets users broadcast to many viewers at once.
According to Stan Chudnovsky, vice-president of Messenger, video calling on Messenger and WhatsApp more than doubled in areas most affected by Covid-19, and views of Facebook Live and Instagram Live videos increased significantly in March.
News is under threat …
… just when we need it the most. Millions of readers around the world are flocking to the Guardian in search of honest, authoritative, fact-based reporting that can help them understand the biggest challenge we have faced in our lifetime. But at this crucial moment, news organisations are facing an unprecedented existential challenge. As businesses everywhere feel the pinch, the advertising revenue that has long helped sustain our journalism continues to plummet. We need your help to fill the gap..
