The U.S. Federal Trade Commission released an agreement containing a consent order against Zoom Video Communications to settle alleged unfair and deceptive practices surrounding Zoom’s misleading statements about the company’s encryption practices, cloud storage encryption practices and use of an invasive web server.
Founded by Eric Yuan in 2011, Zoom has become an incredibly popular videoconferencing tool since the pandemic forced millions to work and communicate from home. Zoom went from having about 10 million daily users in December 2019 to having more than 300 million daily users by April 2020. Zoom’s userbase includes businesses, schools, government, social and religious groups, and medical institutions. Zoom told users their conversations and recorded meetings were secure with Zoom’s touted “end-to-end encryption” and “256-bit encryption.” However, according to the FTC’s complaint, the reality was starkly different.
While the FTC’s settlement provides that Zoom must enact certain security measures, it does not mention a privacy program or offers a remedy to injured consumers. Commissioners Rebecca Kelly Slaughter and Rohit Chopra published separate dissents. Their dissents foreshadow trends for a future FTC action against a company engaged in unfair and deceptive practices involving consumer privacy.
The complaint alleges five FTC Act violations
The FTC’s complaint details five violations of the FTC Act by Zoom. In each case, the FTC alleges Zoom falsely stated the company adhered to a certain security standard that it did not.
- End-to-end encryption. The complaint alleges Zoom represented to consumers that it used end-to-end encryption to maintain secure communications between participants on a Zoom call when, in fact, it only used end-to-end encryption when a call was hosted on a customer’s server. End-to-end encryption means that only the parties involved in the communication can access the communication. As a result of the representation, all users believed their Zoom meetings were protected by end-to-end encryption when they were not.
- 256-bit encryption. The complaint alleges Zoom represented that it used 256-bit encryption to secure communications and meetings on Zoom. However, Zoom used a lower level of encryption instead.
- Cloud storage security. The complaint alleges Zoom represented that recorded Zoom calls were immediately encrypted and stored in Zoom’s cloud storage upon a call’s end. However, the calls were actually stored on Zoom’s servers and remained unencrypted for up to 60 days before being moved to cloud storage and encrypted.
- Circumvention of browser security. In July 2018, Zoom’s update for Mac computers deployed a web server that circumvented a privacy safeguard in Apple’s Safari browser onto users’ computers without adequate notice or consent. When activated, the server would automatically open Zoom and, by default, immediately activate a user’s webcam. The complaint alleges that by deploying the webserver and avoiding the browser privacy safeguard, Zoom likely caused or would have caused “substantial injury to consumers.”
- Deceptive failure to disclose. The complaint alleges Zoom represented that it was updating its Mac app to resolve minor bug fixes. However, Zoom did not disclose that the update would deploy a web server onto users’ computers that would circumvent browser security features.
The agreement containing a consent order
The commission released an “Agreement Containing a Consent Order,” and two commissioners published separate dissents. The dissents did not disagree with the majority but instead expressed it did not go far enough in either disciplinary actions or remedies to injured parties.
The consent agreement outlines how Zoom should overhaul its security process to create a better system designed to protect consumers. In April, seven months prior to the release of that agreement, Zoom released a statement explaining that the company has already begun taking steps to protect user security.
The consent agreement outlines a multitude of steps and procedures Zoom must take, including:
- Create an information security program documented in writing, run by qualified employees, and designed with security in mind.
- Implement a security review for all software updates prior to releasing the updates to the public.
- Implement a vulnerability management program.
- Implement data deletion procedures.
- Host regular security training programs for employees.
- Create and implement incident response policies.
- Test and monitor new safeguards at least once every 12 months.
- Obtain biennial assessments performed by an objective, independent third-party professional.
- Cooperate with the third-party assessors by providing available information and disclosing material facts.
- Provide annual certification to the FTC that the measures outlined in the Consent Agreement are upheld.
The FTC released a shortened analysis of the consent agreement to aid with understanding for public comment. Comments can be submitted online through Dec. 14, 2020.
The dissents
Both Slaughter and Chopra released dissents that highlight the potential future trends in FTC enforcement actions. As former Commissioner Julie Brill explained during a LinkedIn Live hosted by the IAPP, it is important to pay attention to dissents. She explained dissents are particularly important at the FTC given that the vast majority of cases are resolved unanimously. Dissents can foreshadow where the agency may head in future cases.
Both commissioners give suggestions in their dissents that would aid both existing and emerging companies in enacting good cyber hygiene policies and put a focus on the interplay between security and privacy.
Slaughter’s dissent
Slaughter released a strongly worded dissent. The dissent points to two potential trends going forward: (1) the FTC may put more emphasis on the privacy implications of security shortcomings; and (2) the FTC may be more likely to provide a remedy or recourse for harms caused by privacy failures.
Her dissent pinpoints the difference between security and privacy and rejects the idea advanced by the Consent Agreement that security by default means privacy. Consumer privacy is notably not mentioned in the Consent Agreement. “[T]his omission reflects a failure by the majority to understand that the reason customers care about security measures in products like Zoom is that they value their privacy,” she writes. The dissent explains that while strong security measures are a necessary component to having robust privacy protections, security measures do not automatically lead to privacy protections.
Additionally, her dissent argues that the commission’s proposed settlement did not provide any sort of recourse or remedy for Zoom’s pre-pandemic paying customers who were injured by Zoom’s prior deceptive practices outlined in the complaint. Her dissent also points out that while the Consent Agreement presents how Zoom must establish security practices, it does not explain how Zoom can establish privacy protections for Zoom users.
Privacy practitioners and businesses can glean important lessons from Slaughter’s dissent, which could become a road map for future privacy enforcement at the FTC. Comprehensive privacy programs may continue to play an important role for businesses as activities continue to be remote. Security practices absent a privacy program may not be enough to persuade a future FTC commission that a company has done enough to protect consumers.
In particular, her dissent suggests that companies should not prioritize features that opt for ease of use over privacy protections because the commission may view that as “not only a data-security failing,” but a “privacy failing,” as well.
Key takeaways for practitioners and businesses can be found in Slaughter’s suggestions for a more effective order. The dissent states that a more effective order would require the company to (1) “engage in a review of the risks to consumer privacy presented by its products and services; [(2)] implement procedures to routinely review risks; and [(3)] build in privacy-risk mitigation before implementing any new or modified product, service, or practice.”
Going forward, privacy violation remedies could include a combination of a comprehensive privacy program and a comprehensive security program instead of one or the other. Potential remedies could include redress, refunds and notices to customers of deceptive practices, security shortcomings and privacy failures.
Businesses and practitioners can begin by self-auditing their own privacy programs and making sure privacy-by-design principles are used when designing products or services.
Chopra’s dissent
Chopra’s dissent focuses primarily on what he calls the FTC’s “status quo approach to privacy, security, and other data protection law violations.” He dissented because the consent agreement did not do enough to provide remedies for impacted Zoom users. He also would have preferred to see Zoom send notices to users alerting them of the outcome of the FTC’s decision and Zoom’s prior issues.
His dissent foreshadows a future FTC that protects and promotes fair markets by acting as a “credible law enforcement agency, especially when it comes to large players in digital markets.”
The dissent lists a series of actions he would like to see occur at the FTC that also predict where the FTC may head in the future. Practitioners and businesses can anticipate investigations in which engineers and designers more closely scrutinize their technical protections and interface design choices. They can also expect a shift to a “greater willingness to pursue administrative and federal court litigation” and an increase in cooperation between international, federal and state partners. Startups can look forward to the FTC releasing “simple, clear rules of the road.”
Final takeaways
While the commissioners all agreed Zoom acted in an unfair and deceptive manner, the majority stuck to reprimanding Zoom without providing redress, notice or remedy to consumers. This decision prompted Chopra and Slaughter to write dissents, both citing the need for increased remedies for privacy failures. The majority outlines a comprehensive security regime for Zoom to follow going forward, which it has already begun to implement independently.
The dissents provide a glimpse into what could be the future of FTC enforcement actions for privacy violations, including increased remedies and redress for injured consumers, increased cooperation between federal, state and international partners, and an emphasis on privacy risk mitigation and privacy programs. It appears Slaughter and Chopra would prefer to see a stronger FTC privacy enforcement scheme.
Photo by ipse dixit on Unsplash