Does anyone else have concerns about the free version of Zoom?

[unmode]

Hello,

 

I'm in the process of reviewing the use of Zoom for our school. Multiple teachers are desperate to use it because it's "free" despite already having access to Microsoft Teams.

 

As an video conferencing app, it's really nice, however, schools can't manage the free version in any meaningful way.

 

As this post outlines, can anyone explain why using the free version of Zoom for teaching primary and secondary age students is any different to just allowing teachings to use Facetime or Facebook Messenger to communicate with students.

 

From what I can see, even if the teacher sets up an account against their school email address, they can just go in later an change it to something else.

 

Does anyone else have any safeguarding concerns with Zoom.

 

It seems to me that if you pay for it, it works really well and is manageable, but the free version looks exceptionally conspicuous.

 

Any feedback would be appreciated.

 

Thanks

Edited April 1, 2020 by unmode

[mavhc]

Ask them why they want to use it rather than Teams

[TechMonkey]

We are not using Zoom and actively advising against it due to the various privacy, security and safeguard issues. The free version is not under the US child protection regulations, although if you sign up for the education version which is free it does.

[network41]

Disgusting

 

https://www.bbc.co.uk/news/technology-52105209

 

Don't think I will be using it anymore

[jmak]

I can't see a good reason for a education institution to use it over Teams or Google. However, having had a quick look at the Zoom options, I reckon even with free accounts it should be possible to run it in a way that would meet minimum safeguarding requirements.

 

As a starter, I would say that you need to mandate:

 

1) All meetings must be scheduled between all parties (you can have guests on recurring links, which means no records of who joined or when; not acceptable for school use. Means that all students would need their own account.)

2) All meetings must be recorded (available for free accounts, but only for recording locally, which would require manual intervention by teacher running the meeting. I'd then insist that the teacher upload that to the school Google Drive or SharePoint.)

3) A record of every meeting must be provided to your line manager for audit purposes.

 

Tell teachers this is for their own protection and alert management that if they don't keep records like this, the school is open to accusations of safeguarding issues. Of course, all of this can be automated in either the MS or the Google system.

 

After that, you might find you get backing from teachers and management to use the proper tools for the job. The downside is that it's more work for the technical team - but that's what we're there for.

[elsiegee40]

Disgusting

 

https://www.bbc.co.uk/news/technology-52105209

 

Don't think I will be using it anymore

 

The problem in this case was having a public meeting. A meeting protected by a strong password should not get zoom-bombed. However, it doesn’t prevent the little darlings texting the meeting password to third parties.

 

For Safeguarding reasons, you shouldn’t be doing online sessions like this without some sort of control over who can join.

[jmak]

Disgusting

 

https://www.bbc.co.uk/news/technology-52105209

 

Don't think I will be using it anymore

The behaviour of the "Zoom bomber" is despicable, but in fairness, I don't think this is the fault of the platform. If you publish joining details for the meeting to the web and don't secure it, there will be people who take advantage. This is why anything used for school must be properly secured, irrespective of the platform being used.

[saggu]

The problem in this case was having a public meeting. A meeting protected by a strong password should not get zoom-bombed. However, it doesn’t prevent the little darlings texting the meeting password to third parties.

 

For Safeguarding reasons, you shouldn’t be doing online sessions like this without some sort of control over who can join.

 

If only the SLT in the school understands this. For them we are just the blocker and not letting them do what they want to do.

[TechMonkey]

I can't see a good reason for a education institution to use it over Teams or Google. However, having had a quick look at the Zoom options, I reckon even with free accounts it should be possible to run it in a way that would meet minimum safeguarding requirements.

 

As a starter, I would say that you need to mandate:

 

1) All meetings must be scheduled between all parties (you can have guests on recurring links, which means no records of who joined or when; not acceptable for school use. Means that all students would need their own account.)

2) All meetings must be recorded (available for free accounts, but only for recording locally, which would require manual intervention by teacher running the meeting. I'd then insist that the teacher upload that to the school Google Drive or SharePoint.)

3) A record of every meeting must be provided to your line manager for audit purposes.

 

Tell teachers this is for their own protection and alert management that if they don't keep records like this, the school is open to accusations of safeguarding issues. Of course, all of this can be automated in either the MS or the Google system.

 

After that, you might find you get backing from teachers and management to use the proper tools for the job. The downside is that it's more work for the technical team - but that's what we're there for.

 

Safeguarding yes, what about GDPR? They share all their data far and wide from both ends of the connection, not just the meeting organiser, unless you get the Education version.

[atcoates]

I'm having the same argument with one of my schools. We have Google meets already setup but one school is insisting they use Zoom. I'm not backing down..so probably be looking for a new job soon. This article was a timely reminder about the concerns I've already expressed to them.

[jmak]

Safeguarding yes, what about GDPR? They share all their data far and wide from both ends of the connection, not just the meeting organiser, unless you get the Education version.

Fair comment.

 

Also this:

 

https://metro.co.uk/2020/03/31/boris-johnson-sparks-security-concerns-revealing-zoom-id-cabinet-meeting-12489236/

 

If you believe the Downing Street statement, it's all covered by various mitigation options including not reusing the same meeting ID, but at least the story gives you some evidence that it's not all roses. Also mentions that it's banned by MoD.

[AndyCrow]

Under GDPR, any new process within the school must have a Data Protection Impact Assessment completed before it's used. This needs to be signed off by the DPO.

I presume that this has been done for Teams and is therefore good to use, however Zoom cannot be used if it has not been signed off on.

[atcoates]

Under GDPR, any new process within the school must have a Data Protection Impact Assessment completed before it's used. This needs to be signed off by the DPO.

I presume that this has been done for Teams and is therefore good to use, however Zoom cannot be used if it has not been signed off on.

I pointed all of this out and reply was, "I appreciate that but still want it set up"

[AndyCrow]

Tell them you will when the DPO confirms that they are happy.

[3s-gtech]

They cannot override policy or GDPR/data protection with ‘want’. The number of reports coming through about the free version at the moment put this firmly in the ‘not at the moment, until the company has clarified’ category.

[atcoates]

Tell them you will when the DPO confirms that they are happy.

She is!

[unmode]

We are not using Zoom and actively advising against it due to the various privacy, security and safeguard issues. The free version is not under the US child protection regulations, although if you sign up for the education version which is free it does.

 

Thanks for this. So, there is a free education version? Do you know how you sign up for this as I can only find a paid for education version on the website.

[TechMonkey]

Thanks for this. So, there is a free education version? Do you know how you sign up for this as I can only find a paid for education version on the website.

 

Only free during the current situation. It has a request button on the front of the Education site https://zoom.us/education

 

You may want to check with them that the free version is the Education version. I haven't enquired as I am not intending to use it.

[mavhc]

If the DPO has filled in the correct forms it's their fault now.

 

Of course if someone wants to guess that john's password is john, or john sends the password to someone else, your google meet isn't secure either

[atcoates]

The Google meets can't be sent outside our domain.

[Jamman960]

One of our SLT wanted to use this, my biggest kickback was that our pupils would end up setting up their own zoom meetings between each other, not great if we’re the ones providing the devices and app... at least with teams we can block them and audit calls made

 

The only valid complaint is that teams only shows a grid of 4 videos whereas Zoom shows up to 49

 

For now they’ve backed off and seem to have agreed to use teams like everyone else... I won’t be pushing the zoom app out

[mdrabble]

Out SLT want to use this for staff - i've said my piece and how we should stick with Teams for most of the reasons host have mentioned on here and SLT have largely ignored what i've said - all because some SLT are not keen on Teams!

 

Will only be a matter of time before some staff start using Zoom with students - and when it hits the fan i will sit back and let them deal with the issues!

[mavhc]

Got to ask why and get real reasons "not keen on" is not a real reason.

 

2 more bugs in Zoom https://techcrunch.com/2020/04/01/zoom-doom/

[Arthur]

You may want to check with them that the free version is the Education version.

It's not. It's just the basic version without a 40-minute time limit. From your link...

 

Zoom is temporarily removing the 40-minute time limit on free Basic accounts for primary and secondary schools affected by the Coronavirus.

 

The Education edition is still paid and very expensive.

Edited April 2, 2020 by Arthur

[Arthur]

2 more bugs in Zoom https://techcrunch.com/2020/04/01/zoom-doom/

 

https://objective-see.com/blog/blog_0x56.html

https://twitter.com/hackerfantastic/status/1245133371262619654

https://twitter.com/DanAmodio/status/1245329512889487361

 

Also...

 

Elon Musk's SpaceX bans Zoom over privacy concerns: memo

 

Elon Musk’s rocket company SpaceX has banned its employees from using video conferencing app Zoom, citing “significant privacy and security concerns,” according to a memo seen by Reuters, days after U.S. law enforcement warned users about the security of the popular app.

 

Use of Zoom and other digital communications has soared as many Americans have been ordered to stay home to slow the spread of coronavirus.

 

SpaceX’s ban on Zoom Video Communications Inc illustrates the mounting challenges facing aerospace manufacturers as they develop technology deemed vital to national security while also trying to keep employees safe from the fast-spreading respiratory illness.

 

In an email dated 28 March, SpaceX told employees that all access to Zoom had been disabled with immediate effect.

 

“We understand that many of us were using this tool for conferences and meeting support,” SpaceX said in the message. “Please use email, text or phone as alternate means of communication.”

 

Two people familiar with the matter confirmed the contents of the mail.

 

A representative for SpaceX, which has more than 6,000 employees, did not respond to a request for comment. Chief Executive Musk also heads electric car maker Tesla Inc .

 

NASA, one of SpaceX’s biggest customers, also prohibits its employees from using Zoom, said Stephanie Schierholz, a spokeswoman for the U.S. space agency.

 

The FBI’s Boston office on Monday issued a warning about Zoom, telling users not to make meetings on the site public or share links widely after it received two reports of unidentified individuals invading school sessions, a phenomenon known as "zoombombing".

 

Investigative news site The Intercept on Tuesday reported that Zoom video is not end-to-end encrypted between meeting participants, and that the company could view sessions.

 

Zoom did not immediately respond to requests for comment on SpaceX’s decision, but it has been advising users to use all the privacy functions on its platform.

 

As a defense contractor, California-based SpaceX has been classified as an essential business, allowing it to stay open through shutdowns that are in effect in California and Texas, the development and testing hub for its Starship rocket that could be used to get to the moon and Mars and send national security satellites to space.

Edited April 2, 2020 by Arthur