Zoom under fire – ETH’s response

Mr Brandao, let’s start off with the question that’s on everyone’s mind: can the ETH community continue to use Zoom?
In today’s extraordinary circumstances, Zoom’s advantages outweigh potential disadvantages. For this reason, the Executive Board decided that Zoom use is permitted at ETH during the state of emergency; specifically, until the end of Spring Semester. This decision was partly informed by the Data Protection Office of the Canton of Zurich, which approved the use of Zoom during the coronavirus crisis. Switzerland’s Federal Data Protection Commissioner has not given an opinion on this issue. The federal government allows the use of cloud products that are hosted outside the country as long as they fulfil certain conditions, and Zoom meets those requirements. Once the state of emergency is over, we will reassess the use of Zoom.

Why is Zoom so popular?
The platform is reliable, it can be scaled up for a large number of users and it has an excellent track record particularly as a way to stream and record classes. We should note that without tools like Zoom, continuing to hold classes during the coronavirus crisis would have been well nigh impossible.

Why is Zoom coming under fire?
Zoom is accused of sharing personal data with third parties, such as social media companies. However, if you sign up for Zoom via ETH, all you have to provide is your email address so that the registration can be confirmed. Zoom doesn’t require further personal information. IT Services is the contact partner for Zoom, and of course we don’t share any personal data. What’s more, you can participate in Zoom meetings without signing up.

Does Zoom collect other data?
The Zoom clients transmit a large amount of technical data, for example information about the operating system or the browser used. Such information is necessary to ensure that the service is convenient for the user. However, Zoom is suspected of selling this data to third parties, which the company denies. It has recently put major effort into quelling any potential doubts about this.

There are also reports of “Zoom bombing”. What does this mean?
In “Zoom bombing”, uninvited guests gain access to a meeting and intrude upon it. I am aware of one such incident to date at ETH; in that instance, the access code for the meeting had been publicly communicated. There are several things you can do to prevent Zoom bombing. For example, you can protect access to the meeting with a password, and once all invited participants have joined, you can “lock” the meeting. The organisers can also block uninvited guests from joining. In general, links to online meetings should be shared only with those who are supposed to attend. We have put together a few key pointers for using Zoom responsibly.

And if people opt not to use Zoom, what alternatives are there?
We intended Zoom to be used primarily for teaching. For online discussions and meetings, we recommend Microsoft Teams. In light of the coronavirus crisis, we made a simple version of this platform available to all ETH members at short notice. We also offer other tools that are hosted not in the cloud but on ETH servers. One of these is Riot, the other is Skype for Business, although Microsoft plans to discontinue the latter in the next few years. However, these tools are not suitable for online classes and both fall far short of the functionality that Teams offers.

You mentioned a “simple” version.
Yes, our first step focused on options for basic communication with colleagues working from home. Everything had to be done very quickly and so we are currently suppressing certain functions. That’s partly for technical reasons, but also to make sure the IT support teams aren’t overwhelmed with questions. We expect that we will be able to make a considerably expanded version available to everyone by the end of the semester at the latest.

Could you comment on data security in Teams?
The security in Teams is much better. That’s because the data is stored in Swiss data centres as well as in EU countries. We have clear contracts with Microsoft that have also passed muster with the Data Protection Office of the Canton of Zurich. We are blocking all functionalities that store data in other countries until further notice. And finally, there is a good financial argument for Teams: we don’t have to pay separate fees for using it, as it is included in the Microsoft Office licence.