Zoom encryption fiasco continues with another U-turn

At what is increasingly looking like a shambolic business, Zoom CEO Eric Yuan has said Zoom will offer end-to-end encryption after widespread criticism.

After previously stating the firm would only offer end-to-end encryption to paying customers, a decision which was highly condemned by privacy advocates, Yuan has written a blog post to state the security feature will be made available to anyone who authenticates their identity.

“Since releasing the draft design of Zoom’s end-to-end encryption (E2EE) on May 22, we have engaged with civil liberties organizations, our CISO council, child safety advocates, encryption experts, government representatives, our own users, and others to gather their feedback on this feature,” said Yuan.

“We have also explored new technologies to enable us to offer E2EE to all tiers of users.”

One has to question how many lives Zoom has. Questionable links to China were revealed, Zoombombing became a thing, accounts of human rights activists in Hong Kong were shut down at the behest of the Chinese Government, security credentials were questioned by New York State Attorney General Letitia James and the firm lied about implementing end-to-end encryption. After all this, the business still survived.

The latest criticism of Zoom came from numerous corners of the technology industry. Mozilla and the Electronic Frontier Foundation (EFF) penned an open letter damning the move to monetize privacy, while the American Civil Liberties Union suggested it was a way to get rid of the “riff raff” on the service.

Privacy should be considered a consumer right. And at a time where virtual communications services are critical in a society with restricted movements, charging for privacy should be considered an example of corporate opportunism. Interestingly enough, no-one else has decided to take this approach.

Any messaging service worth its salt offers end-to-end encryption as a free feature. WhatsApp, Facebook Messenger, Microsoft Teams and GoToMeeting are all examples, while Google Meet offers transport encryption, a lesser security feature, which has slipped below the radar. It has become widely accepted end-to-end encryption should be an industry standard, built into products not offered on top as a premium feature, which makes the Zoom move all the cheekier during the COVID-19 pandemic.

Ultimately, we suspect that the only thing able to match Zoom’s rise to fame will be its fall from grace.

As society begins to reopen, the consumer usecase will drop off, some can already see this with weekly ‘pub quizzes’ with friends becoming less common, while corporate usecases are likely to go elsewhere.

In the coming weeks and months, enterprise organisations are likely to go through rationalisation programmes for cloud services. As the shift to remote working was predominantly a knee-jerk reaction for many, contracts would have been signed and deals make in somewhat of a rush. As the landscape calms, IT decision makers will likely re-evaluate the relevance of these services.

One interesting trend which could emerge, and would be a consequence for Zoom, is a preference for IT companies with a broader portfolio. For example, Microsoft can offer numerous collaboration tools, as well as cloud computing services and other enterprise IT solutions. Bundling these services together is a more favourable option both operationally and financially for enterprise customers.

This is where Zoom is at a disadvantage. It offers video conferencing and cloud-based telephony services, but little else, and probably at a premium compared to rivals. Zoom might offer a better service, depending on who you ask, but sometimes quality has to be sacrificed in the capitalist quest for profit. This might be an example.