Taiwan Bans Official Use of Zoom Over Cybersecurity Concerns

(Bloomberg) -- Taiwan barred all official use of Zoom, becoming one of the first governments to impose an outright ban on the popular video-conferencing app over mounting security concerns.

Agencies should avoid using services such as Zoom as they may have security flaws, the island’s cabinet said in a statement Tuesday. Governments, companies and individuals around the world, including in Taiwan, have been using the app to conduct meetings remotely in an effort to minimize person-to-person contact amid the coronavirus pandemic.

Taiwan’s ban is the latest blow to San Jose-based Zoom Video Communications Inc. as it struggles to cope with an explosion in demand for its services. Millions of people have turned to the app as they work and study from home amid the global lockdown. But cybersecurity researchers have warned that security loopholes in the software could allow hackers to eavesdrop on meetings or commandeer machines to access secure files, and traffic from some users has been routed through data centers in China.

“The rapid uptake of teleconference platforms such as Zoom, without proper vetting, potentially puts trade secrets, state secrets, and human rights defenders at risk,” researchers at the University of Toronto’s Citizen Lab wrote.

Taiwan isn’t the first to take such action. Elon Musk’s SpaceX and New York City’s Department of Education have already banned its use.

Zoom routed data through servers in China and used developers there, Citizen Lab said in its report last week. Any official data being routed through China poses a major risk for Taiwan. Beijing claims the self-ruled island as part of its territory, and threatens to invade if Taiwan moves to make its independence official. Taiwan’s government rejects China’s claim, viewing the island as a sovereign nation.

The company said it had mistakenly sent traffic through Chinese data centers as it was dealing with a “massive increase” in demand. It said it has stopped using that capacity as backup for non-Chinese clients.

Links to China are not the only concern with Zoom. Weak encryption technology has given rise to the phenomenon of “Zoombombing”, where uninvited trolls gain access to a video conference to harass the other participants. Recordings of meetings have also shown up on public internet servers.

Zoom Chief Executive Officer Eric Yuan has apologized for the lapses, acknowledging in a blog post last week that the company had fallen short of expectations over privacy and security.

A “large number” of institutions around the world have completed security reviews of Zoom’s services and continue to use it, Zoom said in an emailed statement Wednesday.

In the absence of an established domestic alternative to Zoom, Taiwan’s government said Tuesday that services from Alphabet Inc.’s Google and Microsoft Corp. have been deemed acceptable.

©2020 Bloomberg L.P.