“The AES-128 keys, which we verified are sufficient to decrypt Zoom packets intercepted in Internet traffic, appear to be generated by Zoom servers, and in some cases, are delivered to participants in a Zoom meeting through servers in China, even when all meeting participants, and the Zoom subscriber’s company, are outside of China.”
Zoom is one the companies that has come under fire for its ties to China. According to its SEC filings, Zoom isn’t just sending data through China, it also has 13 colocated data centers in Australia, Brazil, Canada, Germany, India, Japan, the Netherlands and the U.S. For more information, refer to the US government's list of sanctioned countries. Sign up for the That could mean, in … Reuters/Carlo Allegri Following the incident, Zoom said it would not allow requests from the Chinese government to impact anyone outside of mainland China.Zoom is a U.S.-founded company and its founder Eric Yuan is a Chinese immigrant who is now an American citizen. "During spells of heavy traffic, the video-conferencing service shifts traffic to the nearest data center with the largest available capacity – but Zoom's data centers in China aren't supposed to be used to reroute non-Chinese users' calls.This is largely due to privacy concerns: China does not enforce strict data privacy laws and could conceivably demand that Zoom decrypt the contents of encrypted calls.They wrote: "During a test of a Zoom meeting with two users, one in the United States and one in Canada, we found that the AES-128 key for conference encryption and decryption was sent to one of the participants over TLS from a Zoom server apparently located in Beijing, 52.81.151.250. Zoom currently groups its data centers into these regions: Australia, Canada, China, Europe, India, Japan/Hong Kong, Latin America, and the US.Users on the company’s free tier can’t change their default data center region, though any of those users outside of China won’t have their data routed through China, according to Zoom. Its China-based partners — Bizconf Communications, Suirui Zhumu Video Conference and Systec Umeet — are the three that Zoom recommends customers to switch to. Market Data powered by QuoteMedia. as well as other partner offers and accept our The answer may have to do with how quickly Zoom moves to neutralize security threats – and how that plays out with its institutional users.Market Data copyright © 2019 QuoteMedia. The company admitted earlier this year that it had mistakenly routed some meetings through servers in China. "The researchers noted that Zoom has some 700 employees in China, across several Chinese subsidiaries.Zoom did not immediately respond to Business Insider's request for comment and clarification. Zoom did admit to routing data through Chinese servers back in May when there was a surge in users in the backdrop of global lockdowns. Restricted countries or regions. Security researchers have also accused Zoom of re-routing calls through its servers in China, even though those calls were placed outside China. Sign up for our Tech newsletter. Zoom Video Communications will shift to a partner-only model in mainland China from Aug. 23, suspending direct sales to all customers in the region, the company said on Monday. That means clients will no longer be able to buy services directly from Zoom. Zoom’s privacy issues. Spokespersons explained that a default region is typically always locked in, but in within the company’s robust cloud architecture, “regional selections will be honored” for those who pay for access – for instance, school districts and other institutional customers relying on Zoom for crucial coronavirus operations.Reports around this behavior show that users were concerned about some meetings getting routed to China in a way that didn’t gel with regular protocol.“On April 3rd, (a report released by Citizen Lab described) how Zoom’s encryption scheme sometimes used keys generated by servers in China,”“The AES-128 keys, which we verified are sufficient to decrypt Zoom packets intercepted in Internet traffic, appear to be generated by Zoom servers, and in some cases, are delivered to participants in a Zoom meeting through servers in China, even when all meeting participants, and the Zoom subscriber’s company, are outside of China.”This is the kind of thing that the choice-of-center move is supposed to address. If you have a need for online video conferencing, you may reach out to our partners," the company said on its Chinese website.Zoom started notifying customers in China on Monday about the change, which will come into effect on Aug. 23, 2020, according to a letter seen by CNBC. Separately, researchers at the University of Toronto also found Zoom's encryption used keys issued via servers in China, even when call participants were outside of China. Terms of Use. Data is a real-time snapshot *Data is delayed at least 15 minutes. Yuan said Zoom first added servers in China, where the outbreak began. The company admitted earlier this year that it had mistakenly routed some meetings through servers in China.