I spy with my little eye, a gossiping person on Zoom
May 14, 2024 10:18 AM   Subscribe

What can my company see me do on Zoom?

My company has a corporate zoom account. I host a weekly zoom meeting on it that was set up by a different person in the organization, with me set as the host, and I just log in. So I don't "own" the meeting and nothing gets sent to me after, etc.

Is it possible for the company to:
- See who logged into the meeting and what time?
- See people who tried and failed to log into a meeting?
- Secretly record or transcript the conversations in the meeting?

posted by nouvelle-personne to Computers & Internet (10 answers total) 2 users marked this as a favorite
You should assume the company can do all 3.

The meeting can be secretly recorded by anyone, completely outside of the zoom ecosystem.

If you are using a company computer, or connecting to a company VPN, then tracking your logins, (both failed or successful), is possible and even likely if they are doing typical security monitoring.

If it's a personal computer and you have never given your company any permissions or installed any software from them, and you only work remotely and not on company wifi, it's a little less likely but still very feasible they can track your logins.

For example, Zoom allows corporate accounts to set up "single sign on" which would mean when you log in, zoom asks your company's servers to verify who you say you are, which means they could have a record of you trying to access zoom.
posted by mrgoldenbrown at 10:42 AM on May 14 [2 favorites]

Best answer: Account owners and admins can access valuable data related to your Zoom account and usage through the Report section of the Zoom web portal. These support articles tell you how to use various reporting dashboards and analyze data to understand how your team uses your Zoom products.

- See who logged into the meeting and what time?

Accessing the meeting attendance report
Account owners and admins can pull a meeting attendance report, which shows a list of meeting participants. This report, which is the Active Hosts report, also shows a list of active meetings and users during a specific time range, up to one month. Active meeting means the meeting was started during the specified time range. Active user means the user has hosted at least one meeting during the specified time range.

The meeting participant report allows you to view the total number of participants and the full list of participants who joined, including their names, their email addresses (if signed in to a Zoom account), and when they joined and left the Zoom meeting. This report is useful for account owners and admins to obtain a post-meeting participant list and view the attendance report after a Zoom meeting. Additionally, account owners and admins can also export the attendee list.
- See people who tried and failed to log into a meeting?

I don't think logs include this on the account owner side, but it depends on what you mean by tried and failed.

- Secretly record or transcript the conversations in the meeting?

Modifying recording notification prompts
Zoom will always* notify meeting participants that a meeting is being recorded. It is not possible to disable this notification. For participants joining by desktop client or mobile app, the screen will display a recording consent disclaimer. For participants that join audio by phone, they will hear an audio prompt when they first join the meeting if it is already being recorded or at the time the recording is started.

Based on the type of account you have, you can modify some recording notification settings.

For Basic, Pro, Business, and Free Trial accounts with less than 100 licenses, the recording consent disclaimer is enabled for all users on a Zoom client by default and can't be disabled or customized, but voice prompts (audio notifications) can be disabled. For participants that join by phone, you have the option to require participants to press 1 to consent to being recorded and enable multiple audio notifications in which users will hear a notification each time the recording is started, paused, resumed from being paused, or stopped.
For Enterprise, API, Education, or Business accounts with 100+ licenses, account owners and admins can disable the disclaimer for internal participants and customize the recording consent disclaimer. The recording consent disclaimer is required for all guest participants.
* Keep reading: it can apparently be disabled for internal enterprise participants, unless they're making a distinction between the 'notification' and the 'consent disclaimer.'
posted by zamboni at 10:46 AM on May 14

Response by poster: Sometimes for sensitive conversations, my colleague and I will mute our zoom mics, and talk over the phone while still looking at each other on Zoom. When a mic is muted, is it really muted?
posted by nouvelle-personne at 11:26 AM on May 14

>When a mic is muted, is it really muted?
It depends who's trying to listen! But I think for these purposes it is.

I'm the admin of the Zoom account for our small business, whose specialty for a while was running public-facing events via zoom. I don't know of any way that I could access the audio of any meeting participant whose mic was muted. I suspect that the mute happens at the client or the device level, and simply doesn't deliver audio to zoom's servers, since that would seem to be the most technically sensible way to implement it. That said, Zoom as a platform is a rabbit's warren of options and checkboxes that's being constantly revised, so anything is possible, but I think it's unlikely. There's no benefit to Zoom to recording that audio, and potentially significant risk/downside.

Also FWIW, if I were an employer or someone sufficiently paranoid to be snooping this deeply into meeting behaviors, then seeing video of people using their phones to take conversations off the record would engender further suspicious questions, and maybe some bad lipreading.
posted by hovey at 12:24 PM on May 14 [7 favorites]

In general it's a good idea to avoid using organizational assets to talk about things you don't want management (or IT) to know about, but honestly I think in most organizations the risk is small, just because trawling through everyone's meeting recordings would be a huge hassle.

For the microphone question specifically, it would be pretty audacious for your company to keep recording you while saying you're on mute and you could completely subvert this by turning off your mic at the hardware level. But yes talking on the phone while on a zoom meeting looks super-suspicious!
posted by mskyle at 12:26 PM on May 14 [4 favorites]

Best answer: Another option would be to set up a plan with this coworker where you say, "let's take a break and then resume," both turn off cameras and microphones, and then call each other on the phone. This way, if someone is just tracking the meeting logs, it would look like the meeting took the expected time, but someone who watches a recording wouldn't notice anything weird - unless they were upset about you slacking off.

Also, even if the audio notification is recorded, I'm pretty sure you would still see the little recording icon in zoom. However, the transcript may still be captured - I'm not sure - and there's also that whole creepy AI assistant thing.

But honestly, if there is something you and a coworker need to talk about that you can't risk your company hearing you discuss, you should do it at another time on the phone.
posted by litera scripta manet at 5:18 PM on May 14 [1 favorite]

Response by poster: Thanks for the links.

For Enterprise, API, Education, or Business accounts with 100+ licenses, account owners and admins can disable the disclaimer for internal participants.

So, wow, if a company has over 100 employees, they can completely disable the "recording" notification for anyone within the organization. In other words, YES, big organizations can zoom-record their internal people without notification or consent.

I'm glad I asked!
posted by nouvelle-personne at 9:38 PM on May 14 [1 favorite]

AFAIK (I teach using Zoom) while the recordings may include participant screens depending on settings, they don't include sound that wasn't in the original meeting. The sound file is whatever audio the people in the meeting heard, and same for the transcript - it's created live during the meeting from the broadcasted audio. There's no secret audio recording of muted participants that I'm aware exists behind the scenes.
posted by augustimagination at 1:16 AM on May 15

With a little further digging, I think I understand what the zoom help page is saying- sorry for steering you wrong earlier.

The little '🔴 Recording' notification that appears in the corner of the screen when recording is in progress is mandatory and cannot be disabled. Enterprise users can turn off or customize the 'this meeting is being recorded' click through overlay for their employees.
posted by zamboni at 6:59 AM on May 15 [1 favorite]

Although there are reasonable measures in place within Zoom to notify and allow opt-in etc, don't assume your work is not using a third party tool to capture that information. We use stuff like that for recordings and broadcasts, but a video and audio capture tool can trivially be deployed to get any data that appears on other computers. These are ordinary paid tools so it doesn't require your company to be doing or paying for any shady services.

Muting yourself is, I believe, considered generally safe though. Your audio data is not sent at all in that case usually.

But the right answer for your threat model is, as mrgoldenbrown said, "assume they can do all 3" and don't use company assets for any kind of sensitive communications.
posted by BlackLeotardFront at 12:50 PM on May 15 [1 favorite]

« Older Gateways to Fictional Lands?   |   Tips for living in an Easy-Bake oven Newer »

You are not logged in, either login or create an account to post comments