Video Conferencing – You Have Options

apple apple device design desk

During a time of social distancing law firms, courts, schools, and more are now meeting via video conference. Zoom rapidly became the platform of choice due to its low price point and ease of use. However, Zoom has been besieged with security issues, many of which are being rapidly addressed. There are still ways to use Zoom securely, and there are also plenty of options lawyers can consider for their video conferencing needs.

In Comment [19] to NC RPC 1.6, lawyers are given some guidance as to how to determine if they have made reasonable efforts to prevent access or disclosure of confidential client information. The factors include the sensitivity of the information, the likelihood of disclosure if additional safeguards are not employed, the cost of employing additional safeguards, the difficulty of implementing the safeguards, and the extent to which the safeguards adversely affect the lawyer’s ability to represent clients. Taking those factors into consideration, lawyers can weigh the pros and cons of various video conferencing platforms.

The Elephant in the Room

Zoom’s video conferencing platform quickly became the video conferencing platform du jour for lawyers and the rest of the world. Why? It is free or inexpensive, dead simple to use and works well on almost any device, browser, or operating system. Zoom integrates with Office 365, Slack, G-Suite, Calendly and many other applications.

Zoom’s popularity also meant that its security protocols (or lack thereof) came under intense scrutiny. From server traffic routing through China to an overly broad privacy policy to weak encryption, there is plenty of work for Zoom to do to improve their security. And they are working to address those things. Other security concerns stem from their huge user base and high profile. Hackers and bad actors looked for exploits and the results were stolen login credentials, Zoom bombing, wardriving for open Zoom meetings, zero-day exploits and more. Tom’s Guide documents all the Zoom security issues, as well as what has been fixed. Although Zoom has dedicated the next 90 days to begin addressing the security issues and has made several fixes, Google and Tesla both banned the use of Zoom for work.

There are a few noted legal technologists who have made the argument that, used effectively, Zoom can be used for secure communication. Simon Boehme and John Grant write that Zoom is Safe for Lawyers (if you use it right), John Simek from Sensei Enterprises also suggests the same – Zoom can be used by lawyers if appropriate safeguards are followed, and Sharon Nelson follows with “Lawyers: Don’t be Afraid to Use Zoom”.

Zoom has released version 5.0 of the software and it includes a lot of security features including upgraded encryption, security controls in the meeting toolbar to easily enable a waiting room, report a user, and remove participants. They have added meeting registrations, a screen share watermark that superimposes the image of a meeting participant’s email address onto shared content in the event a participant takes a screenshot, complex meeting IDs and much more. All Zoom clients on versions older than 5.0 will be required to upgrade by May 30 to join meetings as GCM Encryption will be fully enabled for all meetings then.

If, based on weighing the pros and cons outlined in the “reasonableness” checklist from NC RPC 1.6, considerations as illustrated in Suzanne Lever and Brian Oten’s article “Professional Responsibility in a Pandemic”, and independent judgment, a lawyer chooses to use Zoom for client meetings and representation, what are some of the safeguards available?

Zoom Settings Checklist

The following list of Zoom settings and options is not comprehensive and will depend on what Zoom plan you are using.  Personal free plans will have many of these features, while multi-user paid plans may need assistance from an administrator to adjust global default settings. To set all your options, go to Zoom.us, login, and go to My Account. Many of these options are customizable on the fly when you are in a meeting as host. Which settings you use will be contingent on what type of meeting you are planning to host.

Meeting Invitations and Initial Settings

There are many ways to schedule a Zoom meeting. You can use the Zoom desktop client, an Outlook or Google Calendar plugin, or go to the browser and login to Zoom.us and choose “Schedule a Meeting”.

There are two types of meeting links you can send to attendees. If you schedule a meeting using “generate automatically” a unique ID will be generated. You can set an additional password for the meeting. If you use the Outlook or Gmail integration the meeting information will be sent out as a calendar event and the password will be embedded in the event notes. If you need to be extra careful you can remove the password and send it separately. Another option is to go to Zoom.us – Settings – Meeting – Schedule Meeting and you can toggle on or off  “Embed password in meeting link for one-click join” which puts the meeting password into the invitation link (encrypted) so that participants do not have to enter the password. You can also toggle on or off “Require password for participants joining by phone, which requires a numeric password, which will automatically be generated if the meeting already has an alphanumeric password.

As an alternative to the automatically generated unique ID you can use a Personal Meeting ID, which is a static meeting ID. In your profile you can create a personal link, which will give you the option of creating a short link with any name (4-40 characters) you choose. To add a meeting password to your Personal Meeting ID go to “Meetings” and in your Personal Meeting Room check “Meeting Password” and set your password. When you send an invitation using your Personal Meeting ID the password will be embedded in the event notes if you use the Google Calendar or Outlook Calendar integration. If you make the link available by copy/pasting it into social media or through an event registration system like EventBrite, you will need to email the password to the attendees.

Best practice settings for when someone joins a meeting include muting the participants upon entry and disabling joining before the host. It has been suggested that having participants videos enabled by default may make it easier to identify who has joined, though if you have people joining by phone only this option won’t make much difference. You can also toggle on “only authenticated users can join” which will require participants to create a (free) Zoom account and login to access the meeting.

Other settings at Zoom.us – My Account – Settings – In Meeting (Basic) to consider include toggling off “Allow removed participants to rejoin” and “Allow participants to rename themselves”.

Chat Settings

At Zoom.us – My Account – Settings – In Meeting (Basic) you can make some granular changes to how people use chat. You can prevent participants from saving chats, disallow participants from sending a message that is visible to all participants, and toggle off  “auto saving chats”. It depends on the purpose of the meeting which chat features you choose. For instance, if you don’t want participants to have “side bar” chats you can disable Private chat so that users cannot send private 1:1 messages to other participants. You can and should toggle off  “File Transfer” to disallow hosts and participants to send files through in-meeting chats. as a best practice, you should also not send links to document via chat .

Screen Sharing

In the account settings scroll down to screen sharing (My Account – Settings – In Meeting (Basic). The option to let All Participants share their screen is the setting that allowed the Zoom Bombing to occur. Set the default to Host Only for “Who can share?”.  If you use the Whiteboard consider toggling off the “Auto save whiteboard content when sharing is stopped” as this content is saved to your Zoom account. Since the information stored in Zoom is potentially insecure it is best not to save chat or whiteboard content on the platform. You can also toggle on or off “Annotation” during screen sharing to allow/disallow participants to use annotation tools to add information on shared screens.

Advanced Settings

At Zoom.us – My Account – Settings – In Meeting (Advanced) you can turn on or off breakout rooms. Lawyers using Zoom for depositions, mediations and ODR are using this feature. Another advanced setting is whether you allow users to replace their background with an image (Virtual Backgrounds). Virtual backgrounds can help reduce distractions and privacy issues from displaying your home office, though there is always the possibility that someone could use an inappropriate image as their background. It is dependent on the type of meeting you are hosting as to whether you allow virtual backgrounds. Disable “Allow live streaming meetings” if the meeting is meant to be private.

Another advanced setting that is enabled by default for many account types is the Waiting Room feature. Attendees cannot join a meeting until a host admits them individually. This is an excellent option for smaller meetings but can be difficult for very large meetings as the host will continuously need to check the waiting room and admit attendees.

Recordings

At Zoom.us – My Account – Settings choose the tab at the top under “Recording”. You can change default settings and toggle off “Automatic Recording”. You can choose whether the host and participants can record the meeting to a local file. While it would be better to record the meeting using a third-party screen recording tool like Camtasia, if you do not want participants to be able to record locally uncheck, “Hosts can give participants the permission to record locally”.  Since Zoom meetings that are recorded are save in Zoom’s potentially insecure cloud storage, it is best to toggle off Cloud Recording altogether.

Other Considerations

When you hold a Zoom meeting keep the Participants panel open so you can see who is in the meeting and mute them, remove them, and other functions as needed.

If you are working in an environment where your conversation can be overheard use a headset with noise-canceling to reduce others from hearing you and to enable you to speak quietly. Shut the door if you can.

Consider using a background to reduce exposure of your personal environment when working out of your home. The available backgrounds in Zoom are not very professional but you can create your own.

Verify at the beginning of every meeting, mediation, and arbitration that only authorized people are physically present in the room.

If you are using Zoom for ODR or mediation Don Philbin from ADR Toolbox has outlined how to tailor Zoom for mediation, and Simon Boehme has tips for using Zoom for ADR.

Zoom Alternatives

There are a lot of options to using Zoom. Some are best and easiest to use for intra-firm communication; some may not be any more secure than Zoom but enjoy security through obscurity. Some options are more complex and expensive than Zoom but may offer better security. And, there are several products purposes built for law firms. You will need to do due diligence on these platforms/products, read the terms of service and privacy policies, and test for usability.

Options for intra-office video conferencing

Options for extra-office conferencing, like client meetings (overviews here, here, here and here)

Legal Specific video conferencing options (overview here)

Conclusion

Suffice to say there are a LOT of settings in Zoom to contemplate that could help make your meetings more secure and maintain more control. You can use the platform without storing confidential information, like recordings and chat logs, in their cloud. Keep in mind the reasonable care standard set out in the comments in NC RPC 1.6, do your homework and leverage this technology that is enabling us to effectively work in this social distanced environment. Video conferencing has long been a part of a law firm’s toolbox, and will no doubt continue to be a vital communication option in the future.