WSJ just wrote an article interviewing the CEO and other security experts on this topic. Some interesting excerpts:
> In the U.S., 27 attorney general’s offices have raised questions about privacy issues, Zoom said, adding it is cooperating with authorities.
> Security researchers also have scrutinized Zoom’s links to China. Researchers at the Citizen Lab, a security research group affiliated with the University of Toronto, on Friday said Zoom used an encryption technology that is considered substandard, and that in certain circumstances the company stored encryption keys—long strings of numbers and characters that can be used to access encoded communications—on servers based in China.
> Brendan Ittelson, head of technical support at Zoom, said because of the distributed nature of the company’s infrastructure, meeting data can be routed through different data centers around the world. Zoom’s system first tries to send this data locally, but if the connections fail, the backup route might send it elsewhere.
> Zoom had created a system to prevent this data from being sent through China when calls originate in the U.S. But when traffic surged starting in February, some data was mistakenly routed that way, the company said, adding that it has remedied the problem. Critics also have questioned whether Zoom’s heavy reliance on China-based engineering could pose a security risk.
Source: https://www.wsj.com/articles/zoom-ceo-i-really-messed-up-on-...
Personal opinion: I think we should all boycott Zoom until there is a guarantee of where the data is stored with independent audits. In this pandemic, we've given our privacy (facial features, email, screen sharing, video data and application usage patterns) to Zoom in a whim. The entire world has done so. I have no trust in the Chinese Communist Party and their potential to exploit this data if they get it. Perhaps not in the immediate future, but may be in year 2027 - suppressing voices, threats and border control, detentions of people who spoke against the CCP during the pandemic or after caught using the facial AI technologies from the data collected today. This is real and we should all be concerned.