Hacker News Reader

Comment by vikramkr | Hacker News Reader

Yeah, Zoom is a US based company. Yes, they have a development team in China. It is valid to be concerned about the Chinese government exercising control of some sort over the local development team to put in a backdoor, just as our government seems to want to do to US developed products. No politicians really seem to like encryption very much. This is an overall geopolitical risk not unique to Zoom. But Zoom is not a Chinese company, it falls under US jurisdiction. And sovereign security risks are not unique to Chinese companies. Just saying that Zoom needs to be treated with caution because it is a "Chinese company" is lazy and inaccurate, and incorrectly characterizes both Zoom and where that risk originates.

View on HN

Yes, and I've clarified and fixed my originally badly described wording. I'll let Zoom describe this themselves.

From Zoom's S-1 [1]:

"In addition, we have a high concentration of research and development personnel in China, which could expose us to market scrutiny regarding the integrity of our solution or data security features. Any security compromise in our industry, whether actual or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures, negatively affect our ability to attract new customers and hosts, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could harm our business."

[1] https://www.sec.gov/Archives/edgar/data/1585521/000119312519...

Thanks for clarifying that, and yes, Zoom's s-1 writers did a good job of laying it out. The risks are real, and presenting them in an incorrect way makes it easy for people to dismiss the risks when they shouldn't. If the times comes because they're a Chinese company, and you check and see that they're a delaware c corp founded by a US citizen headquartered in the US, that would lead you to discount that risk. Clarifying that the risk comes from the development team being in a country where the government is in a contentious trade relationship with the US with an authoritarian regime (especially if the dev team isn't in one of the special economic zones) helps highlight what the risk is and confirm that it is a real threat.

> Any publicized security compromise in our industry, whether actual or perceived, could harm our reputation...

FTFY

> It is valid to be concerned about the Chinese government exercising control of some sort over the local development team to put in a backdoor, just as our government seems to want to do to US developed products.

Chinese companies legally cannot refuse a government request for data. https://en.wikipedia.org/wiki/China_Internet_Security_Law

Comparing that with US/EU private sector protections is absurd.

I can't find your claim in the linked Wikipedia page. What section?

First section:

> It requires network operators to store select data within China and allows Chinese authorities to conduct spot-checks on a company's network operations.

More has been reported about the implications of the law:

> China’s National Intelligence Law from 2017 requires organizations and citizens to “support, assist and cooperate with the state intelligence work.”

https://www.cnbc.com/2019/03/05/huawei-would-have-to-give-da...

Reply on news.ycombinator.com