How Zoom’s terms of service and practices apply to AI features

What you and what you say need to be consistent to preserve user trust and then being inconsistent shows mismanagement by senior leadership or even potentially intent to deceive or spin the situation while still implementing the policy. It’s the PR classic do one thing say another.

Edit: Oh, and then this hits almost at the same time…

https://www.sfgate.com/tech/article/zoom-return-to-office-an...

One implication is that lawyers can no longer use Zoom for anything which is attorney-client privileged.

> We will not use ... protected health information, to train our artificial intelligence models without your consent.

> We routinely enter into ... legally required business associate agreements (BAA) with our healthcare customers. Our practices and handling of ... protected healthcare data are controlled by these separate terms and applicable laws.

To my understanding there is nothing in the separate terms (BAA) or applicable laws (HIPAA) that actually guarantees this.

I don't want to assume malice but if in good faith I would have expected an updated BAA with an explicit declaration regarding data access and disclosure in a legally-binding fashion rather than a promissory blogpost vaguely referencing laws that don't themselves inherently restrict the use of PHI for training by Zoom.

It would really only require a single term.

It’s worth mentioning that per this agreement they can still do almost anything else with that data. They could put your face up on a billboard if they wanted to.

I’m out. I was a paying user. Can’t run fast enough from ever doing business with them again.

†but we'll prompt you an overly long privacy policy including such consent whose acceptation is just a checkbox you tick the first time your join a call without even paying attention (nor choice)

They'll do inference all day long, but not train without consent. Only being slightly paranoid here, but they could still analyze all of the audio for nefarious reasons (insider trading, identifying monetizable medical information from doctor's on Zoom, etc). Think of the marketing data they could generate for B2B products because they get to "listen" and "watch" every single meeting at a huge swath of companies. They'll know whether people gripe more about Jira than Asana or Azure Devops, and what they complain about.

Hats off to zoom for the free contract drafting lesson!

[edit: thanks to HN commenter lolinder for the actual lesson].

So they can create a transcript of the conversation and train with it. Or train on any document you may have shared during a Zoom meeting.

I woukd have preferred the exception - if that was the intent - to enumerate the components of the Customer Content that they want to use for training.

10.1 Customer Content. You or your End Users may provide, upload, or originate data, content, files, documents, or other materials (collectively, “Customer Input”) in accessing or using the Services or Software, and Zoom may provide, create, or make available to you, in its sole discretion or as part of the Services, certain derivatives, transcripts, analytics, outputs, visual displays, or data sets resulting from the Customer Input (together with Customer Input, “Customer Content”);

https://www.diffchecker.com/RLiqgAaA/

this is how it used to be, until HTTPS and cloudflare-like hosting solutions, were guzzled back like electric kool-aid. all you really needed was an IP and perhaps a port number if endpoint was behind NAT.

I never really understood why people like Zoom's UX, I find it unintuitive and awkward.

Or you inherently can't make it "forget about it UX and extremely high quality" as most non techies define it. Because you have the issue that even if a company self hosts a meeting tool, they likely can't get the backbone connections Zoom etc can get. They at least need someone to use a URL to get there. It can be made mostly simple, but then you're back to some company running it - works for corporate use maybe, not for your home user. Even Signal lags compared to Zoom. And people really dislike Signal's phone number requirement, but it's what makes it somewhat possible to route connections for users.

What's a system that a home person could use that's not going to get them routing through one companies servers, but is actually simple enough to use?

The place where I do get somewhat exasperated as a techie is that the equivalent of asking for a phone number or address in any program that isn't an e-mail website is seen as "too hard". This makes pretty much any privacy respecting design impossible to scale beyond nerds.

I now use Hanlon's Shaving Brush. Its a broad brush that I use to paint every sketchy move businesses make. "Is it malice? Or is it incompetence that merely looks like malice?". I don't care! I'll assume malice unless otherwise shown.

It's not my job to try and find out how evil shit was done accidentally. It doesn't matter if they "oopsied" into selling a firehose of my data to a "trusted partner" to analyze to death. Nobody actually gives a shit at these companies, so I need to treat them all as if they're malicious. If the underlying cause was a bit of incompetence a few years ago, that does nothing for me when I'm discovering the fuckery.

But, really, does it matter whether the bad thing is caused by incompetence or malice outside of a court of law? The bad thing happens either way.

I think attributing everything to incompetence vastly underrepresents intent. Maybe not all bad acts are malice, but too many are attributed to incompetence. Maybe it is not malice, but it can still be intentional actions against or indifferent to your interests.

Maybe it's both: malice to kick off the effort and incompetence because they got found out.

The word adequately, and the fact it was made when presuming good faith was more reasonable.

These days it's better to assume everything is theft, fraud, or marketing.

There is however research (that aligns with a lot of people's experience) to suggest psychopaths and sociopaths are very over represented in leadership:

https://www.sakkyndig.com/psykologi/artvit/babiak2010.pdf

https://jitsi.org/

The few with smarter lawyers and IT departments, usually academic, do but a majority of all of the new "AI" health tech products I've heard about pitched to hospitals use customer PHI for product development.

I had the same issue when my EU-based employer was sold to an US company. My personal data suddenly went from EU to US-based HR systems without my consent. Resigning would not have fixed anything. My personal data will be in the US forever.