hey everyone welcome back to today in tech I'm Juliet Beauchamp I'm here with
CSO senior writer JM Porup and today we're talking about when it's important
to have end-to-end encryption for video conferencing stick around alright Jam
thank you so much for calling in and chatting with me about this I feel like
we've been hearing a lot about this as we all have been relying on video
conferencing much more heavily and we're now hearing that a lot of video
conferencing apps aren't actually encrypted end-to-end so before we talk
about you know why that's actually important can you tell me a little bit
about what end-to-end encryption actually means especially in regards to
a video conferencing software sure so and an encryption means that a
communication a phone call a video conference a text message can only be
read by the person sending it and the person receiving it as the the opposite
of end-to-end encryption would be transport level encryption where a
message or video is encrypted from like right now for the zoom call we're having
this video conference is recorded from my laptop to zoom server its decrypted
on zoom server so zoom can see what we're doing if they wish to
then zoom re-encrypt stat and sense it to you and so forth and so on so it's
end to server encrypted but not end-to-end encrypted so I think a lot of
our viewers now would be wondering when it would be impro prea to explore an
end-to-end encrypted option since like you said that it's really not available
on every platform and what we will do of course is link your article jam below
that you've wrote for a CSO that sort of details the security benefits of or
security features of a variety of popular video conferencing apps but I do
want to talk about just that when is it appropriate and when is it not
appropriate to have to as as a user be on a video call that is or is not end to
end encryption I guess what should users expectations of privacy be in a video
conferencing software using a video conferencing software that is an
end-to-end encrypted right know that if it's not encrypted well so
I mean it very much depends on the use case let's say that you are running a
virtual conference which we're seeing more and more these days you know in
virtual conferences of five hundred a thousand five thousand people online
where you know a handful of speakers are speaking to a large audience you know if
you are a panelist of four panelists on the stage at an a real-life conference
and there's 5,000 people in the audience your expectation of privacy is very
different than if you're talking to your dying grandmother or your boyfriend or
girlfriend or your children or what have you you know there's a very different
expectations of privacy so you know how important is end and encryption in a you
know a webinar with 5,000 people in it you know probably not buried because
your expectation of having a private conversation is close to zero whereas if
you are say in a classroom so if we send a lot of learn from home we see a lot of
schools using zoom or Google neat if you're in a room of 20 to 30 students
where you want to have a free and frank intellectual discussion without the fear
that someone could be you know spying on the class to see who has you know some
sort of dissenting opinion or or what have you and in a situation where
one-to-one interaction among all the students is both reasonable and
encouraged then that begins to become you know a serious question know should
we have end-to-end encryption for videoconferencing for for schools and I
would certainly argue yes that is certainly a case where student privacy
and and the freedom to intellectually debate and explore new ideas deserves
the protection of end and encryption and certainly for something sensitive like a
board meeting like if you have 15 members of the board meeting virtually
to discuss you know strategy during these very difficult times that again
that goes to business confidentiality and even trade secrets you know do you
want to risk you know zoom or you know access to zoom servers by a high
perhaps a foreign nation state or the US government's you know violating that
confidentiality that's a good point I think it also is interesting to consider
times where in fact it could be either required by law or our compliance
methods to have a meeting or a video meeting that is not encrypted because it
needs to be public information is there a case for that well there are certainly
cases where highly regulated industries or government employees must maintain
records of their emails and and meeting notes and what-have-you for instance
complying with FOIA the Freedom of Information Act you know as journalists
you know and as the public we have a right to FOIA government agencies and
say you know I would like to see copies of the emails by the director
surrounding a particular question of the day we don't need to give an example and
in that case you know government employees must keep records of their
emails for a certain period of time they must keep meeting notes you know what
was discussed at that at that meeting you know this is important to government
accountability and transparency likewise in many regulated industries
there are requirements to keep those kinds of records for ediscovery
should there be a government audit of some kind now in the past for meetings
that has typically revolved around a a secretary of the meeting taking those
meeting notes hopefully an honest and and transparent manner both of their own
historical records as well as to comply with any relevant government regulation
now just does a video recording of every such meeting is that required to to meet
that compliance threshold I mean I'm not a lawyer that seems like a very high
threshold to meet I mean historically there was no requirement to record
actual in-person meetings but there was a requirement to take good honest
thorough meeting notes and keep those records should someone require them so
you know is there a compliance burden to keep video recordings I I'm not a lawyer
but I would expect that's not the case no sure it
really does seem like there's a real spectrum of options and use cases for
whatever you need to be doing in some cases it's obviously appropriate to like
you mentioned I'm in a meeting I'm in a webinar with 5,000 people my expectation
of privacy is very low there isn't a huge need to expect that all of this
information is going to remain private in which case something that isn't
encrypted end-to-end could be appropriate but I am wondering it what
any other sort of best practices are I want to make sure our viewers are aware
of what exactly they're getting into if something is not encrypted end-to-end so
they can make that judgment for themselves whether they want to explore
options that are encrypted end-to-end which they can explore in your article
that will link below or not well there's really two points here what one is what
should an individual user or what should an enterprise do to select the
appropriate technology for them but there's also the collective-action
problem here in terms of right now we are in under stay at home orders during
this code pandemic we're living under and and you know the odds of any
individual person especially a younger person with no pre-existing conditions
becoming seriously ill is not impossible it is extremely low but what we are
doing this to protect other members of our society who may not be be so
fortunate and and so you know it may be that your particular use case does not
require end-to-end encryption but in terms of the digital pandemic they are
also facing simultaneously in terms of digital security you know and and
encryption protects everybody even those who may not necessarily have you know a
specific need for it now in terms of you know what best
practices there are for individual users or for enterprises for both if we are
talking about a one-to-one video conferencing solution just two people on
the call like hands down use signal from open will open whisper systems it's
but not for five years I use it extensively and in terms of you know our
best practice their hands down not even debatable you know if this is this is
your go-to if you're in a situation with more than 50 or 100 people then
usability becomes far more important than encryption or security you know
it's it's the conference it's the the large webinar situation we discussed
earlier you know ant an encryption then becomes you know it's nice to have there
is a serious engineering challenge which I won't get into the weeds but once you
get over a couple dozen participants it becomes very difficult to to solve that
mathematical challenge so for you know over 50 people you know engine
encryption is not so important because it is often a one-to-many broadcast sort
of situation it's that very difficult range between like 3 and 50 where there
are not yet great solutions here where trade-offs really have to be made and it
you know if you are discussing sensitive customer business if you're discussing
anything sensitive then you know it's paramount that you think very carefully
about how what what communications channels you're using to do that are you
discussing trade secrets are you discussing you know just personal
matters that are really nobody else's business but your own maybe it's a
family reunion or maybe it's maybe it's a wake you know people are dying maybe
you want to remember someone in a private manner how do you do that in in
a way that respects you know the person who's past you know the least become
very tricky you know problems to solve in a situation we're in right now and
zoom is optimized for usability but it is not optimized for security at this
moment in time right I think it is you do you make a great point that if the
there's really no harm for on the user end to have something that's encrypted
and to end and I'm wondering as we are all using videoconferencing so
three more and I think it's pretty widely suspected that even after we're
all permitted to go back to work these you know collaboration habits won't die
I think it'd be interesting to see how when when rather we can expect to see
end to end encryption deployed in some software do you think it's possible that
with perhaps an outcry for and and decryption that we'll see it in some
software well you know there has been efforts by companies that value privacy
to deploy strong and to end encryption that have been met with strong
resistance from the US government for instance there was a huge scoop by
Reuters a couple months ago that Apple had a plan called project Plessy oh that
would have deployed zero knowledge and ten encrypted iCloud backups so that
Apple would have zero access to backups and they could say in good faith in
response to a warrant we can't help you we can't decrypt it and there is
widespread speculation that under FBI pressure the Apple declined to build
that system now we are an interesting circumstance here with zoom because zoom
is not a surveillance capitalist business they it also often people pay
to you zoom enterprises pay to you zoom and they pay you know a substantial
amount of money for it so zoom in is a-- is in a position to give customers what
they want similar to Apple and there is a huge
backlash right now to against zooms previous false advertising and what's
more zoom has hired some of the world's leading security experts and
cryptographers to fix it so and III know some of those people personally and they
care deeply about user privacy and security and they carry deeply about
properly implemented end-to-end cryptography and you know I I have hopes
a tempered by experience but hopes that zoom might actually build and an
encryption into their software at this point I mean it's too early to
say you know I'm not placing any bets but watch this space
sure well thank you so much Jim for chatting with me I think this is
probably on the front of mine for a lot of people no matter who you are whether
you know just a a you know layperson zoom user all the way up to you know a
member of a board that's really relying on video conferencing software's not
only zoom a lot more heavily now so it's this really great info and like I've
said about five thousand times during this entire episode we will link your CS
article down below so you're just can explore and viewers
can explore a real in-depth comparison about each video chat feature security
features so yeah thanks so much Jim for calling in it's always a pleasure Juliet
thanks for having me and thank you all so much for watching this episode of
today in tech if you liked this video be sure to give it a thumbs up and
subscribe to our Channel if you have any questions or comments
about end-to-end encryption especially in regards to video calls please leave
them below if at you have any questions that I can't answer I'll shoot them to
JME and we'll get back to you thanks so much for watching once again and we'll
see you next time