53

With travel restricted by the COVID-19 pandemic, many academics are organizing online seminars and conferences as a substitute for regular in-person university seminars, colloquia, and research conferences.

In real life, seminars are usually open to anyone who wants to drop in, and every attendee can be seen and heard and may ask questions. So an obvious approach is to organize the event using video meeting software such as Zoom, and simply post the link on a public website so that any interested person can participate. However, this also opens the event to "Zoom bombers", random people who just want to disrupt the proceedings with annoying or offensive video / audio / text chat - such abuse has unfortunately become very common in public Zoom meetings.

What best practices exist to keep such an event as open as possible to legitimate participants, and let them interact with each other and the speaker in a reasonable way, while reducing the risk of disruption and abuse?

What are the pros and cons of these strategies?

Strategies could be general, or involve specific features of certain software.

Some strategies I've thought of, and their drawbacks:

  • Create a password for the meeting. Then the question is, to whom should the organizer give the password? If they only give it to people they know, it excludes people who might be interested but whom they happen not to know. If they distribute it to large mailing lists of interested academics, it raises the chance that it will fall into the wrong hands.

  • Offer to share the password by email upon request. This requires extra time from the organizer to respond to those emails, and to manually verify the credentials of each requester.

  • Require a nominal registration fee, as real-life conferences often do. This requires setting up an online payment system, which can be a lot of work, and may exclude people who are only casually interested, or who don't have funding, or who work in less wealthy parts of the world. It may also involve the organizer in a lot of bureaucracy with their university as to how the fees will be managed and spent.

  • Use a "waiting room" feature, where participants must be approved immediately before joining. However, as far as I know, the host only sees the participant's name. If they see an unfamiliar name, how can they tell whether it is a troll, or a legitimate researcher whom they just happen not to know? Conversely, I don't think there is anything to stop a troll from masquerading under the name of a famous academic.

I am wondering if people have thought of better solutions, that are specifically appropriate to academia. Such strategies might take advantage of specific features of the academic community, e.g. to authenticate genuine researchers (.edu addresses? accounts on preprint servers? ORCid IDs?). Answers could also address the pros and cons of such strategies as they apply to academia in particular, and how well they fit with people's existing expectations for academic conferences.

  • Comments are not for extended discussion; this conversation has been moved to chat. Please read this FAQ before posting another comment. – Massimo Ortolano Apr 7 at 18:39
  • Conventional public meetings have always been susceptible to abuse. The usual approaches apply: (1) Put a bouncer at the door to prevent uninvited or bad characters from entering (2) Don't give everyone a microphone or a billboard (3) If a participant does something unacceptable, warn them. If they persist, kick them out. (4) Moderate/Censor/Filter anything that goes through the microphone / projector (5) Take legal action against persistent abusers. – Xantix Apr 8 at 18:28
  • @Xantix: I thought about that, but the parallel breaks down in a few ways. First of all, for someone to disrupt an in-person academic seminar, they actually have to travel somewhere; for a virtual seminar, a few mouse clicks suffice. The cost of an attack is orders of magnitude lower. Second, #5 is effectively impossible; there is no easy way to identify a Zoom bomber, who will typically have taken steps to conceal their IP address, and it's unlikely that law enforcement will take an interest. – Nate Eldredge Apr 8 at 20:18
  • @Xantix: Indeed, not only can't you punish a Zoom bomber, you can't even prevent them from logging back on with a new account five seconds later. – Nate Eldredge Apr 8 at 20:19
  • @Nate Eldredge: The cost of an attack may be lower, but so is the cost of blocking offenders. You don't need a team of bouncers, just a few key clicks. It should be fairly easy to identify & block their IP addresses, too, which increases their cost of attacking. – jamesqf Apr 9 at 2:59
55

How about using something other than Zoom? Other softwares support features that can help with this. Moreover there are some serious security and privacy concerns about Zoom (see e.g. this statement by the FBI and this investigation by the NY attorney general; Bruce Schneier has written an overview of the concerns here).

In our department we use BigBlueButton (website, Wikipedia) for our classrooms and seminars. It's a completely open-source and free web conferencing system. There are a few services out there that host servers but they're completely overloaded at the moment. I'd say your best bet would be to get your IT services to host a server for your department. With BBB by default new users don't have their webcams activated, and you can prevent them from doing so. You can even prevent them from using their microphone and require them to virtually "raise their hand" before a moderator allows them to speak. That should cut down a lot of the abuse. You can also set up the service so that an account is required before accessing the meeting. Unless the abuser is very dedicated, they probably won't bother creating dozens of accounts to continue bothering people after being kicked out, I hope.

Also, something obvious: many abusers are specifically targeting Zoom and going into random Zoom meetings. Unless you've somehow attracted abusers who are specifically targeting you, if you use something else (especially something hosted by your own department), you probably won't have any problems.

Note: I'm only recommending BBB because that's what we use at our department, but there are other services out there. I know another department has set up something called "Panopto" for example, and another something called "Classilio" - you'll have to look that up, I don't know much about it. For informal meetings we use Jitsi but it doesn't seem adequate for hosting a seminar. But in any case, if a software doesn't meet your requirements, you should definitely look into switching to something else, especially with the privacy concerns...

| improve this answer | |
  • 27
    Zoom has also features like "mute all participants", "do not allow participants to unmute themselves", etc.: support.zoom.us/hc/en-us/articles/… – Jukka Suomela Apr 7 at 10:02
  • 18
    To be clear, BBB has the same problems that Zoom has with the possibility of vandals "bombing" meetings, and the same solutions and their trade-offs applies. The problem seems simple: without authentication, anybody can enter the meeting, no matter what platform is used. – President James K. Polk Apr 7 at 12:37
  • I know the host can mute and unmute participants, but how do you tell whether the person you're about to unmute is an abuser? – Nate Eldredge Apr 7 at 12:38
  • 14
    @NateEldredge Just have them type in questions to the moderator, and the mod filters the questions and only unmutes askers with good questions, or the mod reads good questions to the speaker. It works for radio stations, at least. – user3067860 Apr 7 at 13:50
  • 1
    @HansOlsson I've seen livestreamers do it with just one person, if you can pause to read through questions (no typing responses, just respond out loud). But it is easier with a moderator. Even if the moderator is just filtering out obviously not-real questions and banning anyone who asks joke questions. – user3067860 Apr 7 at 14:08
22

The features discussed in the comments seem sufficient in the case that the organizer knows the participants, e.g. classes, committee meetings, etc.

I don't think this question has a single right answer. I'm going to answer for the case where the conference is open to interested academics and the organizer doesn't know all the potential participants. This isn't specific to Zoom, either. I think this would work for most on-line conferencing systems.

Require preregistration using Google Forms or a similar tool. Ask for full name, email address, and some vetting information such as the URL of the applicant's academic web page. The vetting questions will likely change depending on the nature of the audience, and perhaps with experience. You'll need a registration deadline so that you can send out passwords.

There are several tools for sending bulk email from a .csv spreadsheet such a Google Forms provides. I use the mail-merge add-in for Thunderbird. I'm told Microsoft Office has an email-merge feature. Look through the list, delete any that don't pass vetting, and mail the meeting link to the rest.

"Look through the list" will be the time-consuming task. If one expects more than perhaps 50-100 participants, I'd download the list daily, clear it out, and vet applicants one day at a time.

Edit: It will be hard, but not impossible, for a troll to masquerade as a famous academic because the invitation will go to the address in the registration, which, for famous academics, is likely to be well-known.

I've just done some poking with Google. Excel appears to have a way to highlight cells that do not end with a specified string. So, the Google form says "academic email address required" and the formula lights up in red any addresses that don't pass the filter described just below. Deleting them is still a manual process unless one wants to learn the Visual Basic stuff used to "program" excel, but finding them becomes easy.

Further to Federico Poloni's comment, start with a simple rule, e.g. addresses must end in .edu in the US, or .ac.uk in the UK. Look at the addresses that get flagged and adjust the rule accordingly. Of course, that means no automagic deletions, but you can group the flagged addresses using a filter for manual deletion in a batch. Yes, this is a certain amount of "make it up as we go along," but I imagine we'll be doing a lot of that for many months.

| improve this answer | |
  • 24
    Outside the US, people have academic addresses such as @unipi.it, so the approach in your last paragraph won't work in an international setting. – Federico Poloni Apr 7 at 9:24
  • 1
    You don't need VBA to do this, conditional formatting and IF() can be used. – Solar Mike Apr 7 at 9:24
  • 1
    @FedericoPoloni Sure it will; one just has to work through the exceptions. – Bob Brown Apr 7 at 12:36
  • 15
    @bobbrown I think most universities in the world do not have an .edu domain. – Dirk Apr 7 at 14:46
  • 1
    @BobBrown you can filter based on color, select all rows showing by shift-clicking, then right click and delete. That's still technically manual, but it only takes a few seconds. – Kat Apr 7 at 17:29
16

We had the same problem and ended up with a solution like this:

  • The seminar series web page contains information about the seminar program, plus instructions for joining the seminar mailing list.
  • The Zoom link is shared only through the seminar mailing list some time before the event.
  • There is no password.

The mailing list subscriptions can be moderated, but I don't think there is need to really "check the credentials" of those who are joining the list.

This is low-effort for the organizers and legitimate seminar participants, and it would be relatively high-effort for someone who wants to do Zoom bombing (in particular, you will need to plan ahead and subscribe in advance, so if you are just right now bored and drunk and would like to do something silly, it doesn't sound too exciting to subscribe to a seminar mailing list that would make it possible to maybe do some Zoom bombing next week).

| improve this answer | |
  • 5
    From what I understand, there are various internet forums where bored students can share a meeting password and ask for internet trolls to bomb their teacher. See e.g. this news article that discusses them. – Federico Poloni Apr 7 at 9:27
  • 2
    +1 for the low-effort solution which is enough in most cases. Just like cheap bicycle locks can be easily defeated by an experienced thief, but they are still useful in most cases, as they prevent casual passers-by from stealing your bike. – vsz Apr 7 at 10:08
  • 3
    It would more useful to have a password and put the password in the email with the link. That way, you would at least prevent Zoom bombing from people trying random meeting numbers, – pboss3010 Apr 7 at 11:45
15

In addition to Zoom "meetings," they have a "webinar" option for calls:

https://zoom.us/webinar

(Note that this feature is only available in certain paid versions, I believe)

This option is designed for meetings at which most people are silently listening. The audio and video of participants are off by default, and can only be turned on by one of the hosts. Alternatively, there is a mechanism in these for submitting text questions, which go to a moderator queue and then are shown to everyone.

I recently attended a webinar of this type, and it ran smoothly. I think it would be much more difficult to disrupt than the usual meeting style.

| improve this answer | |
  • 1
    It looks like this is an extra-cost add-on to their paid versions. The ability to host a webinar with 100 participants is currently USD 40 per month, with more participants costing more money. I guess you can compare it to your regular seminar budget for tea and cookies. – Nate Eldredge Apr 9 at 2:15
10

The current phenomenon of "Zoom bombing" seems to come from the fact that Zoom meeting IDs can easily be guessed.

So you may be overthinking this and should try to publish the conference password on the institute website. This will not be found by people who just try to bomb random conferences.

When someone is explicitly targeting your conference, you won't have much chance to prevent it, while keeping it open to everyone even when you do not know them.

I would consider at least trying to use a meeting with a rather public password and only change when you actually run into problems.

| improve this answer | |
  • 2
    I think most times a student in the class gives away the Zoom codes. I've seen people on social media specifically ask for other people's "zoom codes" so they can join. – MCMastery Apr 8 at 5:16
  • 1
    @MCMastery: This might be true for high school and low-level university classes, but not so much for seminars and conferences, whose participants are a bit more mature. Also, I don't remember a talk so boring that I'd ask 4chan to raid it :) – darij grinberg Apr 8 at 8:03
  • @MCMastery but are these codes being given to people who will create problems? – Ian Apr 8 at 9:12
  • @MCMastery When someone especially wants to interrupt your meeting (maybe a student with a bad grade) you will need to make it private in some way, e.g., by communicating a password via a mailing list. But this is true for any medium that is open to everyone. And bold people may even come in and disturb real meetings until security forces them to leave. – allo Apr 8 at 9:49
6

It seems to me that the current state of things is that you can't, without some support from Zoom's side. Even if you set up a meeting password, a malicious participant can give it to a bomber. Even if you vet names, a bomber may spoof the name of a legitimate user.

You need accounts to solve this problem.

The crucial issue is that Zoom (EDIT: at least the way you are using it) has no concept of users or authentication. The problem can be solved if you require a form of personal authentication: a malicious user won't give their personal password to a bomber, because their name is attached to it.

You need trusted accounts.

This requires you to have some form of trusted authentication: if you have accounts, but users can create one in two minutes with randomaddress@gmail.com, that's as good as nothing. Orcid may be more vetted (I don't have experience in how easy it is to create an Orcid account if you are not an academic). A "walled garden", such as schools that use Microsoft Teams or a corporate Google Suite for their internal needs, may work if all participants are inside the garden (and have independently authenticated accounts).

You can require academic addresses to create accounts, and check manually that their domains are legitimate. If we had a working global academic authentication infrastructure, it would have helped solving this problem probably. There are some attempts to create one: Shibboleth, Openathens, Eduroam. Probably Eduroam is the most widespread, so they may help. But you can't just use their credentials without some support from both them, and the video-conference service.

Of course firms are pushing for their walled gardens instead, and schools and universities blindly use Microsoft or Google because they are cheaper.

| improve this answer | |
  • 4
    Zoom does have a concept of accounts and authentication, though, if you pay for it. See this page for integrating an existing authentication systems with Zoom. The fact that the US government doesn't use it when they should and get problems because of it doesn't mean that it's unavailable. – Erik A Apr 7 at 9:54
  • @ErikA Interesting, thanks! In particular it does already support Shibboleth, which is already quite common in academia. – Federico Poloni Apr 7 at 10:06
3

You could publicly share the meeting ID (and password, if required) before the meeting. Once the meeting has started - or maybe a few minutes later - you lock the meeting such that no new participants can join.

This will not protect you from determined troublemakers that attend the meeting from the start, but it prevents Zoom bombers from randomly dropping in. This approach is the digital equivalent of locking the door after the meeting has started.

| improve this answer | |
  • 3
    What happens in a locked meeting if someone's connection breaks down and they want to rejoin? – darij grinberg Apr 8 at 8:05
  • @darijgrinberg Good catch. I couldn't test a loss of connection, but if a guest of a locked meeting leaves the meeting, the guest cannot rejoin. – CL. Apr 8 at 8:35
3

Would be cool to have a capcha-type question, which is very specific to the seminar.

I am moderating a facebook group in a very specialized research field, mainly for researchers (all members either have a PhD or are on the way to get one). Hence, I ask a few questions which are very basic for the members, but highly non-trivial for laypersons.

| improve this answer | |
  • That could be a solution, but you would need to have only a very specific answer possible. While in maths this is doable (say, a basic integral and you expect a number back), even in physics it becmes more complicated (except if this is a name such as Maxwell, or the answer of a basic physics problem). OK, after reading myself I think this is a cool idea :) (+1) – WoJ Apr 8 at 10:34
  • One of my questions is to provide the canonical next integer in the sequence 1,1,2,5,14,... – Per Alexandersson Apr 8 at 10:36
  • 1
    Yes, for mathematicians this is probably obvious, or they can look it up in OEIS. An absolute deterrent for anybody else, though (I am an ex-physicist and had to look it up :-| ) – WoJ Apr 8 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.