53

With travel restricted by the COVID-19 pandemic, many academics are organizing online seminars and conferences as a substitute for regular in-person university seminars, colloquia, and research conferences.

In real life, seminars are usually open to anyone who wants to drop in, and every attendee can be seen and heard and may ask questions. So an obvious approach is to organize the event using video meeting software such as Zoom, and simply post the link on a public website so that any interested person can participate. However, this also opens the event to "Zoom bombers", random people who just want to disrupt the proceedings with annoying or offensive video / audio / text chat - such abuse has unfortunately become very common in public Zoom meetings.

What best practices exist to keep such an event as open as possible to legitimate participants, and let them interact with each other and the speaker in a reasonable way, while reducing the risk of disruption and abuse?

What are the pros and cons of these strategies?

Strategies could be general, or involve specific features of certain software.

Some strategies I've thought of, and their drawbacks:

  • Create a password for the meeting. Then the question is, to whom should the organizer give the password? If they only give it to people they know, it excludes people who might be interested but whom they happen not to know. If they distribute it to large mailing lists of interested academics, it raises the chance that it will fall into the wrong hands.

  • Offer to share the password by email upon request. This requires extra time from the organizer to respond to those emails, and to manually verify the credentials of each requester.

  • Require a nominal registration fee, as real-life conferences often do. This requires setting up an online payment system, which can be a lot of work, and may exclude people who are only casually interested, or who don't have funding, or who work in less wealthy parts of the world. It may also involve the organizer in a lot of bureaucracy with their university as to how the fees will be managed and spent.

  • Use a "waiting room" feature, where participants must be approved immediately before joining. However, as far as I know, the host only sees the participant's name. If they see an unfamiliar name, how can they tell whether it is a troll, or a legitimate researcher whom they just happen not to know? Conversely, I don't think there is anything to stop a troll from masquerading under the name of a famous academic.

I am wondering if people have thought of better solutions, that are specifically appropriate to academia. Such strategies might take advantage of specific features of the academic community, e.g. to authenticate genuine researchers (.edu addresses? accounts on preprint servers? ORCid IDs?). Answers could also address the pros and cons of such strategies as they apply to academia in particular, and how well they fit with people's existing expectations for academic conferences.

6
  • Comments are not for extended discussion; this conversation has been moved to chat. Please read this FAQ before posting another comment. Apr 7, 2020 at 18:39
  • Conventional public meetings have always been susceptible to abuse. The usual approaches apply: (1) Put a bouncer at the door to prevent uninvited or bad characters from entering (2) Don't give everyone a microphone or a billboard (3) If a participant does something unacceptable, warn them. If they persist, kick them out. (4) Moderate/Censor/Filter anything that goes through the microphone / projector (5) Take legal action against persistent abusers.
    – Xantix
    Apr 8, 2020 at 18:28
  • @Xantix: I thought about that, but the parallel breaks down in a few ways. First of all, for someone to disrupt an in-person academic seminar, they actually have to travel somewhere; for a virtual seminar, a few mouse clicks suffice. The cost of an attack is orders of magnitude lower. Second, #5 is effectively impossible; there is no easy way to identify a Zoom bomber, who will typically have taken steps to conceal their IP address, and it's unlikely that law enforcement will take an interest. Apr 8, 2020 at 20:18
  • @Xantix: Indeed, not only can't you punish a Zoom bomber, you can't even prevent them from logging back on with a new account five seconds later. Apr 8, 2020 at 20:19
  • @Nate Eldredge: The cost of an attack may be lower, but so is the cost of blocking offenders. You don't need a team of bouncers, just a few key clicks. It should be fairly easy to identify & block their IP addresses, too, which increases their cost of attacking.
    – jamesqf
    Apr 9, 2020 at 2:59

8 Answers 8

54

How about using something other than Zoom? Other softwares support features that can help with this. Moreover there are some serious security and privacy concerns about Zoom (see e.g. this statement by the FBI and this investigation by the NY attorney general; Bruce Schneier has written an overview of the concerns here).

In our department we use BigBlueButton (website, Wikipedia) for our classrooms and seminars. It's a completely open-source and free web conferencing system. There are a few services out there that host servers but they're completely overloaded at the moment. I'd say your best bet would be to get your IT services to host a server for your department. With BBB by default new users don't have their webcams activated, and you can prevent them from doing so. You can even prevent them from using their microphone and require them to virtually "raise their hand" before a moderator allows them to speak. That should cut down a lot of the abuse. You can also set up the service so that an account is required before accessing the meeting. Unless the abuser is very dedicated, they probably won't bother creating dozens of accounts to continue bothering people after being kicked out, I hope.

Also, something obvious: many abusers are specifically targeting Zoom and going into random Zoom meetings. Unless you've somehow attracted abusers who are specifically targeting you, if you use something else (especially something hosted by your own department), you probably won't have any problems.

Note: I'm only recommending BBB because that's what we use at our department, but there are other services out there. I know another department has set up something called "Panopto" for example, and another something called "Classilio" - you'll have to look that up, I don't know much about it. For informal meetings we use Jitsi but it doesn't seem adequate for hosting a seminar. But in any case, if a software doesn't meet your requirements, you should definitely look into switching to something else, especially with the privacy concerns...

7
  • 27
    Zoom has also features like "mute all participants", "do not allow participants to unmute themselves", etc.: support.zoom.us/hc/en-us/articles/… Apr 7, 2020 at 10:02
  • 18
    To be clear, BBB has the same problems that Zoom has with the possibility of vandals "bombing" meetings, and the same solutions and their trade-offs applies. The problem seems simple: without authentication, anybody can enter the meeting, no matter what platform is used. Apr 7, 2020 at 12:37
  • I know the host can mute and unmute participants, but how do you tell whether the person you're about to unmute is an abuser? Apr 7, 2020 at 12:38
  • 14
    @NateEldredge Just have them type in questions to the moderator, and the mod filters the questions and only unmutes askers with good questions, or the mod reads good questions to the speaker. It works for radio stations, at least. Apr 7, 2020 at 13:50
  • 1
    @HansOlsson I've seen livestreamers do it with just one person, if you can pause to read through questions (no typing responses, just respond out loud). But it is easier with a moderator. Even if the moderator is just filtering out obviously not-real questions and banning anyone who asks joke questions. Apr 7, 2020 at 14:08
22

The features discussed in the comments seem sufficient in the case that the organizer knows the participants, e.g. classes, committee meetings, etc.

I don't think this question has a single right answer. I'm going to answer for the case where the conference is open to interested academics and the organizer doesn't know all the potential participants. This isn't specific to Zoom, either. I think this would work for most on-line conferencing systems.

Require preregistration using Google Forms or a similar tool. Ask for full name, email address, and some vetting information such as the URL of the applicant's academic web page. The vetting questions will likely change depending on the nature of the audience, and perhaps with experience. You'll need a registration deadline so that you can send out passwords.

There are several tools for sending bulk email from a .csv spreadsheet such a Google Forms provides. I use the mail-merge add-in for Thunderbird. I'm told Microsoft Office has an email-merge feature. Look through the list, delete any that don't pass vetting, and mail the meeting link to the rest.

"Look through the list" will be the time-consuming task. If one expects more than perhaps 50-100 participants, I'd download the list daily, clear it out, and vet applicants one day at a time.

Edit: It will be hard, but not impossible, for a troll to masquerade as a famous academic because the invitation will go to the address in the registration, which, for famous academics, is likely to be well-known.

I've just done some poking with Google. Excel appears to have a way to highlight cells that do not end with a specified string. So, the Google form says "academic email address required" and the formula lights up in red any addresses that don't pass the filter described just below. Deleting them is still a manual process unless one wants to learn the Visual Basic stuff used to "program" excel, but finding them becomes easy.

Further to Federico Poloni's comment, start with a simple rule, e.g. addresses must end in .edu in the US, or .ac.uk in the UK. Look at the addresses that get flagged and adjust the rule accordingly. Of course, that means no automagic deletions, but you can group the flagged addresses using a filter for manual deletion in a batch. Yes, this is a certain amount of "make it up as we go along," but I imagine we'll be doing a lot of that for many months.

7
  • 24
    Outside the US, people have academic addresses such as @unipi.it, so the approach in your last paragraph won't work in an international setting. Apr 7, 2020 at 9:24
  • 1
    You don't need VBA to do this, conditional formatting and IF() can be used.
    – Solar Mike
    Apr 7, 2020 at 9:24
  • 1
    @FedericoPoloni Sure it will; one just has to work through the exceptions.
    – Bob Brown
    Apr 7, 2020 at 12:36
  • 15
    @bobbrown I think most universities in the world do not have an .edu domain.
    – Dirk
    Apr 7, 2020 at 14:46
  • 1
    @BobBrown you can filter based on color, select all rows showing by shift-clicking, then right click and delete. That's still technically manual, but it only takes a few seconds.
    – Kat
    Apr 7, 2020 at 17:29
16

We had the same problem and ended up with a solution like this:

  • The seminar series web page contains information about the seminar program, plus instructions for joining the seminar mailing list.
  • The Zoom link is shared only through the seminar mailing list some time before the event.
  • There is no password.

The mailing list subscriptions can be moderated, but I don't think there is need to really "check the credentials" of those who are joining the list.

This is low-effort for the organizers and legitimate seminar participants, and it would be relatively high-effort for someone who wants to do Zoom bombing (in particular, you will need to plan ahead and subscribe in advance, so if you are just right now bored and drunk and would like to do something silly, it doesn't sound too exciting to subscribe to a seminar mailing list that would make it possible to maybe do some Zoom bombing next week).

3
  • 5
    From what I understand, there are various internet forums where bored students can share a meeting password and ask for internet trolls to bomb their teacher. See e.g. this news article that discusses them. Apr 7, 2020 at 9:27
  • 2
    +1 for the low-effort solution which is enough in most cases. Just like cheap bicycle locks can be easily defeated by an experienced thief, but they are still useful in most cases, as they prevent casual passers-by from stealing your bike.
    – vsz
    Apr 7, 2020 at 10:08
  • 3
    It would more useful to have a password and put the password in the email with the link. That way, you would at least prevent Zoom bombing from people trying random meeting numbers,
    – pboss3010
    Apr 7, 2020 at 11:45
15

In addition to Zoom "meetings," they have a "webinar" option for calls:

https://zoom.us/webinar

(Note that this feature is only available in certain paid versions, I believe)

This option is designed for meetings at which most people are silently listening. The audio and video of participants are off by default, and can only be turned on by one of the hosts. Alternatively, there is a mechanism in these for submitting text questions, which go to a moderator queue and then are shown to everyone.

I recently attended a webinar of this type, and it ran smoothly. I think it would be much more difficult to disrupt than the usual meeting style.

1
  • 1
    It looks like this is an extra-cost add-on to their paid versions. The ability to host a webinar with 100 participants is currently USD 40 per month, with more participants costing more money. I guess you can compare it to your regular seminar budget for tea and cookies. Apr 9, 2020 at 2:15
10

The current phenomenon of "Zoom bombing" seems to come from the fact that Zoom meeting IDs can easily be guessed.

So you may be overthinking this and should try to publish the conference password on the institute website. This will not be found by people who just try to bomb random conferences.

When someone is explicitly targeting your conference, you won't have much chance to prevent it, while keeping it open to everyone even when you do not know them.

I would consider at least trying to use a meeting with a rather public password and only change when you actually run into problems.

4
  • 2
    I think most times a student in the class gives away the Zoom codes. I've seen people on social media specifically ask for other people's "zoom codes" so they can join.
    – MCMastery
    Apr 8, 2020 at 5:16
  • 1
    @MCMastery: This might be true for high school and low-level university classes, but not so much for seminars and conferences, whose participants are a bit more mature. Also, I don't remember a talk so boring that I'd ask 4chan to raid it :) Apr 8, 2020 at 8:03
  • @MCMastery but are these codes being given to people who will create problems?
    – Ian
    Apr 8, 2020 at 9:12
  • @MCMastery When someone especially wants to interrupt your meeting (maybe a student with a bad grade) you will need to make it private in some way, e.g., by communicating a password via a mailing list. But this is true for any medium that is open to everyone. And bold people may even come in and disturb real meetings until security forces them to leave.
    – allo
    Apr 8, 2020 at 9:49
6

It seems to me that the current state of things is that you can't, without some support from Zoom's side. Even if you set up a meeting password, a malicious participant can give it to a bomber. Even if you vet names, a bomber may spoof the name of a legitimate user.

You need accounts to solve this problem.

The crucial issue is that Zoom (EDIT: at least the way you are using it) has no concept of users or authentication. The problem can be solved if you require a form of personal authentication: a malicious user won't give their personal password to a bomber, because their name is attached to it.

You need trusted accounts.

This requires you to have some form of trusted authentication: if you have accounts, but users can create one in two minutes with [email protected], that's as good as nothing. Orcid may be more vetted (I don't have experience in how easy it is to create an Orcid account if you are not an academic). A "walled garden", such as schools that use Microsoft Teams or a corporate Google Suite for their internal needs, may work if all participants are inside the garden (and have independently authenticated accounts).

You can require academic addresses to create accounts, and check manually that their domains are legitimate. If we had a working global academic authentication infrastructure, it would have helped solving this problem probably. There are some attempts to create one: Shibboleth, Openathens, Eduroam. Probably Eduroam is the most widespread, so they may help. But you can't just use their credentials without some support from both them, and the video-conference service.

Of course firms are pushing for their walled gardens instead, and schools and universities blindly use Microsoft or Google because they are cheaper.

2
  • 4
    Zoom does have a concept of accounts and authentication, though, if you pay for it. See this page for integrating an existing authentication systems with Zoom. The fact that the US government doesn't use it when they should and get problems because of it doesn't mean that it's unavailable.
    – Erik A
    Apr 7, 2020 at 9:54
  • @ErikA Interesting, thanks! In particular it does already support Shibboleth, which is already quite common in academia. Apr 7, 2020 at 10:06
3

You could publicly share the meeting ID (and password, if required) before the meeting. Once the meeting has started - or maybe a few minutes later - you lock the meeting such that no new participants can join.

This will not protect you from determined troublemakers that attend the meeting from the start, but it prevents Zoom bombers from randomly dropping in. This approach is the digital equivalent of locking the door after the meeting has started.

2
  • 3
    What happens in a locked meeting if someone's connection breaks down and they want to rejoin? Apr 8, 2020 at 8:05
  • @darijgrinberg Good catch. I couldn't test a loss of connection, but if a guest of a locked meeting leaves the meeting, the guest cannot rejoin.
    – CL.
    Apr 8, 2020 at 8:35
3

Would be cool to have a capcha-type question, which is very specific to the seminar.

I am moderating a facebook group in a very specialized research field, mainly for researchers (all members either have a PhD or are on the way to get one). Hence, I ask a few questions which are very basic for the members, but highly non-trivial for laypersons.

3
  • That could be a solution, but you would need to have only a very specific answer possible. While in maths this is doable (say, a basic integral and you expect a number back), even in physics it becmes more complicated (except if this is a name such as Maxwell, or the answer of a basic physics problem). OK, after reading myself I think this is a cool idea :) (+1)
    – WoJ
    Apr 8, 2020 at 10:34
  • One of my questions is to provide the canonical next integer in the sequence 1,1,2,5,14,... Apr 8, 2020 at 10:36
  • 1
    Yes, for mathematicians this is probably obvious, or they can look it up in OEIS. An absolute deterrent for anybody else, though (I am an ex-physicist and had to look it up :-| )
    – WoJ
    Apr 8, 2020 at 10:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .