Avoiding "Zoom bombing" in virtual conferences and seminars

Question

With travel restricted by the COVID-19 pandemic, many academics are organizing online seminars and conferences as a substitute for regular in-person university seminars, colloquia, and research conferences.

In real life, seminars are usually open to anyone who wants to drop in, and every attendee can be seen and heard and may ask questions. So an obvious approach is to organize the event using video meeting software such as Zoom, and simply post the link on a public website so that any interested person can participate. However, this also opens the event to "Zoom bombers", random people who just want to disrupt the proceedings with annoying or offensive video / audio / text chat - such abuse has unfortunately become very common in public Zoom meetings.

What best practices exist to keep such an event as open as possible to legitimate participants, and let them interact with each other and the speaker in a reasonable way, while reducing the risk of disruption and abuse?

What are the pros and cons of these strategies?

Strategies could be general, or involve specific features of certain software.

Some strategies I've thought of, and their drawbacks:

• Create a password for the meeting. Then the question is, to whom should the organizer give the password? If they only give it to people they know, it excludes people who might be interested but whom they happen not to know. If they distribute it to large mailing lists of interested academics, it raises the chance that it will fall into the wrong hands.

• Offer to share the password by email upon request. This requires extra time from the organizer to respond to those emails, and to manually verify the credentials of each requester.

• Require a nominal registration fee, as real-life conferences often do. This requires setting up an online payment system, which can be a lot of work, and may exclude people who are only casually interested, or who don't have funding, or who work in less wealthy parts of the world. It may also involve the organizer in a lot of bureaucracy with their university as to how the fees will be managed and spent.

• Use a "waiting room" feature, where participants must be approved immediately before joining. However, as far as I know, the host only sees the participant's name. If they see an unfamiliar name, how can they tell whether it is a troll, or a legitimate researcher whom they just happen not to know? Conversely, I don't think there is anything to stop a troll from masquerading under the name of a famous academic.

I am wondering if people have thought of better solutions, that are specifically appropriate to academia. Such strategies might take advantage of specific features of the academic community, e.g. to authenticate genuine researchers (.edu addresses? accounts on preprint servers? ORCid IDs?). Answers could also address the pros and cons of such strategies as they apply to academia in particular, and how well they fit with people's existing expectations for academic conferences.

Answer 1

How about using something other than Zoom? Other softwares support features that can help with this. Moreover there are some serious security and privacy concerns about Zoom (see e.g. this statement by the FBI and this investigation by the NY attorney general; Bruce Schneier has written an overview of the concerns here).

In our department we use BigBlueButton (website, Wikipedia) for our classrooms and seminars. It's a completely open-source and free web conferencing system. There are a few services out there that host servers but they're completely overloaded at the moment. I'd say your best bet would be to get your IT services to host a server for your department. With BBB by default new users don't have their webcams activated, and you can prevent them from doing so. You can even prevent them from using their microphone and require them to virtually "raise their hand" before a moderator allows them to speak. That should cut down a lot of the abuse. You can also set up the service so that an account is required before accessing the meeting. Unless the abuser is very dedicated, they probably won't bother creating dozens of accounts to continue bothering people after being kicked out, I hope.

Also, something obvious: many abusers are specifically targeting Zoom and going into random Zoom meetings. Unless you've somehow attracted abusers who are specifically targeting you, if you use something else (especially something hosted by your own department), you probably won't have any problems.

Note: I'm only recommending BBB because that's what we use at our department, but there are other services out there. I know another department has set up something called "Panopto" for example, and another something called "Classilio" - you'll have to look that up, I don't know much about it. For informal meetings we use Jitsi but it doesn't seem adequate for hosting a seminar. But in any case, if a software doesn't meet your requirements, you should definitely look into switching to something else, especially with the privacy concerns...

Answer 2

The features discussed in the comments seem sufficient in the case that the organizer knows the participants, e.g. classes, committee meetings, etc.

I don't think this question has a single right answer. I'm going to answer for the case where the conference is open to interested academics and the organizer doesn't know all the potential participants. This isn't specific to Zoom, either. I think this would work for most on-line conferencing systems.

Require preregistration using Google Forms or a similar tool. Ask for full name, email address, and some vetting information such as the URL of the applicant's academic web page. The vetting questions will likely change depending on the nature of the audience, and perhaps with experience. You'll need a registration deadline so that you can send out passwords.

There are several tools for sending bulk email from a .csv spreadsheet such a Google Forms provides. I use the mail-merge add-in for Thunderbird. I'm told Microsoft Office has an email-merge feature. Look through the list, delete any that don't pass vetting, and mail the meeting link to the rest.

"Look through the list" will be the time-consuming task. If one expects more than perhaps 50-100 participants, I'd download the list daily, clear it out, and vet applicants one day at a time.

Edit: It will be hard, but not impossible, for a troll to masquerade as a famous academic because the invitation will go to the address in the registration, which, for famous academics, is likely to be well-known.

I've just done some poking with Google. Excel appears to have a way to highlight cells that do not end with a specified string. So, the Google form says "academic email address required" and the formula lights up in red any addresses that don't pass the filter described just below. Deleting them is still a manual process unless one wants to learn the Visual Basic stuff used to "program" excel, but finding them becomes easy.

Further to Federico Poloni's comment, start with a simple rule, e.g. addresses must end in .edu in the US, or .ac.uk in the UK. Look at the addresses that get flagged and adjust the rule accordingly. Of course, that means no automagic deletions, but you can group the flagged addresses using a filter for manual deletion in a batch. Yes, this is a certain amount of "make it up as we go along," but I imagine we'll be doing a lot of that for many months.

Answer 3

We had the same problem and ended up with a solution like this:

• The seminar series web page contains information about the seminar program, plus instructions for joining the seminar mailing list.
• The Zoom link is shared only through the seminar mailing list some time before the event.
• There is no password.

The mailing list subscriptions can be moderated, but I don't think there is need to really "check the credentials" of those who are joining the list.

This is low-effort for the organizers and legitimate seminar participants, and it would be relatively high-effort for someone who wants to do Zoom bombing (in particular, you will need to plan ahead and subscribe in advance, so if you are just right now bored and drunk and would like to do something silly, it doesn't sound too exciting to subscribe to a seminar mailing list that would make it possible to maybe do some Zoom bombing next week).

Answer 4

In addition to Zoom "meetings," they have a "webinar" option for calls:

https://zoom.us/webinar

(Note that this feature is only available in certain paid versions, I believe)

This option is designed for meetings at which most people are silently listening. The audio and video of participants are off by default, and can only be turned on by one of the hosts. Alternatively, there is a mechanism in these for submitting text questions, which go to a moderator queue and then are shown to everyone.

I recently attended a webinar of this type, and it ran smoothly. I think it would be much more difficult to disrupt than the usual meeting style.

Answer 5

The current phenomenon of "Zoom bombing" seems to come from the fact that Zoom meeting IDs can easily be guessed.

So you may be overthinking this and should try to publish the conference password on the institute website. This will not be found by people who just try to bomb random conferences.

When someone is explicitly targeting your conference, you won't have much chance to prevent it, while keeping it open to everyone even when you do not know them.

I would consider at least trying to use a meeting with a rather public password and only change when you actually run into problems.

Answer 6

It seems to me that the current state of things is that you can't, without some support from Zoom's side. Even if you set up a meeting password, a malicious participant can give it to a bomber. Even if you vet names, a bomber may spoof the name of a legitimate user.

You need accounts to solve this problem.

The crucial issue is that Zoom (EDIT: at least the way you are using it) has no concept of users or authentication. The problem can be solved if you require a form of personal authentication: a malicious user won't give their personal password to a bomber, because their name is attached to it.

You need trusted accounts.

This requires you to have some form of trusted authentication: if you have accounts, but users can create one in two minutes with [email protected], that's as good as nothing. Orcid may be more vetted (I don't have experience in how easy it is to create an Orcid account if you are not an academic). A "walled garden", such as schools that use Microsoft Teams or a corporate Google Suite for their internal needs, may work if all participants are inside the garden (and have independently authenticated accounts).

You can require academic addresses to create accounts, and check manually that their domains are legitimate. If we had a working global academic authentication infrastructure, it would have helped solving this problem probably. There are some attempts to create one: Shibboleth, Openathens, Eduroam. Probably Eduroam is the most widespread, so they may help. But you can't just use their credentials without some support from both them, and the video-conference service.

Of course firms are pushing for their walled gardens instead, and schools and universities blindly use Microsoft or Google because they are cheaper.

Answer 7

You could publicly share the meeting ID (and password, if required) before the meeting. Once the meeting has started - or maybe a few minutes later - you lock the meeting such that no new participants can join.

This will not protect you from determined troublemakers that attend the meeting from the start, but it prevents Zoom bombers from randomly dropping in. This approach is the digital equivalent of locking the door after the meeting has started.

Answer 8

Would be cool to have a capcha-type question, which is very specific to the seminar.

I am moderating a facebook group in a very specialized research field, mainly for researchers (all members either have a PhD or are on the way to get one). Hence, I ask a few questions which are very basic for the members, but highly non-trivial for laypersons.