Love it or hate it, everyone is on Zoom these days, including lawyers.
The company notes that daily use went up from 10 million users a day in December 2019, to over 200 million daily users in March 2020. On March 23, 2020 alone, the app was downloaded 2.13 million times globally.
Social distancing during COVID-19 has in no insignificant way pushed the use of this platform to new levels, with share prices going from $70 in January to $150 by the the end of March 2020. Yet, the platform was never designed with this type of use in mind.
A myriad of security and privacy issues have been identified with Zoom use, including:
- Zoom bombing, where strangers crash a Zoom meeting, usually with a disruptive intent
- Windows password stealing via chat function
- Windows malware injection via chat
- iOS user profile sharing to Facebook
- Misleading end-to-end encryption
- Malware concerns on Macbooks
- Mac malware backdoor
- Sharing email addresses and profile pictures
- Sharing personal data to advertisers
- Recorded meetings online
- Private chats being disclosed
The vast majority of these have been fixed or patched by Zoom, with a message from the CEO promising to priority security and privacy concerns,
For the past several weeks, supporting this influx of users has been a tremendous undertaking and our sole focus. We have strived to provide you with uninterrupted service and the same user-friendly experience that has made Zoom the video-conferencing platform of choice for enterprises around the world, while also ensuring platform safety, privacy, and security. However, we recognize that we have fallen short of the community’s – and our own – privacy and security expectations. For that, I am deeply sorry, and I want to share what we are doing about it.
In addition to regular training sessions and tutorials, Zoom has implemented waiting rooms, passwords, muting controls, and limited screen sharing, to prevent Zoom bombing abuse. They have disabled the “attendee attention tracker,” which allowed hosts to monitor which participants were not paying attention. They are also proactively shifting their focus on trust, safety, and privacy, rather than developing new features.
The professional versions of Zoom have more sophisticated features than the free version, which also limit the types of abuse possible. Given the amount of time that professionals are working from home these days, the expense involved may be justifiable.
USA Today suggests logging in through Meeting ID, rather than a direct Zoom link, to avoid phishing scams.
In short, Zoom is anything but a perfect platform, especially from a privacy and security perspective, but it is one that is highly responsive to these concerns, and takes its relationship with the public very seriously. Amit Serper states on Medium,
Zoom is not malware. Zoom is safe to use for both you personally and businesses, but you should read through on how to best protect yourself and your company. Throughout the past few days, social media (mostly infosec twitter) is gushing with various opinions and hot takes about Zoom being malware due to multiple issues found with it. Some of these issues are indeed problematic (and are/were taken care of by Zoom) and some of the issues that are being raised and discussed in social media are in fact not bugs or issues with Zoom itself but issues with the way operating systems work.
The question remains as to whether Zoom is good enough for lawyers to use in their capacity as a lawyer. Some lawyers, in particular some insurance defence counsel, have indicated that they do not have the ability to use Zoom for legal work, including communications with counsel, mediations, or hearings.
The Federation’s Model Code states,
3.3-1 A lawyer at all times must hold in strict confidence all information concerning the business and affairs of a client acquired in the course of the professional relationship and must not divulge any such information unless:
(a) expressly or impliedly authorized by the client;
(b) required by law or a court to do so;
(c) required to deliver the information to the Law Society; or
(d) otherwise permitted by this rule.
Ideally, a lawyer’s retainer agreement will include an authorization by the client for the lawyer to use Internet and cloud-based technology, which may not have perfect security features at all times. This does not absolve a lawyer from making reasonable inquiries and addressing security risks where it is possible to do so, but such an agreement up front helps resolve much of these concerns. Where these issues are not addressed in the retainer, but the practice of law requires the use of videoconferencing systems like Zoom, it is prudent to obtain this consent from the client in writing.
The preface to the Model Code also urges professional conduct to be interpreted in light of the realities of the practice, and emerging technology,
The practice of law continues to evolve. Advances in technology, changes in the culture of those accessing legal services and the economics associated with practising law will continue to present challenges to lawyers. The ethical guidance provided to lawyers by their regulators should be responsive to this evolution. Rules of conduct should assist, not hinder, lawyers in providing legal services to the public in a way that ensures the public interest is protected.
One of the most obviously was that Zoom could be justified in this context is where its use is ordered by the court. A small handful of reported cases have done so.
In L.L. c Québec (Société de l’assurance automobile), a 2018 challenge to the Tribunal administratif du Québec of a decision by the Société de l’assurance automobile du Québec to end income replacement was received outside of the 60 day time limit in the Loi sur la justice administrative.
The Tribunal had refused a request to postpone the hearing because he was in the U.S., stating there is flexibility in the justice system, and the applicant could testify by videoconferencing, including the use of Zoom,
Le temps d’audience est précieux, il s’agit d’une ressource limitée.
L’audience ne doit porter que sur une question limitée. Certes, le requérant a le droit à une audience. Cependant, compte tenu de la flexibilité de la justice administrative, cela ne se traduit pas nécessairement par un moment à toutes les parties et le juge administratif sont présents dans la même salle.
Ainsi, le requérant peut témoigner et plaider autrement, il n’a pas à être nécessairement sur place; il peut le faire par différentes manières (visioconférence, conférence téléphonique, Zoom Video, Skype, etc.).
The New Brunswick Workers’ Compensation Appeals Tribunal dealt with Zoom in passing in 20198947 (Re), where the employee was required to use Zoom meetings with a rehabilitation specialist from the Workplace Health, Safety and Compensation Commission of New Brunswick for assessments and training.
Although the employee indicated that he preferred training in-person, the meetings continued, and the Zoom interactions provided the basis for the rehabilitation specialist’s report. Regardless, the employee was successful in challenging the Commission’s position about alternative available work that was suitable for him.
Where Zoom is likely being used most extensively, based on orders or direction by the courts, is in family law, where disputes between parents over parenting time has escalated in many circumstances.
In a new decision in Simcoe Muskoka Child and Youth Family Services v. JH, dealing with an urgent motion to change the child’s placement, the court reviewed what has become a general policy for children’s aid societies, offering virtual access in place of face to face visits during the COVID-19 pandemic. The mother had not been complying with previous supervision orders or access orders for her other children, and there were serious concerns about the mother adhering to COVID-19 precautions.
While noting that it is in the best interests of the child to have “meaningful personal contact” with the parent, Justice Jain also stated that we are in extraordinary times, where the Society also has a responsibility for COVID-19 considerations for children in tehir care. Accordingly, she ordered,
i. The Society shall have temporary care and custody of the child BS born March 25, 2007.
ii. The Mother shall have access with the child BS at the discretion of the Society and in accordance with the child’s wishes including:
a. Virtual contact up to three times per week via social media and/or telephone (including WhatsApp, Zoom, Facetime messenger or other services that allow for video/audio conferencing);
b. Texting daily for up to 30 minutes.
iii. Due to the ongoing COVID-19 pandemic, face to face visits will commence upon same being deemed safe by the Society.
While the latter examples are ones of clients who are being compelled by the courts to use Zoom or equivalent technology, there are recent changes indicating lawyers will soon be sharing this expectation as well.
Starting April 6, 2020, courts in Ontario will be resuming with additional by remote hearings through telephone or video conference, or heard in writing. While every region has slight variations, the Toronto notice explicitly states that Zoom will be used at Divisional Court and the Commercial List,
D.2. Scheduling Divisional Court Matters
4. Hearings will all be conducted electronically, either by teleconference or by videoconference. Teleconferences will be conducted on court teleconference lines. Videoconferences will be conducted using the application ZOOM. Parties will be required to confirm in advance that they will be able to participate in the hearing using the selected technology.
E. Commercial and Estate List Matters
4. All contested matters will be heard by teleconference using ZOOM or another videoconference facility.
The latter court is the one which over a year ago announced a shift to a digital hearing workspace, with the rest of the courts in Ontario to follow shortly. Those efforts are likely to be accelerated in this current climate.
The Commentary to Rule 3.3-1 under the Model Code provides for some exceptions to confidentiality,
 In some situations, the authority of the client to disclose may be inferred. For example, in court proceedings some disclosure may be necessary in a pleading or other court document. Also, it is implied that a lawyer may, unless the client directs otherwise, disclose the client’s affairs to partners and associates in the law firm and, to the extent necessary, to administrative staff and to others whose services are used by the lawyer. But this implied authority to disclose places the lawyer under a duty to impress upon associates, employees, students and other lawyers engaged under contract with the lawyer or with the firm of the lawyer the importance of non disclosure (both during their employment and afterwards) and requires the lawyer to take reasonable care to prevent their disclosing or using any information that the lawyer is bound to keep in confidence.
With courts in Ontario explicitly mentioning Zoom as a platform for virtual hearings, any privacy or security concerns are overcome by the public interest in having these matters continue. What this requires though is for lawyers to familiarize themselves with any shortcomings with the platform, experiment with settings that would reduce vulnerabilities, and have informed conversations with clients and staff about how it can be used responsibly.
Refusing to use videoconferencing like Zoom is no longer an option. If it’s good enough for the courts, it’s good enough for the profession.