3 ms·

Yeah, Zoom is a US based company. Yes, they have a development team in China. It is valid to be concerned about the Chinese government exercising control of som

Yeah, Zoom is a US based company. Yes, they have a development team in China. It is valid to be concerned about the Chinese government exercising control of some sort over the local development team to put in a backdoor, just as our government seems to want to do to US developed products. No politicians really seem to like encryption very much. This is an overall geopolitical risk not unique to Zoom. But Zoom is not a Chinese company, it falls under US jurisdiction. And sovereign security risks are not unique to Chinese companies. Just saying that Zoom needs to be treated with caution because it is a "Chinese company" is lazy and inaccurate, and incorrectly characterizes both Zoom and where that risk originates.

atonse 6y ago
Yes, and I've clarified and fixed my originally badly described wording. I'll let Zoom describe this themselves. From Zoom's S-1 [1]: "In addition, we have a high concentration of research and development personnel in China, which could expose us to market scrutiny regarding the integrity of our solution or data security features. Any security compromise in our industry, whether actual or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures, negatively affect our ability to attract new customers and hosts, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could harm our business." [1] https://www.sec.gov/Archives/edgar/data/1585521/000119312519083351/d642624ds1.htm https://www.sec.gov/Archives/edgar/data/1585521/000119312519...
- vikramkr 6y ago
  Thanks for clarifying that, and yes, Zoom's s-1 writers did a good job of laying it out. The risks are real, and presenting them in an incorrect way makes it easy for people to dismiss the risks when they shouldn't. If the times comes because they're a Chinese company, and you check and see that they're a delaware c corp founded by a US citizen headquartered in the US, that would lead you to discount that risk. Clarifying that the risk comes from the development team being in a country where the government is in a contentious trade relationship with the US with an authoritarian regime (especially if the dev team isn't in one of the special economic zones) helps highlight what the risk is and confirm that it is a real threat.
- uoaei 6y ago
  > Any publicized security compromise in our industry, whether actual or perceived, could harm our reputation... FTFY
seppin 6y ago
> It is valid to be concerned about the Chinese government exercising control of some sort over the local development team to put in a backdoor, just as our government seems to want to do to US developed products. Chinese companies legally cannot refuse a government request for data. https://en.wikipedia.org/wiki/China_Internet_Security_Law https://en.wikipedia.org/wiki/China_Internet_Security_Law Comparing that with US/EU private sector protections is absurd.
- doomrobo 6y ago
  I can't find your claim in the linked Wikipedia page. What section?
  - seppin 6y ago
    First section: > It requires network operators to store select data within China and allows Chinese authorities to conduct spot-checks on a company's network operations. More has been reported about the implications of the law: > China’s National Intelligence Law from 2017 requires organizations and citizens to “support, assist and cooperate with the state intelligence work.” https://www.cnbc.com/2019/03/05/huawei-would-have-to-give-data-to-china-government-if-asked-experts.html https://www.cnbc.com/2019/03/05/huawei-would-have-to-give-da...

atonse 6y ago

Yes, and I've clarified and fixed my originally badly described wording. I'll let Zoom describe this themselves. From Zoom's S-1 [1]: "In addition, we have a high concentration of research and development personnel in China, which could expose us to market scrutiny regarding the integrity of our solution or data security features. Any security compromise in our industry, whether actual or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures, negatively affect our ability to attract new customers and hosts, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could harm our business." [1] https://www.sec.gov/Archives/edgar/data/1585521/000119312519083351/d642624ds1.htm https://www.sec.gov/Archives/edgar/data/1585521/000119312519...

vikramkr 6y ago
Thanks for clarifying that, and yes, Zoom's s-1 writers did a good job of laying it out. The risks are real, and presenting them in an incorrect way makes it easy for people to dismiss the risks when they shouldn't. If the times comes because they're a Chinese company, and you check and see that they're a delaware c corp founded by a US citizen headquartered in the US, that would lead you to discount that risk. Clarifying that the risk comes from the development team being in a country where the government is in a contentious trade relationship with the US with an authoritarian regime (especially if the dev team isn't in one of the special economic zones) helps highlight what the risk is and confirm that it is a real threat.
uoaei 6y ago
> Any publicized security compromise in our industry, whether actual or perceived, could harm our reputation... FTFY

seppin 6y ago

> It is valid to be concerned about the Chinese government exercising control of some sort over the local development team to put in a backdoor, just as our government seems to want to do to US developed products. Chinese companies legally cannot refuse a government request for data. https://en.wikipedia.org/wiki/China_Internet_Security_Law https://en.wikipedia.org/wiki/China_Internet_Security_Law Comparing that with US/EU private sector protections is absurd.

doomrobo 6y ago
I can't find your claim in the linked Wikipedia page. What section?
- seppin 6y ago
  First section: > It requires network operators to store select data within China and allows Chinese authorities to conduct spot-checks on a company's network operations. More has been reported about the implications of the law: > China’s National Intelligence Law from 2017 requires organizations and citizens to “support, assist and cooperate with the state intelligence work.” https://www.cnbc.com/2019/03/05/huawei-would-have-to-give-data-to-china-government-if-asked-experts.html https://www.cnbc.com/2019/03/05/huawei-would-have-to-give-da...