From boardrooms to courtrooms, universities to elementary schools, statehouses to jailhouses, the video-conferencing app Zoom has become an important communication tool during the ongoing COVID-19 pandemic and social distancing efforts.
However, it was not long before Zoom executives acknowledged their platform had a number of security issues, giving birth to a new term: Zoom bombing.
About three dozen worshipers from the Unitarian Universalist Fellowship of Waco learned that in a most traumatic way April 26 when their worship service via Zoom was bombed with images of child pornography, including sex acts involving infants.
It took church officials about 12 seconds to figure out which online visitor was sending the images and to shut down that person’s camera.
To Kris Cervantes, UU Fellowship of Waco minister, those dozen seconds seemed like a lifetime.
“I believe in an all-loving God, which is nice because it frees me to not have to love these people,” Cervantes said. “My feeling is for the safety of everyone, they need to be locked away. My religion calls for me to treat prisoners humanely, even if they don’t deserve it. I stand by that. But it is difficult not to wish for vengeance in this case. Justice is one thing and vengeance is another. The UU faith calls for us to believe in justice.”
Others made a similar attempt to disrupt the UU service Sunday. However, the safeguards that Cervantes and church leaders put in place after the April 26 incident prevented them from disrupting the broadcast again.
Zoom announced last week that it was releasing updates to the app to address the onslaught of security concerns, including encryption and new privacy controls.
After the April 26 incident, Jeff Martin-Moreno, who regularly attends UU Fellowship of Waco and who was online when the child pornography flashed across screens, contacted Cervantes and offered to help improve church Zoom security.
Cervantes said she is grateful that a young couple in the church who recently had a baby were not logged onto the service that day.
“As the pastor, you feel so violated,” Cervantes said. “I am responsible for protecting my people. It is just hard on all of us. I’m not easily shocked, but this shocked me right down to my core.”
Martin-Moreno is a research analyst in McLennan Community College’s Institutional Research Department. He has helped the college set up a more-secure system there. He did the same for the church, setting up a “lobby,” where people who try to sign on to the service are met by a “greeter,” who vets the person a bit, asks how they heard about the church and other information.
Those who the church allows to enter are then sent to a breakout room known as the “sanctuary,” where they can view the service.
“Part of the reason it was so bad from our perspective was that it was from human error,” Cervantes said. “One of our settings was not correctly set, and that allowed them to get in and post things so everybody could see what was posted. Jeff has been running Zoom meetings for MCC. He helped lead all of our leaders and tech folks through the best settings and best practices in terms of screening folks and other issues.”
Martin-Moreno, who also has provided technical assistance for local recovery groups who also have been hit with inappropriate Zoom bombers, said he was shaken by the images.
“I have seen a lot,” he said. “Never in my life have I ever seen anything like that. It was very jarring. My first impulse was to cover my screen so I couldn’t see it.”
After composing himself, he knew he had to help the church.
“I asked if they would be open to doing a workshop after the service that day and I met with the board and workshop participants and shared whatever information I had learned,” he said. “I told them some of the options I was aware of, and they decided which option worked best for them. One option that was real helpful was a setting where you can allow only the host to share their screen and limit that to the host only. That prevents people from being able to put something on the screen. Recovery groups and churches are the most open. They don’t want to turn anyone away, so people prey on that.”
The person who bombed the first meeting had an innocuous woman’s name, like Kristina B. Those who tried to infiltrate the meeting on Sunday used crude screen names, which made it easier to detect and shut them out, Martin-Moreno said.
Those subjected to the images on April 26 were given the opportunity to meet with a church member who is a sex-abuse counselor, Cervantes said.
“We had about 15 people come. It was a small fellowship,” Cervantes said. “We let people process and offered some spiritual care and emotional support. It was really good and very helpful.”
Cervantes said church leaders reported the incident to Waco police.
“We were contacted about that situation and we basically gave the person some advice and a list of things we needed to investigate things like that, but they have not gotten back with us on anything,” Waco police spokesperson Garen Bynum said.
Bynum said a case like this can cross jurisdictional lines and involve federal or state agencies, including the Texas Attorney General’s Office.
Zoom bombings are becoming more frequent as the pandemic continues. Last week, Dallas school officials reported that a Zoom meeting with parents of seniors and teachers was compromised.
Also, Zoom-bombers disrupted virtual graduation at Oklahoma City University on Saturday with swastika displays and racial slurs.
University President Martha Burger said in a statement that the university community is “heartbroken and outraged” that an event meant to honor graduates was interrupted.
Photo gallery: Virus outbreak protests and more
Concerned about COVID-19?
Sign up now to get the most recent coronavirus headlines and other important local and national news sent to your email inbox daily.