The United States Department of Justice (DoJ) unsealed a complaint and arrest warrant on Friday against Zoom's now-sacked liaison with the Chinese government, Xinjiang Jin.
In his role at Zoom, Jin allegedly responded to requests from Beijing for information on users and meetings. He also allegedly ended meetings discussing topics that China found to be problematic. The DoJ said Jin handed information including names, email addresses, and IP addresses of people outside China that Beijing was interested in.
"As alleged in the complaint, between January 2019 to the present, Jin and others conspired to use Company-1's systems in the United States to censor the political and religious speech of individuals located in the United States and around the world at the direction and under the control of officials of the PRC government," the DoJ said.
"Among other actions taken at the direction of the PRC government, Jin and others terminated at least four video meetings hosted on Company-1's networks commemorating the thirty-first anniversary of the Tiananmen Square massacre, most of which were organised and attended by U.S.-based participants, such as dissidents who had participated in and survived the 1989 protests."
It is alleged that between May and June, Jin and others infiltrated Zoom meetings to gather evidence and fabricated evidence to get meetings ended and users banned.
"The fabricated evidence falsely asserted that the meetings included discussions of child abuse or exploitation, terrorism, racism or incitements to violence, and sometimes included screenshots of the purported participants' user profiles featuring, for example, a masked person holding a flag resembling that of the Islamic State terrorist group," the DoJ said.
"Jin used the complaints as evidence to persuade Company-1 executives based in the United States to terminate meetings and suspend or terminate the user accounts of the meeting hosts."
The DoJ said Beijing used the information gathered to retaliate against those in the meeting or their China-based family members.
"PRC authorities temporarily detained at least one person who planned to speak during a commemoration meeting. In another case, PRC authorities visited family members of a participant in the meetings and directed them to tell the participant to cease speaking out against the PRC government and rather to support socialism and the CCP," it said.
According to the complaint [PDF], Jin is charged with one count of conspiracy to commit interstate harassment and another count of unlawful conspiracy to transfer means of identification. If found guilty of both counts, he could face 10 years in prison.
Jin is currently not held in US custody. According to his Most Wanted page, the federal arrest warrant was issued on November 19.
Outing itself as Company-1 in the DoJ's complaint, Zoom said it has fully cooperated with authorities, sacked Jin for violating company policies, and had other employees on "administrative leave" as it completes an internal investigation.
Zoom said in September last year that it was blocked in China by Beijing officials and the company wanted to get the block removed as soon as possible.
"We had not, at that point in our evolution, been forced to focus on societal or policy concerns," the company said.
After meeting with Chinese authorities, the company agreed to having an "in-house contact for law enforcement requests", as well as shifting data on Chinese users out of US data centres and into the Middle Kingdom.
"The plan included measures to comply with real ID and data localization requirements applicable in China, in a manner that is capable of audit and verification, as well as establishing a legal entity in China to meet China's local legal and regulatory requirements," Zoom said.
"The plan also references measures that we did not carry out, such as working with a local Chinese partner to develop technology that would analyze the content of meetings hosted in China to identify and report illegal activity and shut down meetings that violate Chinese law."
The Chinese ban was lifted on 17 November 2019, Zoom said, and while conducting its investigation, it said it believed data was shared with Beijing on less than 10 individuals residing outside the country, and beyond that, neither Jin nor any other employees, have shared data with the Chinese government on users outside of China.
"While the complaint alleges that the former employee obtained Zoom account and user IDs associated with the Xinjiang region of China, our investigation shows that this data was anonymized, and at this time we do not have reason to believe that it was shared with the Chinese government," it added.
Zoom added it was creating an insider threat program to flag suspicious employee behaviour.
Last week, The New York Times reported Alibaba had developed and promoted facial recognition software that could be used to continue China's repression of its Uyghur population. The company subsequently removed any references to Uyghurs, said it was not used outside a test environment, and issued a statement saying it had removed any ethnic tag in the software.
The response mirrored that of Huawei earlier in the month when The Washington Post reported Huawei was testing automated "Uyghur alarms" that send alerts to Chinese authorities when Uyghurs are detected via its camera systems.
The Washington Post said a document it saw from Huawei's website was removed by the company after comment was sought. Huawei reportedly said it was "simply a test" and not a product.
In June, Zoom finally got around to implementing a way to restrict bans by geography. The change followed the company banning a Chinese human-rights activist at the behest of Beijing, before reinstating the account.
Zoom said at the time it should have anticipated needing such a system.
"No company with significant business interests in China is immune from the coercive power of the Chinese Communist Party," Assistant Attorney General for National Security John Demers said on Friday.
"The Chinese Communist Party will use those within its reach to sap the tree of liberty, stifling free speech in China, the United States and elsewhere about the Party's repression of the Chinese people. For companies with operations in China ... this reality may mean executives being coopted to further repressive activity at odds with the values that have allowed that company to flourish here."
Acting United States Attorney Seth DuCharme, meanwhile, claimed US companies operating in China are forced to make a Faustian bargain with Beijing and have to deal with the insider threat of their own employees in the Middle Kingdom.
- Zoom will stop selling directly to Chinese customers
- Zoom to open Singapore research facility, expand data centre capacity
- Zoom settles FTC charges for misleading users about security features
- Zoom backtracks and plans to offer end-to-end encryption to all users
- Zoom concedes custom encryption is substandard as Citizen Lab pokes holes in it