Preventing Zoombombing

Overview

Learn how to prevent and respond to Zoombombing — the disruption of a Zoom class or meeting with messages, imagery, or behavior.

Prevent disruptions with these tips:

• Registration for meetings
• Share meeting links with care
• Use a random meeting ID
• Restrict access to join a meeting
• Require a meeting passcode and disable one-click join
• Mute participants upon entry
• Enable Waiting Room
• Disable "join before host"
• Disable file transfer
• Disable virtual backgrounds
• Lock your meeting
• Limit screen sharing to the host
• Limit chat, renaming, and annotation

Respond to disruptions with these tips:

• Mute a participant
• Remove a participant
• Disable participant video
• Move a participant to the Waiting Room
• Use the new Security menu
• Report the Zoombomber to Zoom

This article also includes links to more information from Zoom about securing meetings.

Please report any Zoombombing incidents to the IT staff in your unit or the UO Information Security Office at infosec@uoregon.edu. Include the Zoom Meeting ID.

Preventing Disruptions

Share Meeting Links with Care

• Don't share your meeting link on social media or other public forums. It makes your event public, and ANYONE with the link can join your meeting.
• UO instructors can create and share Zoom meetings within Canvas.

Use a Random Meeting ID

Avoid using your Personal Meeting ID (PMI) to host public events. Your PMI is basically one continuous meeting. Instead, create a random meeting ID for each meeting.

1. Click Schedule to create a new meeting and review meeting options
2. In the Meeting ID section, click the Generate Automatically radio button

Restrict access to join a meeting

By default, participants don't have to be logged in to Zoom to join a meeting. All they need is the link or meeting ID (and passcode, if you've set one).

To prevent unknown participants from joining meetings, you can choose to restrict meeting participants to people who are logged in to Zoom account, and — if you wish — to people who are currently affiliated with the UO. Restricting Zoom meeting attendance to those affiliated with the UO improves security, especially for large classes and meetings for which waiting rooms are impractical. 

To restrict access when scheduling a new meeting:

1. Visit uoregon.zoom.us/meeting/schedule and log in with your Duck ID and password.
2. Scroll down to the Meeting Options section.
   • If using the Zoom desktop app or Zoom add-in for Microsoft Outlook, select Advanced Options instead.
3. Check the checkbox next to Only authenticated users can join.
4. In the drop-down menu that appears, you’ll have two options:
   • Select uoregon.edu to require participants to log in with a UO Zoom account; or
   • Select Sign in to Zoom to require participants to log in with any Zoom account.
5. Finish scheduling your meeting.

For details and screenshots, please see Zoom: How to Restrict Access to Authenticated Users.

Require a meeting passcode and disable one-click join

Visit uoregon.zoom.us/profile/setting, log in with your Duck ID and password, and select Settings. The Meetings tab should be pre-selected at the top of the page, and the options below are listed in the Security section.

• Locate Require a passcode when scheduling new meetings. Toggle the slider to on, if necessary. (That is UO's default setting.) You can use the passcode Zoom generates or choose your own. Participants will be asked to enter this passcode to join your meeting.
• Locate Embed passcode in invite link for one-click join. Toggle the slider to off, if necessary.

If you need to add or change a passcode to a meeting that has already been scheduled, log in to uoregon.zoom.us and select Meetings in the left hand menu. The Upcoming Meetings tab should be pre-selected.

1. Locate which meeting you would like to edit. You may be able to hover over the meeting to get an Edit button, or you can click the topic of your meeting and then select the Edit this Meeting button at the bottom of the page. 
2. Once editing your meeting, locate the Security area of your meeting. Here you can check the box to enable a passcode, as well as change it to a passcode of your choosing. 
3. Click the Save button at the bottom of the page. 

Mute participants upon entry

Automatically mute all participants when they join your meetings. As the host, you control whether participants can unmute themselves.

Visit uoregon.zoom.us/profile/setting, log in with your Duck ID and password, and select Settings, then Schedule Meeting. Locate Mute participants upon entry, then toggle the slider to on, if necessary.

Enable Waiting Room

The Waiting Room feature allows the host to control when participants join your meeting. As the meeting host, you can admit attendees individually or hold all attendees in the virtual waiting room and admit all when you are ready to begin. Admitting participants from the Waiting Room requires an additional step for the host but provides increased control.

As of March 31, 2020, the Waiting Room should be enabled by default in your UO Zoom account. The April 8 update to the Zoom app also provides meeting hosts with a new Security menu that includes the option to Enable the Waiting Room during the meeting, even if it's not otherwise enabled.

As the host, you can also send a participant to the Waiting Room during a meeting. Click Manage Participants at the bottom of the Zoom window (if the Participants panel is not already visible), then hover over the participant's name, click More, and select Put in waiting room.

Disable "Join Before Host"

If you are scheduling a meeting where sensitive information will be discussed and you don't want participants to start the meeting without you, it's best to disable join before host functionality. Participants will then see a pop-up that says, "Please wait for the host to start this meeting."

If you are the host, there is a login button to log in and start the meeting as the host.

This feature can be enabled or disabled on a per-meeting basis when scheduling under Advanced Options in the Zoom desktop app or under Meeting Options if scheduling in the web browser.

Disable file transfer

Visit uoregon.zoom.us/profile/setting, log in with your Duck ID and password, and select In Meetings (Basic). Next to File transfer, toggle the slider to off, if necessary.

Disable virtual backgrounds

Virtual backgrounds allow users to obscure their actual background with an image or video. Although they may be welcome when used appropriately, and provide a way for UO community members to show some UO spirit, they can also provide disruptors with a way to display offensive images.

We recommend that you warn meeting participants in advance before you stop allowing virtual backgrounds so they have time to choose and prepare an appropriate setting from which to attend your Zoom meeting.

To prevent meeting participants from using virtual backgrounds, visit uoregon.zoom.us/profile/setting, log in with your Duck ID and password, and select Settings, then In Meetings (Advanced). Next to Virtual background, toggle the slider to off, if necessary.

Lock your meeting

A meeting host or co-host can lock a meeting once all participants have joined. That prevents anyone else from joining the meeting, even if they have the meeting passcode.

The April 8 update to the Zoom app also provides meeting hosts with a new Security menu that includes the Lock Meeting option.

If you're not seeing the new Security menu, then:

• Click Manage Participants at the bottom of the Zoom window (if the Participants panel is not already visible).
• At the bottom of the Participants panel, click More.
• Select Lock Meeting.

Limit Screen Sharing to the Host

Limiting who can share their screen during a meeting can help prevent intrusive sharing. However, this may not be appropriate when multiple participants need to share and collaborate.

For UO faculty and staff

On March 26, Zoom changed the default screen sharing setting for Education accounts (the accounts that UO faculty and staff have) to Host Only by default.

To re-enable screen sharing by other meeting participants:

• While hosting a meeting: The April 8 update to the Zoom app provides meeting hosts with a new Security menu that lets you allow or disallow participants to Share Screen. If you're not seeing the new Security menu, then click the arrow to the right of the Screen Sharing icon, select Advanced Sharing Options and select All Participants.
• In your default settings (applies to all meetings): Visit uoregon.zoom.us/profile/setting, log in with your Duck ID and password, and select Settings, then In Meetings (Basic). Under Screen sharing, under Who can share?, select All Participants.

For UO Students

The April 8 update to the Zoom app provides meeting hosts with a new Security menu that lets you allow or disallow participants to Share Screen.

If you're not seeing the new Security menu and you want to limit sharing privileges while hosting a meeting, then: 

• Click the up-arrow next to Share Screen.
• Select Advanced Sharing Options.
• Under Who can share, click Only Host.

Limit chat, renaming, and annotation

Limiting participants' ability to chat in a meeting, rename themselves, and annotate the host’s shared content can reduce the likelihood of unwanted disruptions. To adjust these settings for your account, visit uoregon.zoom.us/profile/setting, log in with your Duck ID and password, and select Settings, then In Meetings (Basic).

• Chat allows participants to send a message to everyone in a meeting. Consider toggling the slider to off.
• Private chat allows participants to send one-on-one messages to another meeting participant. We recommend toggling the slider to off.
• Annotation allows participants to write or draw on content the host is sharing. We recommend toggling the slider to off.
• Allow participants to rename themselves. This allows meeting attendees to change the name that appears for them in Zoom. We recommend toggling the slider to off.

You can also adjust these settings during a meeting using the new Security menu in the April 8 update to the Zoom app.

Responding to Disruptions

As preparation for possible disruptions, familiarize yourself with Zoom’s settings and features. Make sure you know how to manage participants (start at 3:03 in Zoom's video on Meeting Controls).

We suggest leaving your Manage Participants menu open while hosting a meeting. That way, you can easily see raised hands and, in case of a disruption, quickly access the following options below by hovering over a participant's name:

• Mute a participant
• Remove a participant by selecting More, then Remove
  • You can also do this from the new Security menu in the April 8 update to the Zoom app.
• Disable participant video by selecting More, then Stop Video
• If Waiting Room is enabled: Move a participant to the Waiting Room by selecting More, then Put in waiting room.

We also recommend familiarizing yourself with the new Security menu in the April 8, 2020 update to the Zoom app. It allows hosts and co-hosts to easily do the following during a meeting:

• Lock the meeting
• Enable the Waiting Room (even if it’s not already enabled)
• Remove participants
• Restrict participants' ability to:
  • Share their screens
  • Chat in a meeting
  • Rename themselves
  • Annotate on the host’s shared content

As of the November 16, 2020 update to the Zoom app, there is now a Suspend participant activity option in the Security menu. This allows for hosts and co-hosts to immediately suspend all participant activities in one click, which will:

• Mute all video and audio
• Stop any screen sharing
• End all breakout rooms
• Pause recording 

This also immediately opens the Participants window, allowing quick access to Remove the disruptive participant, or Put in Waiting Room (if enabled).

As of Zoom update 5.4.2, meeting hosts are able to report disruptive meeting participants to Zoom. The recent security update allows meeting hosts and co-hosts to take action against disruptive behavior and limit Zoombombing in the future. Report Zoom bombers to Zoom.

More Information from Zoom

• Zoom 101: Securing Your Meetings & Virtual Classrooms (video)
• Best Practices for Securing Your Virtual Classroom (blog post)
• How to Keep the Party-Crashers from Crashing Your Zoom Event (blog post)
• Best Practices for Securing Your Meetings (PDF file)