Kluwer Mediation Blog

Events last Friday have resulted in a harrowing few days for we mediators forced to move our practice online as a result of the COVID-19 pandemic. We’ve all been using Zoom. Zoom immediately emerged as the “go-to” platform for video mediation for the simple reason it offered “break-out rooms”, a function inexplicably absent in FaceTime, Skype, Teams, GoToMeeting, Hangouts and even HouseParty. Mediators, lawyers, and parties have been merrily participating in Zoom mediations routinely over the past few weeks to the satisfaction of all. Cases were being resolved. Even the Superior Court of Ontario directed the use of Zoom as the platform for certain pre-trial matters.

Then, on Friday, April 3rd, The Citizen Lab, an interdisciplinary laboratory based at the Munk School of Global Affairs & Public Policy, University of Toronto released this Report providing “a quick look at the confidentiality of Zoom meetings”. 

Their verdict: not so good. 

More specifically, the report concluded:

“As a result of these troubling security issues, we discourage the use of Zoom at this time for use cases that require strong privacy and confidentiality, including: 

• • • • • • • Governments worried about espionage
            • Businesses concerned about cybercrime and industrial espionage
            • Healthcare providers handling sensitive patient information
            • Activists, lawyers, and journalists working on sensitive topics

For those using Zoom to keep in touch with friends, hold social events, or organize courses or lectures that they might otherwise hold in a public or semi-public venue, our findings should not necessarily be concerning.

For those who have no choice but to use Zoom, including in contexts where secrets may be shared, we speculate that the browser plugin may have some marginally better security properties, as data transmission occurs over TLS.”

Unsurprisingly Zoom responded virtually immediately with this post. While Zoom’s response was reassuring, this line caught the attention of those of us who. for weeks had been assuring lawyers and parties that Zoom provided “end-to-end” encryption:

“We recognize that we can do better with our encryption design.”

It will be understandable if these developments cause parties such as banks, insurers, governments, and public corporations as well as their lawyers to question whether Zoom is truly enterprise-ready. Some have already done so and taken the position they will no participate in Zoom mediations at this time.

So where does that leave we mediators? We can obviously mediate by teleconference or some hybrid of one of the other online video services and teleconference. 

For me though, having read all I can get my hands on and discussing the issues with others,  I have come to the conclusion that, properly used, Zoom is safe enough – not perfect – but safe enough for use in the vast majority of commercial mediations. 

I suggest that “proper use” includes the following:

1. 1. 1. Using a unique and private meeting number for each mediation.
      2. Requiring participants to use a password to enter the meeting.
      3. Warning participants to keep their meeting link and password secure.
      4. For the time being avoid the use of the Waiting Room function in light of The Citizen Lab’s claim of a serious security issue related to that function.
      5. Locking the mediation meeting once all participants have joined using the “lock” function available to the meeting host.
      6. Advising participants against accessing the meeting via a public network and to satisfy themselves as to the security of the private network they’re using.
      7. Requiring participants to access the meeting using the latest version of the Zoom client software and not use a web browser for that purpose. This point is necessarily provisional given The Citizen Lab speculation that the browser plugin may have some marginally better security properties, as data transmission occurs over TLS. 
      8. Amend our Mediation Agreements to cover points uniquely related to video mediation. The following are the relevant paragraphs from my current iteration (all comments welcome).
         1. Parties have requested the use of the online dispute resolution technology known as Zoom Video Platform (“Zoom”) in the mediation. The Mediator shall host the mediation using his Zoom Pro account without additional cost to the parties.  The following terms are agreed to with respect to the conduct of the mediation via Zoom:
            1. The Parties agree that the mediation shall be a ‘mediation’ for the purposes of all applicable legislation, regulations, and rules. 
            2. The Parties acknowledge that they have made their own inquiries as to the suitability and adequacy of Zoom for its proposed use in the mediation and of any risks in using Zoom, including any risks in relation to its security, privacy or confidentiality and request the mediator to proceed with the use of Zoom.
            3. The Parties agree that they will inform the Mediator and each other in advance of the mediation of the names of all persons attending, participating or who are able to hear any communications in the mediation using Zoom and agree that no persons will attend, participate or be allowed to listen in on the hearing without the prior consent of all Parties and the Mediator
            4. The Parties agree that they will not record or permit the recording of all or any part of the mediation without the consent of all Parties and the Mediator. The Parties will ensure that each additional attendee at the mediation for which that Party is responsible also acknowledges and agrees to this. 
            5. The Parties and the Mediator acknowledge and agree for all purposes that their communications at the hearing can be and will be listened to by each other. The Parties will ensure that each additional attendee at the hearing for which that Party is responsible also acknowledges and agrees to this.

It will be interesting to see how this issue will evolve in the coming days and weeks. Plaintiffs and defendants have a mutual interest in getting cases resolved sooner rather than later. Mediators have an interest in helping them do just that. Zoom, to date, has proven to be a reliable and robust tool to help everyone achieve these interests. Privacy and confidentiality are integral to the mediation process but proportionality needs to factor in as well. Not every mediation requires “Manhattan Project” level security.

One can only hope that this won’t be another example of “the perfect being the enemy of the good”. For me, aware of these issues, I will continue to offer Zoom mediations.

________________________

To make sure you do not miss out on regular updates from the Kluwer Mediation Blog, please subscribe here.