Zoombombing and Incident Guidance

Owned by Beth Woods (Unlicensed)
Last updated: Dec 18, 2020 by Debbie Tonks

Overview

Franklin OIT is a central point of contact to assist Franklin College faculty and staff reporting Zoombombings and other Zoom incidents. "Zoombombings" are intentional disruptions of Zoom Meetings, often involving the use of hateful or pornographic imagery and language through participant video, participant audio, whiteboard/annotation tools, chat tool, and screen sharing. Disruptors often access meetings by obtaining publicly shared Zoom Meeting links shared on public forums, listservs, social media, and websites. Other types of Zoom incidents that Franklin OIT can assist with may include matters for referral to Academic Honesty, UGA EOO, and UGA Human Resources.

What to do if a Zoombombing occurs

  1. Click on the Security button and select Suspend Participant Activities (shown to the right). This will:
    1. Lock the meeting
    2. Mute all video and audio (including hosts)
    3. Stop screen sharing
    4. Disable the chat tool
    5. End all breakout rooms
    6. Pause recording

  2. Unmute your audio to:
    1. Acknowledge what is happening for your participants (they will not be able to respond)
    2. Reassure participants that the incident will be reported
    3. Provide an update on what you are doing to take action (e.g., removing disruptive participants or rescheduling the meeting)

  3. After the incident, consider discussing the events that took place with participants to process what happened together and connect them with appropriate campus resources if they have been affected (e.g., Student Care and Outreach, University Health Center, Human Resources)

If you decide to move forward with your meeting after removing participants, consider leaving the following security features in place as you begin re-enabling participant settings that were suspended:

  1. Lock Meeting - enabled (prevents removed participants from re-entering)
  2. Enable Waiting Room - enabled 
  3. Hide Profile Pictures - enabled
  4. Share Screen - disabled
  5. Rename Themselves - disabled

Reporting a Zoombombing or other Zoom Incidents

Please contact the Franklin OIT Help Desk and provide the following information as soon as possible:

  • Information about the type of event (e.g., Zoombombing, academic honesty concern, HR/EOO concern)
  • Host MyID
  • Zoom Meeting ID
  • Date/Time of the Zoom Meeting
  • Optional: Any details you may wish to note for the review process (e.g., estimated time of the event, disruptive participant names)

Contact methods:

Franklin OIT’s process for responding to Zoombombings

Once reported, tickets will be escalated to the Franklin OIT leadership team, who are responsible for analyzing and reporting findings to the meeting hosts and appropriate units. Before beginning any work, our office will download and secure any data relevant to the incident, and we will work in partnership with you, walking you through the process, answering any questions, reviewing the preliminary findings together, and providing the final report to you and the relevant campus groups.

To summarize our process, Franklin OIT will:

  • Confirm receipt of the reported incident via our Help Desk Ticketing system
  • Assign tickets about reported incidents to the Franklin OIT Leadership Team for assistance and follow-up
  • Download available meeting data, recordings, and chat log from Zoom for analysis
  • Report the incident to appropriate units (e.g., UGA EOO, UGA Police, and EITS InfoSec) or indicate that a referral will be recommended once the report is finalized (e.g., Academic Honesty)
  • Analyze the data using available tools and resources
  • Develop a preliminary report for review with meeting host(s)
  • Provide a final report and relevant meeting data/files to the meeting host(s) and appropriate units (e.g., Academic Honesty, UGA EOO, UGA Human Resources, UGA Police, and EITS InfoSec)

Preventative Measures for Future Zoom Events