Zoom

The day this story really broke (August 7, 2023, a day that will live in minor infamy), Nathan in my office pointed this issue out to me.

"Did you see that Zoom is going to use customer content to train AI?" he asked (this is what passes for casual morning conversation in my office).

My eyebrows went up, mostly because Zoom was being upfront about it, rather than because it was being done at all (because yes, this is the way of the world now).  That said, there are some tricks libraries and educators—and any business that cares about use of personal data—can employ to resist it.

Not surprisingly, this comes down to two simple things: awareness, and language.

We'll use the recent Zoom scenario to illustrate:

I am not sure how awareness of the new clause first broke (I am going outsource that research to Nathan, and if he finds out, he'll put it in a footnote, here[1]).  But it is clear that fairly soon, consumers were unambiguously aware of the privacy and use concerns posed by the "we'll suck you into our AI" Terms of Use.

Here is the language Zoom used[2] (and has since retracted) to announce it would use our conferences, etc. to train AI:

"[You agree Zoom can use your Content] ... for the purpose of product and service development, marketing, analytics, quality assurance, machine learning, artificial intelligence, training, testing, improvement of the Services, Software, or Zoom's other products, services, and software, or any combination thereof..."

This is where language comes in.

As the world soon knew, this "old" language listed "artificial intelligence", as well as "training", (although the Terms' dubious use of commas suggests to me that Zoom could use our Content for not just "training" AI, but humans, too... actually an even more terrifying prospect, from some perspectives).[3]  So yes, lots to be concerned about when it comes to "Customer Content" (which is Zoom’s term for the recordings/data/analytics that come from "Customer Input", which is the raw content you put into Zoom[4]).

 Now let's use our awareness of the current Term of Use (current as of August 24, 2023, at least), and see what the language says:

"10.2 Permitted Uses and Customer License Grant. Zoom will only access, process or use Customer Content for the following reasons (the “Permitted Uses”): (i) consistent with this Agreement and as required to perform our obligations and provide the Services; (ii) in accordance with our Privacy Statement; (iii) as authorized or instructed by you; (iv) as required by Law; or (v) for legal, safety or security purposes, including enforcing our Acceptable Use Guidelines. You grant Zoom a perpetual, worldwide, non-exclusive, royalty-free, sublicensable, and transferable license and all other rights required or necessary for the Permitted Uses."

Although not as stark as the old language, there is still a lot of wiggle room to squeeze a blending of Customer Content with AI there.  What if Zoom is "obligated" to provide a service, and decides to use AI to do it?  What if Zoom decides AI is needed for "enforcing Acceptable Use Guidelines?"  What if Zoom decides that AI is needed for your safety, and that, also for your safety, Customer Content must be used to train that AI?

Of course, right now, the Terms also say (in bold, so you know they mean it[5]):

"Zoom does not use any of your audio, video, chat, screen sharing, attachments or other communications-like Customer Content (such as poll results, whiteboard and reactions) to train Zoom or third-party artificial intelligence models".

So can this assurance be trusted?  This brings us back to language.

Back in the day, of course, computer systems were not "trained" (as one would train a dog, or a small child to use the toilet) but rather, "programmed."

However, even in the (relatively) slow-moving world of the law, this is no longer the case.

Here is an excerpt from a recent case[6] where lawyers were squabbling over how to gather "Electronically Stored Evidence" ("ESI"):

Defendants propose the following method for searching and producing relevant ESI:

1) Narrow the existing universe of approximately 27,000 documents...

2) Undersigned counsel reviews a statistically significant sample of the remaining e-mails at issue and marks them relevant/irrelevant to create a "training set;"

 3) That training set is then used to "train" the eDiscovery vendor's artificial intelligence/predictive coding tool, which "reviews" the remaining e-mails and assigns each a percentage-based score that measures likelihood to be responsive...

So even in the law, computer systems are being "trained", and there is a precise meaning to the term (which in plain[7] terms is "repeatedly using data and parameters to create patterns desired by the user").

So, with all that said, let's look at the member's questions:

Question 1: I am wondering if there are any privacy or FERPA concerns that librarians and educators need to be worried about since Zoom is still used heavily in both library and school worlds.

The short answer is: yes.

Question 2: Should we be looking for alternatives or is this just the way of the world now?

The short answer is: yes.

Here is the reason for my first short answer:  Many contracts have what I call a "we were just kidding" clause that allows the contractor to change their terms at will, and without notice.  Here is the one in the current version of Zoom:

15.2 Other Changes. You agree that Zoom may modify, delete, and make additions to its guides, statements, policies, and notices, with or without notice to you, and for similar guides, statements, policies, and notices applicable to your use of the Services by posting an updated version on the applicable webpage. In most instances, you may subscribe to these webpages using an authorized email in order to receive certain updates to policies and notices.

What does this mean?  Even though they are in bold, Zoom can change its assurance on AI at any time.

The reason for my second short answer is this: Libraries and education institutions have incredible commercial leverage when they work together.  For this reason, libraries and educational institutions should always be using their awareness of data, ethics, use, and privacy issues to demand contract language that meets their expectations.

Those expectations will change from product to product. With a product like Zoom, which can generate audio/video/text/analytics/+, including content that later may be part of a student file (FERPA) or a library record (various) the assurances should be:

• All content entered is property of the customer (library or school);
• At all times, all content entered into the service, or content generated with the use of customer-supplied content, may only be used to provide the current service(s) specifically authorized by the customer;
• Any other use of data (for product improvement, for marketing) must be via a specific opt-in;
• Terms cannot change without notice and terms in effect at the time content was generated will govern such content, regardless of future changes;
• Customers can receive assurance that all data is purged upon request.
• Customers can verify that they can enforce and comply with all their own internal policies and obligations regarding data creation, use, and storage.

In addition, libraries and educational institutions should have a clear set of policies for how they, as the potential owners of recordings and other data associated with the use, will use their ownership and control of the content.  It would be unfortunate, to say the least, for a student to find that their college disciplinary hearing for underage drinking is now available on YouTube.[8]

Many public library groups and academic consortia are already working to develop this type of criteria[9] (which should focus more on isolating aspirations and expectations than on legal wording, since legal wording will vary from state to state). And some institutions are designing their own services[10] in order to avoid contract terms that don't meet their criteria.

At the individual institutional level, this means building assessment of such services, and bargaining time, into the procurement process.  It also means thinking through that institution's own particular ethics and responsibilities and developing internal policies to promote them.

So, while this is the world we live in, libraries and educational institutions are well-situated to make a better one. 

Thanks for an important question.

In the spirit of the season, and the answer I must give, this answer will be a modified version of a scene from Macbeth.

[Cue sounds of wind, rain, and small children trying to line up while thinking about candy and their itchy "Frozen II Elsa" costume.]

ENTER THREE WITCHES

FIRST WITCH: Educator!  I sense thou wouldst put on a show!  And Zoom it to demesnes beyond thy institution!  But if the music is protected by copyright and the school does not have a license to use the music in that manner it will be a violation of the copyright!!!

SECOND WITCH:  And, Educator, know this, as well! The Zoom terms of use state: "Zoom may deny access to the Services to any User who is alleged to infringe another party's copyright!" So be warned, or you be twice-condemned for the foul deed of infringement, by both the copyright's master, and the Powers of Zoom!!!

[Lightning.  Thunder.]

THIRD WITCH:  Ahem.  Of course, you'd have to get caught, first....

[Pause.  The cauldron bubbles.  FIRST WITCH and SECOND WITCH give THIRD WITCH the side-eye.]

THIRD WITCH:  Ahem.  Of course, you'd have to get caught, first....

FIRST WITCH and SECOND WITCH:  Gasp!

THIRD WITCH: What? We're witches!  We have to be sneaky, why do you think we're camped out here in the woods?  And seriously, do you think in the midst of everything happening on Zoom, someone's going to notice?  The world is going so crazy, I'm expecting it to rain toads at any moment!  Give this poor Educator a break.

FIRST WITCH:  Oh, Alecto, you always were a rebel.

Okay, back in the real world...

Sadly, my three witches are right, and this is the answer I have to give.  Since the parade won't be a part of a class, there is no TEACH Act exception, so transmitting the music via Zoom is just like putting it out over a streaming service or live TV: a no-go without permission[1].

That said, I dug around in my cauldron, and I can offer this possible solution:

Round about the copyright go

In the creative solution throw

Songs that "copyleft" be

Can help thee celebrate Halloween

For works freely used and easy got

Search "Copyleft Halloween Songs," and find a lot.

Not very much toil and trouble

"Copyleft" works make music bubble!

Just in case my Shakespearean verse is too obtuse, what I'm saying is: Hop on your favorite search engine and type "copyleft Halloween songs."[2]

What will this do?

For those of you who don't know: "Copyleft"[3] is slang for: "I could own and control this copyright, but I am so cool, I am letting you use it, so long as you let others use it, too."  Meaning: "copyleft" work is free to use, by anyone, so long as whatever you generate using the work is also free to use.[4]

Now, as with all clever solutions, this one calls for thorough planning.  I listened to a few of the songs I found this way; not all of them are, as they say, "safe for work" (or at least safe for school) so check out the songs before you Zoom them out to parents. But since this is music the authors have proudly composed and released for free use by a wide audience, I suspect at least some of it will meet your needs.[5]

[NOTE: I don't know if it would work for your school, but this one by Frannie Comstock is hilariously clever[6] (and mentions lawyers)!  If nothing else, give it a listen just for a fun 5 minutes.  Here is that YouTube link written out: https://www.youtube.com/watch?v=XzvlAuUiM5s]

Happy Halloween!

[1] I am not weighing if this would be a "fair use."  That said, if the Halloween Parade and the music interacted to make a clever statement or unique medley of work, that could be a possibility.  But I've been to my kids' Halloween parades.  They are darling, they are not ground-breaking, incisive commentary on modern theatre.

[2] Don't search "Copyleft Halloween Music" because for some reason (which I am sure many of you information professionals out there know) it just wasn't as fruitful.

[3] Yes, this is similar to Creative Commons, but it is also different.  For more information, visit https://www.copyleft.org/.

[4] This means that if you make a movie out of the Zoom recording of the parade, using a Copyleft song, that recording needs to be Copyleft, too.

[5] Unless "your needs" involved specifically using the soundtrack to "The Nightmare Before Christmas."  In which case, I cannot help you, because Skellington Productions, Inc. owns all those copyrights, and I don't see them going Copyleft anytime soon.

[6] I don't know Fannie Comstock (is that even a real name?  It sounds like a person who makes candy while panning for gold), and I am not receiving any kickback for this endorsement of her ridiculously clever work.  Which makes sense, since there is no charge to use her highly amusing song.

Life is full of surprises.  When I was in third grade, I was surprised to learn that this strange country called “Canada” occupied the upper half of North America.  When I was in fifteen, I was surprised to learn that “brooch” rhymes with “roach.”[1]  And upon researching the answer to this question, I was surprised to learn that Zoom doesn’t have an “exclusive use” clause in their service agreement.[2]

Now, let me be clear, the Zoom “Terms of Use,” most certainly bar simply enabling a “third” party to use a library’s account.  Here is the clause that does that:

You may not offer or enable any third parties to use the Services purchased by You, display on any website or otherwise publish the Services or any Content obtained from a Service (other than Content created by You) or otherwise generate income from the Services or use the Services for the development, production or marketing of a service or product substantially similar to the Services.

In other words, Zoom doesn’t want you to “offer” your account out to another party (even if that party is a legit not-for-profit). 

But the member has asked if they can serve as the “host” of the meeting, mirroring the way their library opens its doors for certain groups and gatherings.  Both functionally and grammatically—and thus legally—this means the library is the one using the service.  It’s like my law firm using our Zoom to host a board meeting for a client, since I need to be there anyway.  Or, perhaps more closely, an educational institution letting a student group use its Zoom, so the student newspaper can soldier on. 

So the stark, simple answer to the member’s question (“Is the library legally allowed to use the library's Zoom subscription to host meetings for these groups as an Outreach Program?”) is “YES.”

That said, being a detail-oriented, pro-risk-management, and liability-averse kind of attorney, I can’t just leave it there.

Physical meetings at your library all must follow some rules.  Some libraries set these rules by policy, others confirm them with both a written policy and a facility use contract. 

These documents ensure that the particular rules at that library will be followed.[3] The same should apply when the library is hosting a Zoom meeting for your community. 

In addition, since the Zoom “Terms of Use”[4] and related agreements impose certain rules, and hold the licensee (your library) responsible for any violations, the conditions for library-hosted meetings should not only require adherence to your rules, but also to Zoom’s.

Zoom’s “Acceptable Use” Policy expressly bars numerous types of activity, including but not limited to:

• Promoting violence.
• Harming children.
• Displays of nudity, violence, pornography, sexually explicit material, or criminal activity.
• Human trafficking.
• Supporting or facilitating terrorism or terrorist organizations
• Any activity that is defamatory, harassing, threatening or abusive.[5]
• Copyright infringement.

I imagine most libraries can endorse these conditions, but some may be (rightly) wary to impose content restrictions on meetings.  While the limits your library has agreed to with Zoom is a contract the library has voluntarily accepted, I can see a (very) few instances where perhaps a first amendment concern could loom.  So any library considering hosting Zoom meetings for users should think that aspect through thoroughly, and be ready to address it just as you address such concerns for physical meetings.

To help a library navigate these straightforward but choppy legal waters—especially the Zoom Terms’ bar on letting a third party use your account—here is a template “Virtual Meeting” Agreement. 

NOTE: As always, template agreements should be reviewed by your library’s legal counsel to ensure they conform with your library’s charter, bylaws, unique identity, and other policies.

Videoconference Meeting Agreement—TEMPLATE ONLY

On the above date and time, the [NAME] library will host a meeting of the above-listed group for the above listed purpose.

It is understood that every attendee of the meaning will be expected to abide by both all the applicable rules of the library for meetings at our facility, and to observe any and all above-listed additional conditions. 

The above-listed “Meeting Facilitator” should be logged in to the meeting at least 10 minutes before so they can discuss the orderly conduct of the meeting with Library Staff. 

The Meeting Facilitator must discuss the functional aspects of the meeting with library staff before the start of the meeting; they should be prepared to discuss how attendees will be able to interact and how the relevant functions of the meeting will be used to meet the meeting's stated purpose.

The Meeting Facilitator should also be comfortable with using Zoom's capabilities to assist the Library Staff in hosting the meeting (monitoring the chat, moderating the discussion, muting or removing participants if needed).

When it is time for the meeting to begin, the library staff hosting the meeting will state:

“Welcome to [MEETING NAME].  Hosting an online meeting with your group is a service the library provides to our community groups without charge.  Just as with hosting meetings in our physical space, the library must enforce rules regarding respect, non-discrimination, and accessibility.  If you have concerns in that regard, please let me know by sending me a private message during the meeting.  And now I’ll turn it over to [NAME] to start the meeting.”

It is expressly understood on behalf of the group that:

• The library is hosting the meeting;
• An employee of the library will initiate the videocall;
• An employee of the library will co-facilitate the technical aspects of the meeting;
• An employee of the library will participate in the meeting as set forth above to ensure the applicable rules and the conditions of this Agreement are fulfilled;
• Participants who do not abide by the library’s rules will be muted or removed from the meeting, in the library’s sole discretion;
• The library can cancel or terminate the meeting, in its sole discretion, at any time.

Please alert the library to any ADA considerations for hosting this meeting.  For meetings with more than 50 participants, the Meeting Facilitator should be ready to discuss accessibility objectives with the Library Staff member.

We welcome your ideas for making our co-hosted meetings better.  Constructive feedback may be sent to [e-mail].

Signed: ___________________________________

                        [library representative]

Acknowledged: __________________________________ on DATE: ______________.

                                    [cardholder]

Unless there is a bylaw, policy, or contract barring staff serving as the meeting host, this is most definitely a service that can be offered even when your library cannot be physically open to the public.  However, at all times, it must be clear that this is the library’s meeting.  Account ID’s, passwords, and hosting capabilities should not be given away.  Co-hosting should never be converted into changing the host.  The meeting “intro-text” should be read every time; it is there to make sure that the library’s primary role is documented in every single meeting you host.  Just like a meeting room should never be used when the library is not staffed, the virtual meeting room must remain in the control of your institution—otherwise, there could be concerns with the license. 

And with that, I wish whoever at your library becomes the “virtual meeting staffer,” a stout heart, a quick finger on the mute button, and lots of community-oriented fun.

[1] I have since been informed that either pronunciation is acceptable.  Fortunately, with my spare fashion sense, it is not a word I use often.

[2] As found May 23, 2020 at https://zoom.us/reasonableusepolicy.

[3] The conditions in these documents will change from library to library.  Some libraries have to enforce the rules of a landlord.  Others will decide to charge a nominal fee (DO NOT do that for a Zoom meeting), or restrict use to a charitable use.

[4] As found on May 23, 2020 at https://zoom.us/terms.

[5] By the time I got to this part of the list, I was thinking “Jeez, it’s an ugly world out there, and Zoom has a front-row seat to it.”