It was supposed to be an empowering space for Black students at a university where only about 5% of the student body identifies as Black. 

On the evening of Feb. 9, Seattle University senior and Black Student Union President Adilia Watson welcomed a dozen students who had joined a Zoom-based virtual meeting to watch a film clip in honor of Black History Month and to discuss a BSU-led scholarship campaign.

A few minutes into the screening, the Zoom room exploded into chaos.

The screen filled with twice as many participants, unknown hijackers who turned their cameras on and off, shouted racist slurs and profanity, and called the BSU members “monkeys.” They filled the meeting’s chat box with a torrent of offensive name calling and racist remarks.

Watson tried to remove the intruders, but was forced to shut down the meeting.

“It felt like terrorism,” Watson said.

Students attending from their dorm rooms, living rooms and kitchen tables were left staring at blank screens, feeling shattered and wounded, angry and determined to fight back.

The migration of work, school and prayer to online platforms has created a new form of cyber harassment called Zoom bombing, where hijackers disrupt video conferences with racist, anti-Semitic, homophobic or pornographic material. As of late February, the Anti-Defamation League had tracked more than 30 Zoom bombing attacks that disrupted Black History Month events nationwide. 

Since last March, countless incidents have been reported in Washington state by Black student unions, community organizations and public officials, but people targeted say there is almost no recourse for the attacks. While a perpetrator could be charged with computer intrusion, fraud or a hate crime depending on the type of meeting and content used in the attack, tracking down suspects is difficult and a number of cases in the state have gone unresolved.

But for people who have been targets, the incidents leave a lasting psychological impact. That’s why researchers and civil rights organizations say there needs to be more legislation, enforcement and education to prevent the incidents, and for the hijackers to be held accountable.

“Over the last several years there’s been an emboldening of racism, white supremacy and extremism, and that has ripple effects. And that reverberates across social media,” said Lauren Krapf, ADL’s counsel for technology policy and advocacy.

Widespread incidents

After Watson shut down the intruders, the Seattle University students reconvened in a private virtual meeting.

“For a good 10 minutes we were all pretty stunned. We literally didn’t know what to do because it was so crazy,” BSU Vice President Tatianah Summers recalled.

Several BSU members said that while they’ve been the target of the n-word throughout their lives, the virtual attack felt unlike any form of racism they had experienced.

People targeted by cyber attacks are often caught off guard by the behavior, said Monnica Williams, a psychologist supervisor at University of Ottawa who researches race-based stress and trauma.

“Most people wouldn’t behave in the same way in person as they do when they feel like they’re sheltered behind a digital curtain,” Williams said.

A lifetime of microaggression, racism and lack of support could exacerbate the psychological impact of Zoom bombings for people of color, according to her research. “It could be the straw that breaks the camel’s back and could push somebody over into a PTSD reaction,” Williams said.

Black student organizations aren’t the only ones being targeted. In July, intruders took over a virtual event for retailers on COVID-19 policy, hurling racist slurs against Black and Asian people. Then someone screen-shared a video on a loop of a Black woman being hung.

Kent Chamber of Commerce CEO Zenovia Harris said the video still haunts her. The humiliation, shame and devastation that followed “hit like a ton of bricks.”

Zenovia Harris, CEO of the Kent Chamber of Commerce, experienced a racist Zoom bombing in July that rattled her, but it sparked conversations about diversity and equity at the chamber. (Bettina Hansen / The Seattle Times)

As the first Black leader of the chamber in its over 70-year history, Harris wondered if the attack was personally directed at her and feared for her physical safety. It further compounded the racial trauma she experienced in the wake of Breonna Taylor’s killing by Louisville, Kentucky, police earlier that year.

Harris felt responsible as a meeting host, like she had invited people to a party that became violent. For several months, she would say a prayer whenever she let someone into a Zoom room in hopes that it would not be hijacked.

On March 24, a North Thurston Public Schools Black Student Union coalition meeting on self-care and mental health practices was interrupted when a racist slur directed at Black people was shouted and written in the chat box. Classes had been disrupted before, but the coalition’s advisers say this was the first time people were targeted for their race.

“There’s a whole undercurrent of racism that impacts some of these students of color in a visceral, much more personal way,” North Thurston High School BSU adviser Sara Foppiano said.

Foppiano, River Ridge High School BSU adviser Christie Tran, and Timberline High School BSU adviser Alliniece Andino said the initial response by the district’s information technology help desk and law enforcement was disappointing.

“We’re experiencing some sense of trauma, and when we call for help and your initial words are ‘we can’t help you’ versus ‘we can look into that,’ that’s a problem,” Andino said. “That to me was lacking so much humanity.”

Courtney Schrieve, executive director of public relations for the school district, said that the incident “was racist and hurt these kids and staff terribly.” The district’s technology director, who is responsible for the investigation, traced the internet protocol address to a neighboring school district and said that at least one student was involved. Schrieve said that she’s communicating with the other district about addressing the incident since it’s outside of North Thurston’s jurisdiction. 

Tran, who is Vietnamese, and Andino, who is Black, said it’s an extra burden for people of color to explain to school leaders and law enforcement why an incident was racist and should be investigated as a hate crime.

“There definitely needs to be an equity lens applied to all district policies and practices to ensure there is justice that’s not blind to the identities of our students and our staff,” Tran said.

When heavy metal music started blaring during a Bryn Mawr-Skyway virtual town hall last October, host John Taylor knew intruders had taken over. Taylor, the Department of Local Services director for unincorporated King County, said that about a dozen people started shouting offensive words, and one of them continuously wrote a racist slur in the chat box.

The dozen hijackers were evicted from the meeting within a couple of minutes, and Taylor pushed the slurs in the chat box out of sight by posting the lengthy Walt Whitman poem ‘Song of Myself’ in the chat.

After the attack, the department changed municipal meetings to a webinar format. Now participants’ questions are screened by a moderator. While extra precautions have prevented further attacks, Taylor said it has constrained the opportunity for residents to “speak truth to power” when they have complaints.

A King County Sheriff’s Office representative was in the meeting and launched an investigation, but it is currently closed because no witnesses were willing to pursue the case, said sheriff’s spokesperson Sgt. Tim Meyer.

(Jennifer Luxton / The Seattle Times)
(Jennifer Luxton / The Seattle Times)

How does it happen and who is doing it?

New research shows that hijacking meetings has evolved from a prank into a more coordinated movement to disrupt classrooms and communities.

Zoom meeting participants rose from 10 million daily in December 2019 to an average of 300 million in April 2020, according to company reports. As online meeting platforms became essential during the pandemic, researchers from Boston University and Binghamton University developed what they call a “threat model” to look for signs of Zoom bombings being coordinated by people using Twitter and the anonymous user forum 4chan. In analyzing posts, the researchers looked for descriptions of a call for an attack, coordination, delivery and harm.

During the first seven months of 2020, they identified more than 200 requests on these forums for people to join in raiding a class or meeting, the majority instigated by high school and college class members. Because they have legitimate access, protections such as passwords are ineffective. Other attackers have been known white supremacists with ties to extremist-driven and hate groups.

Pardis Emami-Naeini, a postdoctoral scholar in the School of Computer Science at University of Washington, said more needs to be done to track and understand these attacks so new tools and practices can be developed.

“There’s no research asking people [who’ve been Zoom bombed] to tell us about their experiences,” she said.

What’s the response?

Most schools, businesses and the videoconferencing platform providers offer literature and video tutorials about how to protect meetings, and some have implemented updated security measures.

But there are no universal protocols to help people stop a hijacked meeting, report the incident or seek counseling. Many grassroots and nonprofit groups can’t afford full-time IT staff or counseling if a Zoom bombing occurs.

And victims often don’t know where to turn for help. Harris, from the Kent Chamber of Commerce, did not file a police report because she did not think it was significant enough to warrant investigation.

The Seattle Police Department declined an interview regarding its policies, saying only that the department encourages safeguards and asks victims to report incidents.

After a meeting of the Gonzaga University Black Student Union was Zoom bombed Nov. 8, students shared video recordings, meeting data and testimony with campus public safety officers, Spokane police and the FBI.

The case remains open.

At Gonzaga and Seattle University, officials were quick to issue statements condemning the acts via their websites and on social media. Various groups and individuals rallied around BSU members.

Gonzaga BSU President Faith Ngae said while the support is appreciated, she and her classmates want action and accountability.

“I’m tired of hearing, ‘We’re talking about it.’ ‘We want to change.’ ‘We need a strategic plan,’” she said.

The FBI did not comment on whether the agency tracks attacks. Incidents can only be classified and prosecuted as federal hate crimes if proven to involve violence due to bias against protected characteristics such as race, religion or sexual orientation, an FBI spokesperson said.

Violent interference of a person’s federally protected rights, such as disturbance of court or education, could be grounds for legal recourse. When people in a chat room discuss hacking into a Bible study, for instance, they could be held accountable under a federal statute that makes it illegal to conspire against civil rights. Participating in a teleconferencing attack may result in charges including fraud, disruption of a public meeting, or transmitting threatening communications.

It is less clear how the laws would be applied in digital spaces, said Krapf. On the state level, she added, some civil rights laws explicitly apply to online spaces, but not in Washington.

“There’s room for improvement both in the legal protections and in the way that we see and understand online harassment,” she said.

Zoom is facing several lawsuits for a lack of security measures that users say left them vulnerable to cyberattacks. However, in one class action lawsuit against Zoom, U.S. District Judge Lucy Koh said in early March that Zoom was “mostly” protected from liability.

On March 9, the Metropolitan King County Council passed an ordinance that made it illegal to Zoom bomb or record mental health and recovery video teleconferences without the participants’ consent. The ordinance allows people to file civil lawsuits against the violators for mental pain and suffering, as well as attorneys’ fees.

The ordinance does not include criminal repercussions because excessive policing, along with incarceration, “causes more problems than it solves,” said Girmay Zahilay, the Council’s Law and Justice Committee chair.

Resilience

After the Kent Chamber of Commerce hijack, Harris posted an emotional video to Facebook with a pledge to find the silver lining.

“They picked the wrong person on the right day,” Harris said.

Now chamber conferences are monitored by administrators, and the links to rooms are sent to attendees privately. The hacking sparked deep conversations among the chamber members on how to work toward becoming an anti-racist organization.

By December, Harris had spearheaded a permanent diversity, equity and inclusion committee among chamber members. They have hosted a series of events featuring Black business owners, and the committee is conducting a survey on opportunities for businesses of color.

The incidents spurred Black student unions at Seattle and Gonzaga universities as well as North Thurston Public Schools to reemphasize their demands for campuses to be more inclusive and to provide more mental health counselors and resources for Black and historically marginalized students.

As we live our lives more digitally, Krapf said, harassment statutes also need to be updated to ensure that online spaces are protected.

“It’s time we start to think about what happens online as very real, because for victims and targets that have suffered abuse, there is no question that the interference of their digital life interferes with their entire life,” Krapf said.

How to protect your online meeting security and privacy

Before a meeting: 

• Users and hosts should update meeting tools to the latest version to ensure security updates can be enabled. Familiarize yourself with the platform’s security and privacy settings. Require participants to register. 

• Use an encrypted meeting ID and/or a pass code if available. 

• Notify users that the meeting will be recorded and get attendees’ permission to record. This may deter attackers. 

• Share meeting procedures, protocols and a list of safety and security practices with users before the meeting begins. 

• Encourage public safety officials, law enforcement and organizational leaders to seek out cultural competence training on how to respond to a Zoom bombing incident. 

• Designate a co-host to help run the technical side of the meeting. The co-host can scan the list of participants and remove uninvited attendees. Consider using a webinar or broadcast feature for a meeting that lets only the host speak and show materials. 

If a meeting is hijacked: 

• Eject the meeting intruders or shut the meeting down as quickly as possible. 

• Report the incident to authorities, giving them this information: Meeting ID number; available screen recordings, including photos or videos and a description of what was displayed; descriptions of suspects, including their email addresses and screen names; chat logs; participant logs.

• Create a safe, secure space for participants and witnesses to discuss what happened, share their feelings and gather information to report the incident. 

• Offer participants information on mental health resources.

• Seek input from witnesses on how to publicly share details about the situation. 

• Keep witnesses regularly informed of updates on investigations or actions. 

• Use the information gathered in the incident to inform future response practices and update protocols accordingly. 

Sources: Pardis Emami-Naeini, a postdoctoral scholar in the School of Computer Science at University of Washington; Detective Andrew Stager, a digital forensic specialist for the Criminal Investigations Unit for the University Police at Penn State University; Zoom and FBI blogs