{"id":22728,"date":"2023-08-17T10:31:31","date_gmt":"2023-08-17T18:31:31","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2023\/08\/17\/news-16458\/"},"modified":"2023-08-17T10:31:31","modified_gmt":"2023-08-17T18:31:31","slug":"news-16458","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2023\/08\/17\/news-16458\/","title":{"rendered":"Zoom goes for a blatant genAI data grab; enterprises, beware (updated)"},"content":{"rendered":"

<\/p>\n

Credit to Author: eschuman@thecontentfirm.com| Date: Thu, 17 Aug 2023 07:06:00 -0700<\/strong><\/p>\n

When Zoom amended its terms of service earlier this month \u2014 a bid to make executives comfortable that it wouldn\u2019t use Zoom data to train generative AI models \u2014 it quickly stirred up a hornet’s nest. So the company \u201crevised\u201d the terms of service, and left in place ways it can still get full access to user data.<\/p>\n

Computerworld<\/em> repeatedly reached out to Zoom without success to clarify what the changes really mean.<\/p>\n

Editor’s note: Shortly after this column was published, Zoom again changed its terms and conditions. We\u2019ve added an update<\/a> to the end of the story covering the latest changes.<\/em><\/p>\n

Before I delve into the legalese \u2014 and Zoom\u2019s weasel words to falsely suggest it was not doing what it obviously\u00a0was\u00a0<\/i>doing \u2014 let me raise a more critical question: Is there anyone in the video-call business not <\/i>doing this? Microsoft? Google? Those are two firms that never met a dataset that they didn\u2019t love.<\/p>\n

One of the big problems with generative AI training is that gen AI cannot be predicted. It’s prone to “hallucinations” and despite the widely-held belief that it will get better and more accurate via various updates over time, the opposite has happened<\/a>. OpenAI’s\u00a0ChatGPT accuracy has plummeted<\/a> in the most recent release.<\/p>\n

Once data goes in, there\u2019s no telling where it will come out. Amazon learned that lesson earlier this year when it noticed\u00a0ChatGPT revealing sensitive internal Amazon data in answers<\/a>. Amazon engineers were testing ChatGPT by feeding it internal data and asking it to analyze that data. It analyzed it all right, then learned from it \u2014 and then felt free to share what it learned with everyone everywhere.<\/p>\n

With that scenario in mind, consider the typical Zoom call. Enterprises use it for internal meetings where the most sensitive plans and problems are discussed in detail. Physicians use it for patient discussions.\u00a0<\/p>\n

This is what Zoom says in its revised terms of service:<\/p>\n

“Customer Content does not include any telemetry data, product usage data, diagnostic data, and similar content or data that Zoom collects or generates in connection with your or your End Users\u2019 use of the Services or Software. As between you and Zoom, all right, title, and interest in and to Service Generated Data, and all Proprietary Rights therein, belong to and are retained solely by Zoom. You agree that Zoom compiles and may compile Service Generated Data based on Customer Content and use of the Services and Software. You consent to Zoom\u2019s access, use, collection, creation, modification, distribution, processing, sharing, maintenance, and storage of Service Generated Data for any purpose, to the extent and in the manner permitted under applicable Law, including for the purpose of product and service development, marketing, analytics, quality assurance, machine learning or artificial intelligence (including for the purposes of training and tuning of algorithms and models), training, testing, improvement of the Services, Software, or Zoom\u2019s other products, services, and software, or any combination thereof, and as otherwise provided in this Agreement.\u201d<\/em><\/p>\n

Unless I missed it, the Zoom lawyers apparently forgot to include the full rights to your firstborn. (They\u2019ll get to it.) They then added that:<\/p>\n

\u201cZoom may redistribute, publish, import, access, use, store, transmit, review, disclose, preserve, extract, modify, reproduce, share, use, display, copy, distribute, translate, transcribe, create derivative works, and process Customer Content: You agree to grant and hereby grant Zoom a perpetual, worldwide, non-exclusive, royalty-free, sublicensable, and transferable license and all other rights required or necessary to redistribute, publish, import, access, use, store, transmit, review, disclose, preserve, extract, modify, reproduce, share, use, display, copy, distribute, translate, transcribe, create derivative works, and process Customer Content and to perform all acts with respect to the Customer Content as may be necessary for Zoom to provide the Services to you, including to support the Services; (ii) for the purpose of product and service development, marketing, analytics, quality assurance, machine learning, artificial intelligence, training, testing, improvement of the Services, Software, or Zoom\u2019s other products, services, and software, or any combination thereof; and (iii) for any other purpose relating to any use or other act permitted in accordance with Section 10.3.\u201d<\/em><\/p>\n

OK. And then for laughs, they typed in: \u201cNotwithstanding the above, Zoom will not use audio, video or chat Customer Content to train our artificial intelligence models without your consent.\u201d Really? Had they deleted the earlier words, then maybe this would be legitimate.\u00a0<\/p>\n

There are two loopholes here. \u201cWithout your consent.\u201d Based on all of the above, such consent is granted by merely using the product. I repeatedly asked Zoom to point out where on the site (or in the app) users could go to withdraw consent for any AI training. No answer. They do offer such consent withdrawal for a few highly limited services, such as summarizing meeting notes. But overall? Not so much.<\/p>\n

The consent mechanism of using the product is particularly troublesome for non-customers. Let\u2019s say an enterprise pays for and hosts a call and then invites customers, some contractors and other partners to participate in the meeting. Do those guests understand that anything they say might be fed to generative AI? Other than refusing to attend, how is a guest supposed to decline consent?\u00a0<\/p>\n

The other loophole involves the word \u201ccontent.\u201d As Zoom describes it, there is a lot of metadata and other information it gathers that it does not strictly consider content. Zoom discussed this in a blog post<\/a>: \u201cThere is certain information about how our customers in the aggregate use our product \u2014 telemetry, diagnostic data, etc. This is commonly known as service generated data. We wanted to be transparent that we consider this to be our data.\u201d<\/p>\n

The pushback on this data-grab may be pointless. Zoom isn\u2019t backing off and until rivals take an explicit stance about this kind of generative AI training, this will happen again and again.\u00a0<\/p>\n

Kathleen Mullin, a veteran CISO (including Tampa International Airport and Cancer Treatment Centers of America) who now performs fractional CISO work, said she doubts Microsoft would do the same thing Zoom is trying.\u00a0<\/p>\n

Microsoft \u201cis the originator of a lot of LLM anyway, so I don\u2019t know that they need the data from Teams,\u201d Mullin said. That\u2019s a fair point, but many enterprises have historically never let \u201cwe don\u2019t need that data\u201d from stopping them from using some data.\u00a0<\/p>\n

Scott Castle, who served for four years as the chief strategy officer with AI firm Sisense before leaving that company in July, said he found the Zoom efforts discomforting. \u00a0\u201cCIOs are not paying that much attention\u201d to how the data from partners can be used, he said. \u201cThey are just trying to get a couple of years ahead of the market.<\/p>\n

\u201cThe problem here is that it is the user who created the underlying data and Zoom is saying, \u2018If you use (our service), we want a piece of that action.\u2019 It\u2019s overreach in a way that tries to cut off the conversation [about] who the value creator is: \u2018You still own your content but we own everything\u00a0about<\/i> your content.\u2019 I think it is trying to partition stuff into yours and mine in a way that is deeply ingenuous. \u2018You nominally own the valueless thing you created, but I own everything else, including the pixels and all of the intrinsic information in that image.\u2019<\/p>\n

“And what if Zoom later goes out of business? Where does that data go?\u201d<\/p>\n

Data analytics expert Pam Baker \u2014 author of Data Divination: Big Data Strategies<\/a>\u00a0\u2014 saw the Zoom move as potentially even more dangerous.<\/p>\n

“Zoom’s new AI scraping policy \u2014 with no way to opt out \u2014 is a symptom of a much larger problem,” Baker said. “We are seeing the most expansive data harvesting effort ever, all in the name of training AI on every moment, every aspect, every thought and action, and every idea that people have \u2014 not to mention the harvesting of intellectual property, copyrighted works and proprietary information. This is what movements like Responsible AI are supposed to stop, but if laws aren’t enacted fast to prevent the reaping, privacy will already be dead.”<\/p>\n

Update, Aug. 17, 2023: <\/strong>For the third \u2014 and potentially fourth \u2014 time recently, Zoom has updated its terms and conditions<\/a>. The most recent time (as of this writing) was shortly after this column was published. Finally, Zoom seems to have gotten it right and has seemingly abandoned its effort to use customer information in any way to train generative AI models.<\/p>\n

It\u2019s not great that it took them multiple attempts to get it right, but they ultimately seem to have done so. What is odd is that Zoom repeatedly reached out to media when it removed a tiny slice of data from its genAI effort. But when it actually did the right thing, it was quiet. No media outreach, no news release. When Computerworld<\/em> asked for an interview to clarify all of this, Zoom did not opt to make anyone available.<\/p>\n

http:\/\/www.computerworld.com\/category\/security\/index.rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/p>\n

Credit to Author: eschuman@thecontentfirm.com| Date: Thu, 17 Aug 2023 07:06:00 -0700<\/strong><\/p>\n

\n
\n

When Zoom amended its terms of service earlier this month \u2014 a bid to make executives comfortable that it wouldn\u2019t use Zoom data to train generative AI models \u2014 it quickly stirred up a hornet’s nest. So the company \u201crevised\u201d the terms of service, and left in place ways it can still get full access to user data.<\/p>\n

Computerworld<\/em> repeatedly reached out to Zoom without success to clarify what the changes really mean.<\/p>\n

Editor’s note: Shortly after this column was published, Zoom again changed its terms and conditions. We\u2019ve added an update<\/a> to the end of the story covering the latest changes.<\/em><\/p>\n

Before I delve into the legalese \u2014 and Zoom\u2019s weasel words to falsely suggest it was not doing what it obviously\u00a0was\u00a0<\/i>doing \u2014 let me raise a more critical question: Is there anyone in the video-call business not <\/i>doing this? Microsoft? Google? Those are two firms that never met a dataset that they didn\u2019t love.<\/p>\n

To read this article in full, please click here<\/a><\/p>\n<\/section>\n<\/article>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[11062,10643],"tags":[14535,11063,29835,25882,27064],"class_list":["post-22728","post","type-post","status-publish","format-standard","hentry","category-computerworld","category-independent","tag-analytics","tag-data-privacy","tag-generative-ai","tag-videoconferencing","tag-zoom-video-communications"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/22728","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=22728"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/22728\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=22728"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=22728"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=22728"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}