Background:
A webinar hosting platform (WebinarTV.us) is using publicly posted virtual meeting links to find and record meetings and then post them online on the website (and by public, it can be “shared via email only,” but meetings don’t require a password to join). In some cases, these “webinars” are then featured in an AI-hosted podcast with “Phil & Amy.” There are currently some 200,000+ webinar recordings on the site.
A joint IFLS-WVLS adult services meeting was just victim to this. Their experience followed the reported pattern: the host noticed a unusual guest joining the meeting (but since it’s a cross system meeting it’s not unusual to not know every participant), and shortly after the meeting received an email stating, “Your webinar is featured on the Phil & Amy Show.”
The email does give the recipient the ability to remove the recording, and in this case that was done. But if you review the contents of the website, it’s pretty obvious a lot of recordings are posted that people probably would prefer not be in a public forum of that nature and which haven’t been taken down. Fortunately searches for “WVLS/Wisconsin Valley,” “IFLS,” “NWLS/Northern Waters,” “LEANWI,” and other specific search terms didn’t find anything. But the search function on the website is rudimentary.
The best article I have found so far is from CyberAlberta: Zooming Out: WebinarTV’s Rampant Scraping of Online Meetings. I am going to summarize and in cases directly quote from this below as they say it best. Credit to them for investigating and 404 Media and CyberWire Daily podcast (where I learned about it last Wednesday, the same day our staff had their experience) for picking this up.
How does this happen?
Per CyberAlberta, “Initial access is typically gained through third-party browser extensions such as AI-powered transcription or auto-join tools. These extensions are inadvertently provided calendar permissions by their users and, in some cases, users are willfully submitting meeting details to the WebinarTV platform without the knowledge or consent of the organizers…” and ” The platform mostly relies on the widespread use of these tools by end users, rather than operating them directly.”
Users add (or don’t realize they have added) these third-party extensions (plus one that seems to have been developed specifically by WebinarTV) to their browsers. By agreeing to terms of service, this allows these extensions to access a user’s meeting calendar and in many cases automatically join and record meetings for the user. Per CyberAlberta, “[this is corroborated by] recurring reports from webinar organizers who observed unauthorized use of AI-powered transcription and note-taking tools in their affected sessions.”
It also appears that a if the browser plugin has an “autojoin” feature, human participant doesn’t need to join the meeting for the bot to self-join and record the meeting.
- Recording occurs without active consent of the meeting host or other participants.
-
The recordings are “scraping,” not the built-in meeting recording function that the host controls. So even if the meeting is not being recorded, the scraping bot will still screen capture.
What to do
For Zoom/online meeting organizers and meeting hosts:
- Consider options for using authentication settings to restrict access to meetings or require passcodes to enter meetings (example, in Zoom, turn off “Embed passcode in invite link for one-click join” and/or turn on “Only authenticated meeting participants and webinar attendees can join meetings and webinars” in Settings > Meeting > Security)
- Block webinartv[.]us and meetingtv[.]us domains from accessing meetings.
- Consider requiring advance registration and pre-approval of attendees.
- If you have a meeting with a set number of attendees, once everybody has joined lock the meeting to prevent additional unwanted attendees.
- Be aware of any unknown meeting participants. If you are hosting a large webinar with many attendees, it’s advised to have a partner who can review the participant list.
-
Make an announcement before and at the beginning of meetings that AI recordings are not allowed.
For online meeting attendees:
- Review your browser’s extension and add-on list and remove or disable and unknown or any unwanted extensions. This is similar to the concerns with browser hijacking which was causing a eruption of malware on Chrome browsers earlier this year.
- When you join a Zoom meeting that doesn’t require a passcode, be sure your screen name clearly identifies you. Use of a camera (and/or microphone) where appropriate also demonstrates that you are a human participant.
- Report any unknown meeting attendees/AI recorder guests to the meeting host.
Further reading
CyberAlberta: Zooming Out: WebinarTV’s Rampant Scraping of Online Meetings
IT@Cornell, Cornell University: Block Unwanted Recording Services from Zoom Meetings