'Zoom Bombers' Are Still Blasting Private Meetings With Disturbing and Graphic Content

CW: Child abuse, anti-Semitism, racism.

This article was originally published on VICE Germany.

On a Thursday evening in late April, 27-year-old economist Christian dialled into a Zoom meeting for a Berlin think-tank. Around 60 people joined the regular get-together, discussing policy responses to the pandemic.

At 7:40PM, mystery user "Christoph H." burst into the conference. Christian finds it difficult to speak about what he and other participants were forced to watch in the following seconds. "It was just sick," he said. Christoph H. played a video depicting a young girl being raped. Christian estimates she was about four years old.

Shock and silence followed. It took several excruciating seconds for the host of the call to remove "Christoph H.". Afterwards, when the call participants were discussing how to deal with the situation, a different mystery user appeared and broadcast another rape video. The host cancelled the call.

Before the coronavirus pandemic, Zoom had 10 million daily users. By April, it claimed to have 300 million – before backtracking to admit the statistic is really 300 million "meeting participants" per day. Within that number, there are trolls: so-called "Zoom bombers" looking to hijack calls and mess with people. In March, trolls hijacked an Alcoholics Anonymous meeting in New York, with one shouting "Alcohol is so good!" to the assembled group. In April, a group of anti-Semites crashed an online Holocaust memorial service in Berlin, broadcasting images of Adolf Hitler, while another synagogue service in London was hijacked with anti-Semitic remarks. School classes and church services have also been affected the world over. Recordings of these incidents and others end up on YouTube and TikTok. For Zoom bombers, the horrified reactions are digital trophies. But what kind of people aim to collect trophies like that?

VICE Germany spoke to two teenage Zoom bombers and a number of victims. They found out how trolls take advantage of Zoom's weaknesses to attack unprotected calls, celebrate their successes in private forums (including right-wing extremist channels) and how Zoom is failing to act.

Christian received the link to the think-tank meeting by email, but the meeting ID and password were posted on the think-tank's website. Organisers also made the mistake of sharing the link on Twitter three days earlier.

"Before the call, I didn't realise that anyone could share their screen without my authorisation," said Timo*, one of the hosts of the event, who spoke on the condition of anonymity for himself and the think-tank.

The evening of the incident, Timo called the police. A short while later, three officers stood in his flat photographing data from his laptop screen. The Berlin police confirmed to us that they had started an investigation, but have no suspects. It's a similar story for five separate cases the Berlin police are looking into. The federal police authority told VICE that, across Germany, there have been at least 16 cases of Zoom bombings over the past two months that included images of sexual abuse of children.

Solo* says he is only 15, but on his server he's known as "Legendary Destructor" for his exploits. The New Yorker introduced himself with this title when we met him on a Discord server for Zoom bombers. The server admins distribute orders like army officers. Those who serve the troops – by diligently dragging in Zoom codes or planning bombings, for example – move up the ranks. Solo uses a different handle, but we’ve changed his username at his request.

We chatted to Solo over audio notes, and while we couldn't verify his age, he sounded and acted like a teenager. His display picture is Elmo from Sesame Street. How did Solo move up the ranks so fast? "I'm bored during this fucking quarantine," he said, before claiming to execute around 20 Zoom attacks a day.

Solo claimed his Zoom bombings involve harmless memes or music. If true, he's an exception on Discord, where the tone is generally dark. What's striking about the Zoom bomber servers is the level of hatred directed at Black people, Jewish people, the queer community and women. Among other horrific images, we witnessed a meme showing a Black teenager drinking from a brown puddle. While on the server, we were also sent a video that appeared to show a Black woman being lynched by two white men, along with a message saying Black people needed to have "thicker skin". The US fact checker site Snopes could not conclusively say whether that particular video was real or fake. Solo told us he thinks racist insults are stupid, but on his server he surrounds himself with racists.

Racism isn't the only problem on this server, where we found over 172 results with the search term "child porn". Solo said he has been involved in dozens of Zoom bombings where fellow campaigners have shown child abuse images, including during an online school class. He estimated the students on the call were eight or nine years old. He described it as "upsetting".

"I want to ban the horny fucking weirdos and the perverted crazy people from the server," he said. He claims that's difficult to do, with the perpetrators using many different accounts. "A friend of mine managed to grab an IP address from one," he said. Solo said he reported the data to the police, but didn't show us any evidence of him doing so. He did say that he was once sent a Dropbox folder full of images of child sexual abuse on an anonymous chat platform without his consent. "I've seen so much that it doesn't affect me anymore," he admitted.

According to Dr Andreas Baranowski, research associate in the field of sexual psychology and media impact at the University of Giessen in Germany, Zoom bombers want to dehumanise their victims. But he still thinks they can feel guilt: "I am certain that if you sat these trolls across from a traumatised person and showed them how what they did impacted others, the trolls would realise that their actions have consequences."

In the days following the Berlin think-tank call, Christian said he struggled to get the images out of his head. At work, he continued to use Zoom, but got flashbacks whenever someone would start to share their screen.

A Zoom spokeswoman told VICE Germany that the company takes the problem "extremely seriously", and said they were "deeply dismayed to hear of this type of incident". She claimed Zoom had tightened security measures in recent weeks and months, an example being the addition of "waiting rooms" in all conferences, so hosts have to confirm new participants with a click. But Zoom bombers can still fool many hosts into letting them in to calls.

The best protection against Zoom bombing would be to limit who can share their screen on a call – something the company has now added for the free version of Zoom and the cheapest of the paid versions, but not the two business versions.

When you're dealing with 300 million users, there's always someone not paying attention. Zoom bombers use online platforms such as Twitter, Telegram and Discord to find each other and share meeting links.

A simple search on Telegram showed seven groups on the topic, with between 22 and 207 members. Discord servers we observed had several hundred members, and the largest over a thousand. On that particular server, a Twitter bot continuously spits out the access data for unprotected Zoom calls by recording, in real-time, when someone posts the link to a meeting on Twitter. Theoretically, Google can also be scoured in a similar way. Between the 12th and 27th of May, the bot discovered and shared 947 links.

Many users are barely aware that you should never tweet the invitation to a Zoom meeting, even if you only have a handful of followers. Zoom meetings now have a password, but the level of protection is pretty weak: the password is automatically added to the invitation link. The Zoom spokesperson wouldn’t comment on why the company still automatically links passwords and invitation links.

The largest Discord server dedicated to Zoom attacks we found was run by "D.". Zoom bombing has been D.'s main pastime during the pandemic, and he's amassed over 1,100 members in a few weeks. Over audio notes, D. said he simply likes "making fun of Boomers".

D. believes you don't have to post images of abuse to have "fun" with Zoom bombing. "Just make funny noises and turn up the volume," he said. "It's best if people laugh, too." By "funny noises", the teenager said he meant the national anthem of the former Soviet Union, or a song called "[N-word] in my butthole". He wouldn't provide his real name, but said he lives in Europe.

"I would describe myself as an antisocial person," said D. "I don't often talk to others." He said running the server is the most exciting thing that's ever happened to him. A stranger offered him €90 for the admin rights, but he refused. "I'm not leaving the server to someone who doesn't know how to use it," he said.

D. claims to fight the toxic attitudes on his server. "The more people come, the more toxic it gets," he said. His rules include: no violent videos, no pornography, no child sexual abuse, no toxic behaviour. "One user called himself 'butcher of gays'. He created around 50 accounts and I kept blocking him." We could confirm that 371 accounts have been blocked on D.'s Discord server since the beginning of May.

D. spends about four hours a day in his server, listening to music by Eminem, KSI and XXXTentacion. His budgies screech in the background of his voice memos. A friend takes care of the technical side and maintains the Twitter bot, which is constantly looking for unprotected video conferences on the internet. "I don't do all of this alone," he emphasised.

Many Zoom bombers start out on D.'s server with childish pranks. A hijacked conference fills up with noisy teenagers while one draws a dick on his shared screen. Along with dicks, the N-word and swastikas are two of the most popular motifs.

In Germany, it's illegal to show someone pornography without their consent, and that also applies to swastikas. Zoom bombers can also be charged for recording and distributing the footage of bombings, explained lawyer and cyber crime specialist, Jens Ferner.

It's hard to imagine many offenders being caught. The trolls we met during the investigation value anonymity and exchange ideas about ways to disguise their IP addresses. For anyone who falls victim to a Zoom bombing, criminal defence lawyer Mirko Laudon's advice is to immediately shut your window and delete any recording of the meeting, as it could be legally interpreted as "possession" of images of child sexual abuse. But the most helpful defence would be Zoom improving its security flaws.

Timo reported the Berlin think-tank incident to Zoom several times. At the time of publication, he has been waiting a month to hear back.