W3C has a Zoom account and W3C Groups may use those with assistance from the W3C Team (for Community Groups, see the separate Tools and Infrastructure). We are aware of questions about Zoom's security and privacy practices and recommend mitigations and usage guidelines.
W3C's groups typically meet weekly and therefore schedule recurring meetings for the duration of their charters. The Zoom scheduler limits how far into the future a recurring meeting may be scheduled. However, you can extend the end date after some time has passed.
We have found that recurring meetings can be used at any time and are not limited to the scheduled period. Thus, ad-hoc sessions and regular meetings that are scheduled for different times to use the same meeting number/URI.
To avoid interference from non-invitees, meeting coordinates should not be posted publicly. The meeting information, including password, should be posted to a Member-only mailing list and only the URI of the list archive message used in public meeting agendas or other public group pages.
W3C Team account owners should set account default settings as follows:
These settings will allow the group to meet even if the Team Host is not present. If an actual Host is required, the Team Host can join the call momentarily and assign co-Host privileges to one or more of the other attendees.
Zoom offers a test meeting service for anyone to use to test their connection. You should use it to hear how your own audio is working. This service may only work for Internet (not phone) connections. See also Zoom's article on testing.
Zoom provides the ability to make recordings. If this feature is used, it must be with the consent of the meeting participants. Chairs have the responsibility to ensure that participants are aware that they are being recorded whenever this feature is used. Recordings are made available after the end (could take a few hours) using an email notification to the meeting host, and can only be shared by default to individuals with a W3C Zoom account. We're looking into providing additional recommendations to make those videos available through other means.
Check also the special guidance on automated meeting transcripts.
Participants sometimes wander off and forget to disconnect at the end of a meeting. To avoid later embarrassment it is recommended that someone with Host privileges explicitly end each Zoom meeting once it has adjourned.
The standard precautions apply for meeting participants to mute your audio except when you mean to talk to the meeting to avoid interference and accidentally sharing private communications (e.g. yelling at your pets), and also to pay attention to what is visible in your video feed.
Besides the suggested settings for the W3C team accounts, we understand that concerns have been raised regarding the security/privacy of the Zoom clients. Several of the issues reported were based on native application hacks with computers already infected (such as modifying the installation script). The best and most cost-effective way to prevent those issues is to use the Web application for Zoom but it is more CPU intensive. Using an alternative device helps in isolating the native applications or the impact on CPU usage from the Web application. It's the perfect opportunity to repurpose an old device.
This section provides links to the Zoom documentation.
Feedback is to @w3c/guidebook and is welcome on GitHub