UNIVERSITY PARK, Pa. — Penn State University Police and Public Safety (UPPS) continues to investigate a number of Zoom-bombings that have occurred over the past year, some of which have been racially motivated and targeted underrepresented groups on campus. Recognizing the ongoing concern among Penn State community members regarding these incidents, Detective Andrew Stager, a digital forensic specialist for the Criminal Investigations Unit who has served UPPS for six years, recently answered key questions related to the incidents.
What should I do if I am a victim of or witness to a Zoom-bombing?
First, always record your meetings from the start (with permission of participants) and report any activity directly to University Police. This measure allows meeting hosts to preserve crucial evidence should a Zoom-bombing occur during the session.
If you are the host or co-host of a Zoom meeting that is disrupted, you should report it to University Police immediately and provide the following information:
-
Meeting ID number;
-
Available screen recordings, including photos or videos taken by witnesses with cellphones/screen captures;
-
Any available descriptions of suspects, including email address and screennames provided;
-
If video or photos are shown, a description of what was displayed;
-
Chat logs;
-
Participant logs; and
-
Any other information you believe is relevant.
Zoom-bombings can be reported by calling 814-863-1111, regardless of your campus location, or online through our Report a Crime form.
Our department also offers Victim Services to those who have been victimized. The University also offers support through Counseling and Psychological Services (CAPS), Student Affairs and the Office of Educational Equity.
What is the latest information on the most recent Zoom-bombings that occurred to several online events at Penn State?
When police receive a report of a Zoom-bombing, the incident is assigned to our Criminal Investigations Unit. Investigators immediately begin reviewing the evidence that meeting hosts and other witnesses are able to preserve. Investigators also consult with Penn State’s Office of Information Security (OIS) for assistance to gather additional evidence that could help identify suspects.
University Police along with OIS do their best to comb through any potential evidence and track down any known leads that may point to a possible perpetrator.
Photo and video documentation can aid an investigation, so we are grateful when that type of evidence is provided to us. Unfortunately, this has become a rather sophisticated activity and most perpetrators are using fake screennames and email addresses and take other steps to shield their identities. The suspect could actually be located anywhere in the world.
In the most recent cases, as in other instances, all of these steps have been taken. Police also need to obtain court orders and search warrants that are issued to the virtual meeting service provider (Zoom) and internet and email providers in order for them to provide us with any evidence that is connected to suspects. Without compromising our investigation, I can tell you that right now, no evidence suggests these were Penn State individuals; however, the investigation continues.
Why did the attackers target Penn State?
This is actually happening at businesses and universities across the country. During the COVID-19 pandemic, students and professionals around the world began to use virtual meeting tools more frequently to learn and conduct business. Criminals and other individuals with ill intent have taken advantage of this trend and also of unsuspecting meeting attendees. At times, these events are coordinated by large groups through various websites and sources. So advertising your meeting link is actually one way these perpetrators can learn of specific events for specific groups. These are very deliberate and technologically camouflaged attacks by people who are skilled in using various technologies to shield their identities.
The incidents are also not unique to Zoom. Similar incidents have been reported using other tools such as Google Meet.
What can students and employees do to keep their meeting safe?
Students and employees should continue to follow the meeting safety guidelines outlined by the University.
We hope to apprehend the responsible parties, but the reality is everyone will need to be diligent with Zoom, and if or when an incident occurs, report it to police.
Is there anything else you wish to share?
It’s important to note that even when we are not able to identify a suspect, with each investigation we learn valuable information in terms of techniques and processes along the way. That learning is vital because it enables us to adapt our approaches to investigating and implementing additional safeguards.
University Police understands the importance to our community in finding those responsible, which is why we follow any available technological leads to obtain forensic evidence that may connect a suspect to the event. It’s a lengthy process, but these are criminal acts for which we want to hold the responsible party accountable.