Zoom apologizes for routing some calls made in N. America through China, says it “mistakenly” allowed Chinese data centers to accept calls due to traffic spike
Hours after security researchers at Citizen Lab reported that some Zoom calls were routed through China …
Context & Ripple Effects
Citizen Lab's disclosure put two problems on the table at once: some North American calls were being carried through Chinese data centers because Zoom 'mistakenly' allowed them to absorb overflow traffic during the pandemic spike, and researchers found Zoom sometimes uses encryption keys issued by servers in China alongside a flawed encryption scheme — making it, in their words, unsuited for secrets. The apology is Zoom trying to contain the first problem while the second keeps burning.
What makes this more than a bad news cycle is how quickly it compounds: within days Zoom promised paying customers control over which data center regions serve their calls, by August it had pulled direct consumer sales out of mainland China entirely, and by December the routing-and-China questions had drawn a formal SEC and US attorney investigation.
First-order effects
- Paying customers get a concrete fix on a short timeline: starting April 18 they can opt in or out of specific data center regions, directly answering the routing exposure Citizen Lab documented.
- Zoom's enterprise and government-adjacent buyers now have documented evidence that call metadata and keys could touch Chinese infrastructure, forcing security reviews at exactly the moment usage is peaking.
Second-order effects
- The mainland China retreat — ending direct consumer sales in favor of third-party partners — shows Zoom trading market access for a cleaner compliance story as privacy scrutiny mounts.
- Every competitor selling videoconferencing into regulated accounts now has to answer the same data-residency question, turning 'where are your keys and calls processed' from a footnote into a procurement gate.
Third-order effects
- If the pattern holds, cross-border traffic overflow becomes untenable for US-facing services: capacity planning will have to assume geographic firewalls around call routing, raising costs but matching what regulators and investigators like the SEC probe now demand.
- The episode accelerates a structural split in which a company's China operations and its Western enterprise business must run on separate infrastructure, partners, and even product lines — balkanization imposed less by Beijing than by Washington-side scrutiny.
The trend: Pandemic-driven adoption of collaboration tools is colliding with geopolitical scrutiny of cross-border data flows, pushing vendors toward regionally fenced infrastructure and audited data handling.