Since the COVID-19 pandemic, video conferencing platforms like Zoom and Microsoft Teams have become essential for work, education, and social connections. While these platforms offer controls such as disabling cameras and muting microphones to safeguard user privacy, a new study suggests that video conferencing may not be as secure as many assume.

SMU computer scientists have discovered that even with cameras turned off and virtual backgrounds in use, attackers can actively and covertly probe a user’s physical location by exploiting the two-way audio channels of video conferencing apps.

The mechanism works through “remote acoustic sensing,” allowing an attacker to probe users’ physical surroundings by injecting malicious sounds and analyzing the location-specific audio feedback, or echoes.

In a study published as part of the 2025 IEEE Symposium on Security and Privacy , the research team tested popular apps such as Zoom and found that proposed attacks were able to recognize user’s locations or location contexts with 88% accuracy, whether the user was in the same place multiple times or had never been there before.

“The results raise a severe privacy concern since any video conferencing participant could invade each other’s location privacy easily without malware installation,” said SMU principal investigator Chen Wang, O’Donnell Foundation Endowed Professor of computer science at SMU Lyle School of Engineering.

This type of cybersecurity—known as “sniffing location privacy”—is particularly alarming because there’s very little users can do to secure videoconferencing, Wang said.

“Even a vigilant user who carefully unmutes the microphone only when speaking remains vulnerable: an adversary can exploit the few silent seconds between unmuting and muting, since people naturally leave margins to ensure their speech is fully heard,” he noted. “Furthermore, we find that when a user speaks, echo sounds return with higher energy, because video conferencing systems apply acoustic suppression to silent user ends to eliminate meaningless feedback.”

As a result, the user’s speech effectively amplifies the malicious signal feedback.

Another issue is that the probing sounds can be as short as 100 milliseconds, giving attackers sufficient information before a victim would have time to notice.

Wang and his team are currently working on defense algorithms that can be deployed at the video conferencing server to detect and delete suspicious probing sounds before forwarding audio to participants, along with other ways to defend against an adversary being able to sense our surroundings or “see where we are.”

Why your conference call may not be as secure as you think

SMU researchers identified two types of echo attacks that are noninvasive enough to go unnoticed by the victim: the in-channel echo attack, which uses carefully crafted signals to bypass echo cancellation, and the off-channel echo attack, which hijacks everyday sounds like email notifications to slip past defenses undetected.

These methods could allow a thief or spy, for instance, to learn when you are at home. An adversary can also determine where the user is whenever they meet online, even if the user is using a virtual background.

The research team’s findings are based on six-month experiments at 12 different locations, ranging from homes and offices to vehicles and hotels.

“We all know that video conferencing systems utilize echo cancellation functions to suppress audio feedback and ensure call quality,” Wang said. “However, we find that an adversary can leverage generative AI encoders to counteract such echo cancellation mechanisms and extract stable location embeddings from severely suppressed echo signals, even though they are nearly imperceptible to human listeners.”

Tech giants Meta and TikTok said Tuesday they will obey Australia’s under-16 social media ban but warned the landmark laws could prove difficult to enforce.

Australia will from December 10 force social media platforms such as Facebook, Instagram and TikTok to remove users under the age of 16.

There is keen interest in whether Australia’s sweeping restrictions can work, as regulators around the globe wrestle with the dangers of social media.

Both TikTok and Meta—the parent company of Facebook and Instagram—said the ban would be hard to police, but agreed they would abide by it.

“Put simply, TikTok will comply with the law and meet our legislative obligations,” the firm’s Australia policy lead Ella Woods-Joyce told a Senate hearing on Tuesday.

On paper, the ban is one of the strictest in the world.

But with just over a month until it comes into effect, Australia is scrambling to fill in key questions around enforcement and firms’ obligations.

TikTok warned the “blunt” age ban could have a raft of unintended consequences.

“Experts believe a ban will push younger people into darker corners of the Internet where protections don’t exist,” said Woods-Joyce.

‘Vague’ and ‘rushed’

Meta policy director Mia Garlick said the firm was still solving “numerous challenges”.

It would work to remove hundreds of thousands of users under 16 by the December 10 deadline, she told the hearing.

But identifying and removing those accounts still posed “significant new engineering and age assurance challenges,” she said.

“The goal from our perspective, being compliance with the law, would be to remove those under 16.”

Officials have previously said social media companies will not be required to verify the ages of all users—but must take “reasonable steps” to detect and deactivate underage ones.

Companies found to be flouting the laws face fines of up to Aus$49.5 million (US$32 million).

Tech companies have been united in their criticisms of Australia’s ban, which has been described as “vague,” “problematic,” and “rushed.”

Video streaming site YouTube—which falls under the ban—said this month that Australia’s efforts were well intentioned but poorly thought through.

“The legislation will not only be extremely difficult to enforce, it also does not fulfill its promise of making kids safer online,” local spokeswoman Rachel Lord said.

Australia’s online watchdog recently suggested that messaging service WhatsApp, streaming platform Twitch and gaming site Roblox could also be covered by the ban.

© 2025 AFP

For over a decade, computer scientist Randy Goebel and his colleagues in Japan have been using a tried-and-true method from his field to advance artificial intelligence in the world of law: a yearly competition.

Drawing on example legal cases taken from the Japanese bar exam, contestants must use an AI system that can retrieve statutes relevant to the cases, and, more crucially, make a decision: did the defendants in the cases break the law, or not?

It’s this yes/no answer that AI struggles with the most, says Goebel—and it raises questions of whether AI systems can be ethically and effectively deployed by lawyers, judges and other legal professionals who face giant dockets and narrow time windows to deliver justice.

The contest has provided the foundation for a new paper in which Goebel and his co-authors outline the types of reasoning AI must use to “think” like lawyers and judges, and describe a framework for imbuing large language models (LLMs) with legal reasoning.

The paper is published in the journal Computer Law & Security Review.

“The mandate is to understand legal reasoning, but the passion and the value to society is to improve judicial decision-making,” Goebel says.

The need for these kinds of tools has been especially critical since the Supreme Court of Canada’s Jordan decision, Goebel says. That decision shortened the length of time prosecutors have to bring a case to trial, and it has resulted in cases as severe as sexual assault and fraud being thrown out of court.

“It’s a very good motivation to say, ‘Let’s enable the judicial system to be faster, more effective and more efficient,'” Goebel says.

Making machines ‘think’ like lawyers

The paper highlights three types of reasoning AI tools must possess to think like legal professionals: case-based, rule-based and abductive reasoning.

Some AI systems, such as LLMs, have proven adept at case-based reasoning, which requires legal experts to examine previous court cases and determine how laws were applied in the past to draw parallels to the current case in question.

Rule-based reasoning, which involves applying written laws to unique legal cases, can also be completed to some extent by AI tools.

But where AI tools struggle the most is with abductive reasoning, a type of logical inference that involves stringing together a plausible series of events that could explain, for example, why a defendant is not guilty of a crime. (Did the man with the knife in his hand stab the victim? Or did a gust of wind blow the knife into his hand?)

“Not surprisingly, abductive reasoning can’t be done by modern large language models, because they don’t reason,” Goebel says. “They’re like your friend who has read every page of Encyclopedia Britannica, who has an opinion on everything but knows nothing about how the logic fits together.”

Combined with their tendency to “hallucinate,” or invent “facts” wholesale, generic LLMs applied to the legal field are at best unreliable and, at worst, potentially career-ending for lawyers.

The important challenge for AI scientists is whether they can develop a reasoning framework that works in conjunction with generic LLMs to focus on accuracy and contextual relevance in legal reasoning, Goebel says.

No one-size-fits-all AI tool

When will we have AI tools that can cut the work of lawyers and judges in half? Perhaps not any time soon.

Goebel says a key takeaway from the competition, and one that is also outlined in the paper, is that using computer programs to aid legal decision-making is relatively new, and there is still a lot of work to be done.

Goebel foresees many separate AI tools employed for different types of legal tasks, rather than a single “godlike” LLM.

Claims made by some in the AI industry that humanity is on the cusp of creating an AI tool that can render “perfect” judicial decisions and legal arguments are absurd, Goebel says.

“Every judge I’ve spoken to has acknowledged there is no such thing as perfect judgment,” he says. “The question is really, ‘How do we determine whether the current technologies provide more value than harm?'”