AT A GLANCE
Blocking a meeting bot only addresses part of the recording risk. Phones, watches, wearables and meeting-room equipment belong in the assessment too. Research demonstrations involving compromised smart TVs showed why a dark screen is not a security control. Establish approved tools, clear recording rules, access and retention controls, and responsibility for checking AI notes. Staff, visitors and external meeting hosts all need practical guidance.
In TOP STORIES #175, I warned that controlling meeting bots was only part of the problem. CIO’s latest report extends that warning to phones, watches and wearables, and consider the television on the boardroom wall..... supposedly just a display..... well maybe not......
In their September investigation, Gamers Nexus and Level1Techs demonstrated how compromised LG smart TVs could capture room conversations and conference-call audio. One demonstration captured room audio while the screen appeared off.
LG denies continuous recording during normal operation and says voice processing requires activation. The security demonstrations involved equipment the researchers had taken control of.
The business lesson..... equipment you consider passive may contain microphones, software and network connections. Your confidentiality assessment must include the room itself, including home offices, customer premises and hotel meeting rooms.
AI notetakers have real value. BUT..... telling people “please do not record” cannot substitute for practical policies, controls and training.
Management, staff, customers, service providers, contractors and visitors must understand the rules..... including for devices THEY bring.
Those rules need to cover:
Approved tools and devices. Review security, cloud storage, access, model-training terms and personal accounts. Include meeting-room equipment.
Recording boundaries. Define disclosure, permission, objections, sensitive discussions and agreed exceptions. Cover live transcription and AI summaries too.
External parties. Explain expectations through invitations, visitor information and relevant customer and supplier agreements. Guide staff attending meetings elsewhere.
Records and sharing. Control access, distribution, retention and deletion, including provider-held copies
and legal preservation requirements.
Accuracy and responsibility. Assign someone to check important notes, decisions and actions before use. Microsoft warns that AI meeting content can be inaccurate or incomplete.
Then audit TVs, remotes, webcams and voice assistants alongside laptops. Check microphones, disable unnecessary voice features, install security updates and restrict network access. Train staff to challenge unexpected recording and report concerns.
For South African businesses, address POPIA’s requirements around lawful processing, notification, security, retention and transfers abroad. Involve your legal and privacy advisers.
A dark screen is not a security control..... and a policy nobody understands will not protect the conversation.
THE SOURCE / FURTHER READING
Want the full feature?
You’ve read the TOP STORIES interpretation. Continue to the publisher for the source feature or detailed guidance.
Read the original feature at CIO (opens a new tab)