Members of the Plymouth school community were shocked last Monday night when a hacker interrupted a virtual school committee meeting by posting a full-screen, grainy picture of a man engaging in a sex act.
Swastikas appeared in two corners. At the bottom of the screen were the words “HACKED BY CCP JAY.” A computer-generated voice muttered racial slurs.
But it wasn’t the first time a public Plymouth meeting was disrupted by CCP Jay — whoever that is. Or the second, or even the third time.
It turns out that the same person Zoom bombed meetings at least four times before the School Committee session — including twice in October 2024, and again in January and March 2025.
Even after the Aug. 11 School Committee meeting was forced to end abruptly because of the pornographic image on the screen, the same picture appeared during a meeting of the town’s Distinguished Visitors Committee on Aug. 13, according to Select Board chair Kevin Canty, who is also chair of the visitors committee.
What may have been the first episode took place last October during a meeting of town precinct captains at the Moose Lodge in Manomet and then at a Planning Board meeting on the same day, Oct. 9.
A message posted online 25 minutes into the 2-1/2 hour Planning Board meeting read: “An interruption had occurred during the meeting,”
The cyber attacker then appeared to go silent for a while — until January when the person Zoom bombed a subcommittee session of the town’s Advisory & Finance Committee and then disrupted a March meeting of the town’s Agricultural Commission.
It was apparently only then — after a participant in two of the meetings alerted Town Manager Derek Brindisi — that the town took steps to try to prevent further incidents
On Marc 3, Daniel Green, a member of the Agricultural Commission and a former finance committee member, emailed Brindisi, writing, “Hoping you can help me get this message to the right audience.”
“For the second time in a few months I have had a town sponsored meeting ‘hacked’ by the same individual who logs in and displays graphic images on the screen and plays offensive audio,” he wrote.
Green told the Independent that the interruption during the Agricultural Commission meeting was “especially frustrating.”
“The images shown were absolutely disgusting and it took a solid 20 minutes to get the meeting re-assembled and back on track after it happened,” he said in an email. “Everyone’s first reaction was just to immediately ‘x’ out of the Zoom window, as you can imagine.”
Green also contacted Dave Antoine, government services manager for the Local Seen, which streams and records local government meetings. Antoine suggested the town might want to avoid posting meeting log-in information on social media.
Green offered another possible solution: changing the default Zoom settings to restrict screen sharing and mute speakers.
Town spokesperson Casey Kennedy said officials
immediately put in place “enhanced security measures,” including “geographic restrictions” after the town received Green’s March 3 email.
The school department, which has its own Zoom account and information technology personnel, apparently was not made aware of the cyberattacks.
Kennedy said town officials will meet this week to come up with a more comprehensive plan to discourage future Zoom bombings.
One possibility is to turn most public meetings into webinars, rather than open meetings.
With a Zoom webinar, communication is one-way: attendees can participate only through a question-and-answer session or chat, but their video and audio are disabled. Webinars also require pre-registration so town officials could collect contact information or restrict participation.
Canty, who was present at both the precinct captains and the Distinguished Visitors Committee meetings, said running webinars is “more challenging,” in part because some 40 town boards and committees are able to hold virtual meetings.
“You would need to have training,” he said. “We don’t want (meetings) less accessible and less functional for legitimate residents.”
It’s especially tricky since the Massachusetts Open Meeting Law requires governmental meetings be accessible to all.
“It’s a public meeting so we can’t stop people from participating,” said Steve Bolotin, the Planning Board chair and a lawyer, who presided over the session that was cyber-attacked. “There is even a question about the legality of asking for a name or where they live.”
Since the Oct. 9 episode, Bolotin said, the Planning Board has been muting everyone who logs in and requiring them to request to be unmuted if they want to speak.
“It seems to have stopped the attacks for now,” he said.
Scott Caveza, senior staff research engineer at the Maryland-based cyber security company Tenable, said switching to webinars will help, but there other “proactive steps” meeting hosts can take to “reduce the likelihood of a Zoom bombing derailing meetings.”
Some of those steps were the same as the ones proposed by Green to Brindisi in March — and implemented in the fall by Bolotin.
The “most impactful” Caveza said, is restricting screensharing to “host only” in settings.
This prevents the display of unwanted or offensive content, he wrote.
Meeting hosts may also control “unmuting” and the “chat” function so that a participant can only speak with the host.
There are other potential precautions, but some may run afoul of the Open Meeting Law by limiting public participation. Those include “requiring attendees to register with their name and email address to receive the meeting link,” Caveza said. That, he added, can be “a powerful deterrent.”
“This may not stop a persistent Zoom bomber, he said, “but the extra step may demotivate them.”
The Open Meeting Law does allow communities to cut off apparent troublemakers.
The law says people attending a public meeting can speak only with the permission of the chair, who can also silence participants if they find it necessary.
“No person shall disrupt the proceedings,” the law states.
Many Massachusetts communities have reported Zoom bombings in recent months, though the cyberattacks began during the 2020 pandemic, when public meetings moved online and residents were allowed to participate remotely — mostly on Zoom.
Andrea Estes can be reached at andrea@plymouthindependent.org.