EU “chat control” proposal to break message encryption postponed

A vote on bringing into law a controversial proposal aimed at preventing child sexual abuse material has been postponed by the Council of the European Union. Privacy experts are celebrating that the law has failed to pass yet again since it was first proposed in 2022

Why the proposed law is so controversial

Although presented as a means to prevent children from being harmed, the proposed law would be a privacy nightmare for anyone who communicates online. It would require online messaging services to implement an upload moderation system to scan the contents of messages, such as links, images, and videos. User consent would be required to scan the messages, but if you disagree, images and links wouldn’t be shared.

The Verge has pointed out how the proposed law confusingly seems to both endorse and reject end-to-end encryption. While pointing out how encryption is paramount to a person’s digital rights, it also goes on to say that encrypted messaging services may “inadvertently become secure zones where child sexual abuse material can be shared or disseminated.”

This suggests that messages would be scanned before messaging apps encrypt them. This was not taken well by digital privacy advocates, with Signal president stating:

“the new EU chat controls proposal for mass scanning is the same old surveillance with new branding.

Whether you call it a backdoor, a front door, or “upload moderation” it undermines encryption & creates significant vulnerabilities”

Dozens of digital rights advocacy organizations, including Electronic Frontier Foundation (EFF) and The Tor Project, signed a statement condemning the proposal. The statement points out that the proposal would likely do more harm than good, potentially:

• Risking adolescents’ consensual sexual self-expression

• Threatening anyone who needs secure and private online communications, including journalists, human rights defenders, doctors, lawyers, LGTQI+ people, and more

• Harming innocent people

What’s next?

Although the law has failed to be passed by the Belgian-led EU Council, it is likely to be addressed again in the coming EU Council led by Hungary. Privacy experts, including EFF, believe that the proposal should be dropped entirely in favor of strategies that respect people’s right to privacy and security. 

Organizations who signed the joint statement opposing the proposal have urged The Council and European Parliament to demand that the Council withdraw the draft entirely. They point to alternative methods of preventing the spread and creation of child sexual abuse material, such as:

  • Working with a variety of children’s rights groups, digital human rights advocates, and cybersecurity experts create new technical and non-technical solutions that are lawful and technically feasible
  • Investing resources and raising awareness of national child protection hotlines, boosting their capacity to support victims and survivors
  • Focus on primary prevention, such as investing in prevention programs for potential offenders or re-offenders, making police and judicial systems more child-friendly, and other societal measures to help stop abuse before it happens.
Share on Twitter, Facebook, Google+