Stop the EU’s Plan to Read Every Message

Chat Control is the nickname for a set of EU proposals that would require or permit messaging services to scan the content of your private communications, your messages, photos and links, searching for child sexual abuse material and signs of grooming. That sounds narrow, but it is not. To scan messages that are end-to-end encrypted, the scanning has to happen on your own device, before your message is encrypted and sent. That is called client-side scanning, and it means the confidential channel between you and the person you are talking to is no longer confidential. Software on your phone inspects what you write and reports it. The reach also goes past the EU’s borders: the services it targets are global, and scanning a conversation scans everyone in it, including whoever is on the other end outside Europe. There are two versions on the table, and they are not the same thing. Chat Control 1.0 is already law. Chat Control 2.0 is still being fought over. Which one wins decides how far the scanning goes.

Encryption protects everyone’s data: your bank details, medical records, work, family photos, and your own government’s communications. End-to-end encryption means only you and the person you are talking to can read a message, not the platform, a hacker, or a hostile state. Client-side scanning breaks that promise at the source. Once your device is required to inspect your messages and flag them, a backdoor exists. And a backdoor does not check ID. What is built to look for illegal images can be repurposed, expanded, or exploited by anyone who gains access: criminals, foreign intelligence services, or a future government with a longer list of things to look for.

The industry is already reacting. Signal and other secure messengers have said they would leave the EU rather than compromise their encryption. The engineers who build these systems are telling lawmakers the same thing every independent cryptographer does: you cannot weaken encryption for one purpose without weakening it for all. The threat keeps coming back. Whenever the negotiations stall, member-state governments push to put mandatory detection, and client-side scanning with it, back on the table. The last round of talks collapsed because governments would not give up suspicionless scanning. The encryption exemption won in July is narrow and can be reversed in the next round.

The premise of Chat Control is that the private messages of hundreds of millions of law-abiding people should be searched, continuously, on the chance that a few contain something illegal. That is the definition of mass surveillance, and it is exactly the kind of suspicionless, general search that free societies have always refused to allow in the physical world. It also fails on its own terms. Automated detection floods investigators with false positives:

The Swiss Federal Police found that up to 80 percent of the machine-generated reports they received were criminally irrelevant, such as harmless family holiday photos. A false hit is an innocent person’s private life flagged, reviewed and filed while scarce investigative resources are spent chasing noise.

The people who commit these crimes already know how to avoid detection. They use their own encrypted archives, private forums and closed channels that these systems cannot see. Blanket scanning catches the innocent and misses the guilty.

Chat Control arrived in stages, each one making the next seem normal.

The pattern is the same at every step. A “temporary” and “voluntary” measure becomes the baseline. The next proposal makes it mandatory. One expansion justifies the next, and the infrastructure being built has no natural stopping point.