The end of encrypted Europe

This week, the European Parliament was holding votes on what has come to be known as “chat control” —  legislation enabling technology companies to scan online communications for child sexual abuse material. On 3 April, a legal framework expired that allowed the likes of WhatsApp and Messenger to take voluntary measures derogating from e-privacy rules to identify users suspected of sharing child sexual abuse material (CSAM).

Members of European Parliament supporting have argued that the votes this week were merely about re-establishing the legal regime that allowed voluntary scanning, not changing the legislation to require platforms to scan private communication. Proposals in this sense, which included mass surveillance, the abolition of encryption and making an EU agency responsible for carrying out mandatory checks, have now been defeated several times.

However Belgian Professor Bart Preneel, a global authority on cryptography, asserts that we are not merely talking about reintroducing the old legal regime, but that it is being “extended to the use of AI to find new Child Sexual Abuse Material”.  

He thereby points out that it is already the third vote on what he calls “indiscriminate scanning of unencrypted communications”, lamenting that it is being done “during the start of the holiday period.” He explains his opposition by arguing that “over the past several years, more than 800 cybersecurity and privacy experts have warned about the technological limitations of voluntary mass-scanning and AI-based content analysis, as well as the risks these technologies pose to fundamental rights.” In sum, he thinks that “indiscriminate scanning is not a good approach to solve the serious problem of CSAM distribution.”

Researcher Claudia Peersman, who works for the Cyber Security Research Group at the University of Bristol in the UK, has warned that large scale mass surveillance of our private messages on WhatsApp or Facebook will not effectively deal with child abuse.

With her team, she has tested the technology and finds it inadequate, stating: “Some of these tools, for example, detect nudity and combine that with a filter which searches for people of a young age. You then automatically get a ‘match’ indicating possible child abuse. But what if it is a video of your child in bath which you forward to your parents or in-laws?” She adds that it is, technically speaking, “currently not possible” to avoid such mistakes and suggests to instead focus efforts on monitoring what’s currently publicly available on the internet.

In March, the European Parliament rejected the temporary extension of the old legal regime, with 311 votes against, 228 in favour and 92 abstentions. Earlier this week, the European Parliament has however cleared the way for the legislation however. They have thereby even used a rarely used urgent procedure, whereby only a vote rejecting the measure on 9 July — the last day the European Parliament will still be sitting in Strasbourg before the recess — could still kill it. It really looks like they do not want to take “no” for an answer. In particular the centrist European People’s Party (EPP), to which German Chancellor Friedrich Merz belongs, is behind the push.

Apart from the fact that blunt instruments may do more harm than good, there is also the risk of Chat Control being expanded in the future — for example to police free speech

Understandably, judicial authorities throughout Europe are keen to obtain more instruments to go after savage criminals exploiting the most vulnerable, and without any doubt, they have been putting pressure on governing politicians. But apart from the fact that blunt instruments may do more harm than good, there is also the risk of Chat Control being expanded in the future — for example to police free speech. Sadly, in today’s Europe, where people are being prosecuted merely for insulting politicians, it is hardly irrational to fear for such “function creep”.

At least, it has been heartening to see the extent of opposition throughout Europe, both from the right and the left. Even corporates have voiced their disagreement: for example, Meredith Whittaker, President of the encrypted messaging app Signal, has warned that her company will “leave the EU market rather than undermine our privacy guarantees.”

Evidently, criminals will find ways to circumvent such scanning by WhatsApp or Messenger by switching to other platforms that, temporarily or for a long period of time, manage to stay under the radar and continue to offer encryption without scanning. They may simply move to underground platforms altogether permanently.

In practice, as opponents have maintained, it will be ordinary people that will be monitored.