Review Group: Senior Policy Analysts in Digital Civil Liberties and Cybersecurity Law
This topic is best reviewed by Senior Policy Analysts in Digital Civil Liberties and Cybersecurity Law. These experts specialize in the intersection of legislative mandates, fundamental human rights, and the technical realities of encrypted communication. Their focus is on the long-term impact of surveillance policy on democratic infrastructure and the efficacy of civil society interventions.
Abstract:
This presentation, delivered at the 39th Chaos Communication Congress (39C3), provides a retrospective and strategic analysis of the European Union’s proposed "Chat Control" (CSAM) regulation from 2022 through early 2025. The speakers, Markus Reuter and khaleesi, detail the legislative friction between the European Commission, the European Parliament, and the European Council.
The analysis highlights the technical and political failures of the original mandate, specifically the attempts to bypass end-to-end encryption (E2EE) through "client-side scanning" and "Upload Moderation." The session emphasizes a significant shift in German domestic policy, where a broad-based coalition—comprising technical experts, child protection organizations, and industry giants—successfully pressured the German government to oppose mandatory scanning. However, the report warns of a "zombie" policy cycle: while the most invasive mandatory components were stalled, the legislative "Trilog" continues to negotiate "voluntary" scanning, age verification, and URL filtering. The presentation concludes with a roadmap for 2026, identifying critical trilog deadlines and emerging threats from the EU’s "Going Dark" initiative, which seeks to formalize law enforcement access to encrypted data.
Strategic Analysis of EU Chat Control (2022–2026)
0:20 – 3:16 Legislative History and Persistence: The "Chat Control" proposal has remained a central EU policy friction point for over three years. Over 300 articles and numerous leaks have documented the evolving nature of the mandate.
3:16 – 7:00 Critique of Policy Advocacy: The "Chat Control Skandal Awards" highlights perceived irregularities in the Commission’s advocacy, including the use of micro-targeted social media ads using suggestive polling, and high-access lobbying by celebrities (e.g., Ashton Kutcher) contrasted with the exclusion of digital rights groups.
7:11 – 10:45 Technical Fundamentals and Risks: The core conflict involves the Commission's desire to scan for known/unknown CSAM and "grooming" across all interpersonal communications. This necessitates "Client-Side Scanning," which breaks the trust model of a user's device and renders E2EE effectively void.
10:46 – 13:16 European Parliament’s Counter-Position: The Parliament successfully moved to exclude E2EE from scanning mandates and rejected client-side scanning in favor of "targeted scanning" with judicial oversight. However, provisions for age verification and URL blocking remain in their version.
13:17 – 15:46 Failed Council Compromises (Belgium): Belgium proposed "Schrödinger’s Encryption," suggesting providers use "unnamed" technology to scan without breaking encryption. They later proposed "Upload Moderation," an opt-in model where users refusing scans would be barred from sending images or videos.
15:47 – 20:50 Shifting Council Presidencies (Hungary, Poland, Denmark): Hungary and Denmark maintained hardline stances for mandatory scanning, while Poland proposed the first genuine compromise: a move toward voluntary measures. Legislative progress is stalled by a "blocking minority" (Sperrminorität) led by Germany and Poland.
20:51 – 23:58 The "Signal Effect" and Public Pressure: Market threats from providers like Signal and WhatsApp—stating they would exit the EU market rather than compromise encryption—catalyzed broader public opposition, moving the issue beyond technical circles into the mainstream.
23:59 – 27:35 German Civil Society Intervention: A petition with over 321,000 signatures and a broad alliance including the German Child Protection Association (Kinderschutzbund) successfully pressured the German Interior Ministry to declare "unprompted" (anlasslose) chat control a "taboo."
27:36 – 31:00 Resistance within the Executive: Internal tensions revealed that German permanent representatives in Brussels initially resisted the Berlin government's shift, accusing the "internet community" and "Big Tech" of distorting the political discourse.
31:01 – 33:00 The "Voluntary" Scanning Trap: Current Council negotiations focus on "voluntary" scanning for images, text, and URLs. Analysts warn that high-risk categorizations for platforms could make these "voluntary" measures mandatory in practice.
January 2026: Expiration of the current interim "Chat Control 1.0" exception; the Commission is pushing for an extension despite reports showing insufficient data to prove its proportionality.
February – June 2026: Scheduled "Trilog" negotiation dates (Feb 26, May 4, June 29) where final legislative language will be determined.
46:33 – 48:33 The "Going Dark" Initiative: A new threat emerges via the EU’s roadmap for "lawful access" to data, signaling a broader, multi-pronged effort to create permanent law enforcement backdoors in encryption under the guise of "technology neutrality."
51:16 – 52:20 Definitions of "Voluntary": Clarification that the proposed "voluntary" scanning refers to the platform's right to scan unencrypted traffic, not the user's choice to be scanned.