This presentation provides the 2025 annual review by the Chaos Computer Club (CCC), documenting a significant escalation in state-sponsored surveillance, the erosion of digital sovereignty, and the systemic failure of large-scale digitalization projects. The report centers on three primary axes: the weaponization of global financial systems to deplatform civil society organizations, the legislative push for "Chat Control" and mandatory biometrics under the guise of child protection and security, and the technical incompetence surrounding Germany’s electronic patient record (ePA).
The analysts highlight the "Digital Independence Day" movement as a response to US-led sanctions against international legal figures and the critical need for open-source infrastructure. Furthermore, the report provides a technical critique of AI-driven surveillance pilots, the environmental costs of "AI Nation" ambitions, and the CCC's ongoing legal interventions against illegal biometric databases and state-sponsored spyware. The session concludes with an update on the CCC’s internal health, its commitment to anti-fascist principles, and the continued defense of security researchers facing legal retaliation.
2025 CCC Annual Review: Digital Repression and the Defense of Sovereignty
0:24 Financial Deplatforming as Repression: The CCC reports a disturbing trend of "debanking," where organizations like Rote Hilfe and the DKP had accounts terminated by German banks (GLS, Sparkasse) due to US-led sanctions lists. This reflects the vulnerability of NGOs within a centralized global financial system controlled by foreign interests.
7:16 Erosion of Digital Sovereignty (The Karim Khan Case): US sanctions against the ICC Chief Prosecutor resulted in the immediate revocation of his Microsoft Outlook access, highlighting the extreme risks of relying on US Big Tech for sovereign legal functions. The ICC’s subsequent migration to Open Desk serves as a catalyst for the "Digital Independence Day" (#didit) initiative to promote decentralized, open-source alternatives.
13:15 Chat Control and the Trilogues: EU legislative proceedings for "Chat Control" have entered a non-transparent "Trilogue" phase. Key concerns include the "Lawful Access by Design" mandate and the risk-categorization of services, which effectively threatens end-to-end encryption (E2EE) by mandating client-side scanning.
18:01 Mandatory Age Verification Risks: Global shifts toward mandatory age verification (US, UK, Australia) are criticized for creating new biometric honey pots (e.g., Yoti) and increasing user tracking while providing a "false sense of security" that fails to address underlying social harms.
24:34 The Return of Data Retention: Despite CJEU rulings, the EU Commission and German Ministry of Justice are pushing for three-month IP and port data retention. Analysts argue this is a misinterpretation of legal precedents and ignores the technical bypasses available to actual criminal actors.
30:15 Expansion of Police Powers (ASOG Berlin): New amendments to Berlin’s security laws (ASOG) allow for expanded biometric matching, AI-driven "behavioral recognition" at "danger spots," and the training of AI models using internal police datasets—a major expansion of state surveillance authority.
37:42 Technical Failure of AI Surveillance Pilots: A critique of the Hamburg "Hansaplatz" AI pilot reveals "everything is red" despite police claims of success. The system failed to distinguish between brawls and hugs, lacked transparency, and provided no data on false-positive rates.
42:19 State Spyware and the Constitutional Court: The CCC provided technical statements to the Federal Constitutional Court regarding state spyware (Staatstrojaner). Despite warnings about the compromise of IT security, recent rulings have largely legalized the covert installation of malware on citizen devices.
54:56 The "AI Nation" Myth and Resource Costs: The report challenges the "AI Continent" rhetoric of EU leadership (Von der Leyen), characterizing claims of 2026 AGI as "disinformation." The analysts highlight the massive energy consumption and electronic waste generated by AI data centers, which threatens to cannibalize renewable energy gains.
1:01:00 Incompetence in the ePA Implementation: The electronic patient record (ePA) was audited by Fraunhofer SIT using "GematikGPT" because the documentation was too voluminous for human review. The resulting system lacks passwords, 2FA, and secure encryption, instead relying on easily guessable "Hash Check Values" (HCV) based on public address data.
1:18:22 Support for Security Research (The NEWAG Case): The CCC successfully crowdfunded €31,000 for the legal defense of researchers who uncovered geoblocking/DRM in Polish trains. While civil litigation continues, the case remains a landmark for the protection of independent security auditing.
1:24:33 Legal Action Against Biometric Databases: The CCC is supporting lawsuits against the BKA (Federal Criminal Police Office) for illegally transferring millions of citizen photos from the "Impuls Z" database to Fraunhofer for AI training without consent or legal basis.
1:28:31 CCC Incompatibility Declaration: The membership reaffirmed a binding "Incompatibility Declaration," explicitly barring individuals associated with nationalist, chauvinistic, or anti-democratic organizations from the club, reinforcing the CCC’s identity as a "stable anti-fascist" entity.