EU's Chat Control Legislation Faces Another Setback: Private Message Scanning Blocked

EU's Chat Control Legislation Faces Another Setback

The European Union's efforts to mandate the scanning of private messages have been blocked again, marking another setback for the bloc’s proposed “Chat Control” legislation, and a further win for digital rights activists. German digital rights activist and Pirate Party Germany politician Patrick Breyer wrote in a Nov. 15 X post that a backdoor, which he said mandated client-side scanning of messages, had been removed from the latest draft of the “Regulation to Prevent and Combat Child Sexual Abuse” proposal, more commonly known as Chat Control. According to him, the addition of the following line under the Danish Presidency of the Council of the EU — which also saw the introduction of the backdoor clause — resolved the issue: “Nothing in this Regulation should be understood as imposing any detection obligations on providers.” The draft used vague language referring to “all possible risk mitigation measures,” which, according to critics, would allow authorities to force service providers to implement chat scanning, especially since chat-scanning infrastructure is already in place for voluntary implementation. In a Nov. 11 post, Breyer described the move as “political deception of the highest order,” noting that Chat Control is “coming back through the back door — disguised, more dangerous, and more comprehensive.” “The public is being played for fools,“ he said. Denmark introduced the backdoor amid an apparent step down in monitoring requirements in the bill. This marks the latest attempt by the EU Council to introduce mandatory chat scanning, including checking encrypted messages before they are sent from user devices. The previous attempt failed after Germany’s decision to reject the draft halted its progress.

Mandatory Scanning Removed, but Key Concerns Persist

Breyer wrote in his X post that only mandatory chat control was removed from the proposal, which still contains anonymity-breaking age checks for communication services and voluntary mass scanning. He added that “the fight continues next year!” The legislative process is still ongoing, and the current version of the bill is not set in stone. On Nov. 19, the Committee of the Permanent Representatives of the Governments of the Member States to the European Union (COREPER II) is expected to endorse it without debate, listing it as a “non-discussion” item. Once this body signs off, the text goes to a formal Council of Ministers meeting, where it may be adopted without discussion unless a minister specifically requests to pull it. So far, some unencrypted communication services such as Gmail, Facebook, Instagram, Skype, Snapchat, iCloud email and Xbox have implemented chat scanning. With mandatory scanning, the European Commission — EU’s primary executive branch — expects a 3.5-fold increase in the number of reports generated by the system. Breyer said that on Nov. 13, a clarification ensured that “chat control should not be mandatory, not even through the back door.” Still, he pointed to other issues in the current draft, including voluntary chat control that allows mass scanning of messages without a court order and new age-verification requirements that “would make anonymous e-mail and messenger accounts factually impossible and exclude teens under 17 from many apps.”

A Continuation of the Cypherpunk Fight

The rights to privacy and encryption have long been contested. Bitcoin (BTC) itself stems from the pro-cryptography movement known as cypherpunks. The 80s movement comprised a diverse group advocating the widespread use of privacy-enhancing technologies, including many early Bitcoin developers and community members. The Bitcoin white paper cited a previous paper by British cryptographer and cypherpunk Adam Back as an inspiration, laying the foundations that Satoshi Nakamoto built on. The movement was heavily involved in protesting against US laws restricting the export of cryptographic technologies. The campaign involved cypherpunks distributing T-shirts featuring cryptography-related information to highlight the absurdity of the laws, with Back personally involved. The shirt warned that it “is classified as a munition and may not be exported from the United States, or shown to a foreign national.”