The EU has dropped plans to scan messaging apps for CSAM, but privacy advocates warn this may not be the end. Learn about the implications and what might come next.
The Belgian presidency of the Council of the European Union has decided to drop the controversial Chat Control 2 proposal, which aimed to scan messaging apps like WhatsApp and Signal for child sexual abuse material (CSAM). The legislation would have mandated the use of artificial intelligence (AI) to scan images, videos, and URLs shared by users. This move comes after a vote on the legislation was canceled on June 20 due to insufficient support.
Understanding the Chat Control 2 Proposal
The Chat Control 2 proposal intended to monitor user messages through client-side scanning to detect CSAM. Although well-intentioned, the legislation faced significant opposition from privacy advocates who argued it would undermine the rights of law-abiding citizens. Matthew Nimerg, co-founder of Aleph Zero, a layer-1 blockchain with private smart contracts utilizing zero-knowledge proofs, criticized the proposal for being poorly conceived. Nimerg stated, “Spying on citizens in the name of public safety should never be a solution, lest we forget history.”
Nimerg further argued that the proposal would be more invasive for ordinary users than for technically savvy criminals who could easily bypass the law using open-source software tools. He emphasized that such legislation only harms good actors while failing to stop criminal activities effectively.
Compromises and Concerns
The EU initially proposed broader powers to access text messages and audio. However, the bill was scaled back to focus on scanning images, videos, and URLs when it became clear it wouldn't pass in the European Parliament. The revised proposal required user consent for scanning, yet privacy advocates remained skeptical. They warned that even this watered-down version could become the thin edge of the wedge, leading to further invasions of privacy in the future.
Nimerg highlighted the potential dangers, stating, “Such a mandate is the beginning of a slippery slope and allows regulators to put a foot in the door to prevent people from using other technologies that use cryptography, such as privacy-enhanced decentralized applications deployed on a blockchain.”
Lessons from the UK
The EU’s decision to drop the proposal echoes concerns seen in the UK with the passage of the Online Safety Bill in October 2023. The UK legislation aimed to protect children but extended to address coercive behavior, sexual violence, people smuggling, suicide, self-harm, drugs, weapons, terrorism, and animal cruelty. The expansive scope of the bill prompted threats from messaging apps like WhatsApp and Signal to leave the UK market entirely.
The crisis was temporarily averted when the UK Minister for Arts and Heritage, Stephen Parkinson, clarified that regulators would only intervene when scanning content was “technically feasible,” which it currently is not. This clarification placated WhatsApp and Signal, but the underlying issues remain unresolved.
Mark Johnson, advocacy manager at the UK civil liberties group Big Brother Watch, commented on the EU’s decision, saying, “The news that the EU has put the brakes on their proposed chat control measures is welcome. While these plans would not have applied directly to the UK, any rules which allow governments to conduct mass snooping on internationally used messaging apps like WhatsApp would have an impact on Brits’ privacy too.”
Future Implications
While the EU has dropped the current iteration of the Chat Control 2 proposal, it is uncertain whether this is a permanent decision or if the legislation will resurface in another form. Privacy campaigner and Member of the European Parliament (MEP) Patrick Breyer remains cautious. He stated, “Without the commitment and resistance of countless individuals and organizations in Europe, the EU government would have decided today in favor of totalitarian indiscriminate chat control, burying the digital privacy of correspondence and secure encryption.”
Breyer advocates for judiciary oversight in ordering searches on messaging apps to prevent disproportionate mass surveillance. He argues that this is the only way to avoid a mass surveillance order failing in court and achieving nothing for child protection.
As the EU reevaluates its approach to digital privacy and child protection, privacy advocates will continue to monitor developments closely. The challenge remains to balance public safety with the protection of individual privacy rights in an increasingly digital world.
(ROBERT D. KNIGHT, COINTELEGRAPH, 2024)