EU now one step away from reviving private message scanning rules

https://cyberinsider.com/eu-now-one-step-away-from-reviving-private-message-scanning-rules/

by ggirelli • 14 days ago

457 180 14 days ago

cyberinsider.com

ChrisArchitect3• 14 days ago

[dupe] https://news.ycombinator.com/item?id=48819008

vaylian• 14 days ago

Different news source. But same topic.

ChrisArchitect3• 14 days ago

Welcome to share the url over there. Duplicate discussion.

Cider99865• 14 days ago

I feel like this one should not be removed because people want to continue discussing and that's easier on a newer thread.

ChrisArchitect3• 14 days ago

Easier? You mean easier to duplicate? No need to split up the discussion. There's the link, welcome to continue discussing over there, instead of pushing the news back in front of the rest of those who may not have missed it.

PowerElectronix• 14 days ago

Tough week for euros. Cars that record your face while driving and now apps snooping on communications.

artisinal2• 14 days ago

Perhaps in the future cars will not only record your face but also listen in for hate speech. Most cars have SOS and GPS modules so calling the police if someone in the car shouts a slur is just connecting some code together.

shevy-java2• 14 days ago

Well, it is some kind of social control. People who conform, have more rights than those who reject fascism.

Z0rp• 14 days ago

Car could also become judge and executioner. Swift justice is just one curve away

yubblegum2• 14 days ago

Why do you think this is only going to be in Europe? This will be the global norm modulo some astroid hitting earth or civilizational crash.

The trajectory is crystal clear: access to information (AI), control over personal finance (CBDC), privacy of personal communications (handful of big tech MITM in everything), metered social interactions (today China, tomorrow the world over).

neongod• 14 days ago

The car’s computer voice: John Spartan you are fined one credit for a violation of the verbal morality code!

greenleafone72• 14 days ago

I think this should go one step further. If you don't praise the magnificence of your local EU politicians then your car's breaks will stop working and an electric shot will be administered to everyone presently in the car. That will satisfy EU-rocrats.

The coming revolution will be well deserved I think.

sam_lowry_• 14 days ago

This is called eCall, a fairly intrusive system built into even some motorcycles.

specproc• 14 days ago

Danger, danger. Cannabis detected in the vehicle.

mito88• 14 days ago

the children... :)

Cider99865• 14 days ago

It's not particularly effective with school shootings in the USA.

andrepd• 14 days ago

Cars sold for the past years already record and transmit all your movements and telemetry, I'm sad to say.

sscaryterry8• 14 days ago

Honestly, it is mostly a reaction to how society has evolved, for the worse. Rock and hard place.

The worst thing I have to hide is knowledge about my intentions, none of which are bad/illegal/immoral.

Scan away, I'd rather try to protect my children, other children from unscrupulous characters.

haywalk• 14 days ago

The worst thing I have to hide is knowledge about my intentions, none of which are bad/illegal/immoral.

Correction: None of which are bad/illegal/immoral _right now_. The "I have nothing to hide" crowd will surely change their tune the moment any of their data starts to be used against them.

honeycrispy• 14 days ago

Maybe they should pause on being such snobs towards American politics to take a long hard look at themselves.

varispeed2• 14 days ago

I wait for mandated methane sensor in everyone's anus.

vrganj3• 14 days ago

Boy, do I have news for you: https://www.tesla.com/ownersmanual/model3/en_us/GUID-EDAD116...

ndriscoll• 14 days ago

Didn't Biden's big infrastructure bill already mandate that NHTSA develop regulations to require driver monitoring sensors starting next year? Or was that provision cut or reverted?

warkdarrior• 14 days ago

That provision did get removed, but only for ICE cars.

shevy-java2• 14 days ago

Slaves also have no right to privacy. This EU variant is doomed to failure.

inigyou5• 14 days ago

The Chat Control 1.0 rule is simply that organisations like Meta are allowed to scan messages if they want to. In other words your Facebook messages are not private from Facebook. Surely we already knew and expected that.

Chat Control 2.0 is the worrying one because it mandates scanning and bans E2EE.

These two things should not have both been given the same branding.

Cider99865• 14 days ago

The name "Chat Control" is great because it implies a lockdown on free speech and the exact consequences that are going to happen to everyone.

AshamedCaptain• 14 days ago

I think the name is meaningless to the average layman, therefore useless. Something like "(private) chat police" would probably transmit what this is about but is not as catchy.

inigyou5• 14 days ago

That's suitable for Chat Control 2.0. Applying the same name to v1 just muddies the waters, probably intentionally..

chronogamous• 14 days ago

Not everyone. Politicians and all their communication are to be excluded, for they have decided it is obvious that we can trust them. It's just the rest of the world that is considered untrustworthy. This also absolves them from having to go through a trial period of having the software tested on themselves, so they will never have to know about any ridiculous false positives. Or worse: all the stuff they communicate which they never considered to be problematic - it would have been so nice if they had at least had such a trial run, for say, about one or two years, with anything that is being flagged open for anyone who wishes to see.

The problem with this software is at the very core of why any sane person should reject it; a company like Thorn has no incentive whatsoever to actually come up with something that would work properly, especially since the target demographic that is to be monitored, is European. No worries if some firmware update bricks a massive amount of devices. Good for business. And I bet the US Government would also prefer if they prioritized having the backdoors work properly for listening in, over having the software scan properly (taking all the cultural and linguistic differences across the continent into account) just so that it will be capable of actually flagging what it is (for now) meant to flag.

Having your entire infrastructure of digital devices augmented with surveillance software is a bad idea in itself, but it's sheer madness if you're having this done for the whole of Europe, by using an American software endlosung/solution that was pushed by a Hollywood-actor who was so genuine in his motivation to save the children... truly impressive show of tears for someone who had the chance to save a number of girls from his predatory co-star a long time ago, like, to save them for real, yet he chose not to intervene... Years later, he's with Thorn, but still what he knows best is acting, so instead of focussing on actual victims, he's acting as if he gives a toss about present day children, knowing full well he is selling a dodgy technology using horror-scenarios they actually invented themselves for this very purpose.

In subsequent years this has led to an actual increase in number and variety of perpetrators in the field of sexual abuse and/or trafficking of minors - where it was quite a niche field in crime before - niche and overall way more predictable, making it possible to prevent quite a bit of it, too. Thanks to the fearmongering and constant need for succesfull detection of victims (as it is the metric they've used for years to keep the people providing them with money and power excited about the project) it has become much more problematic. The efforts of groups like Thorn have so effectively spread these horrorstories by pushing them as 'news' using so many newsoutlets, that this in itself caused a whole new demographic of messed up people to act them out, making the horrors a reality.

All this should be enough for anyone to know that, if you're totally hellbent on having a thing like chat control implemented, doing so by choosing to stick with software sold by these people or anyone from their circles will be disastrous.

john_strinlai7• 14 days ago

These two things should not have both been given the same branding.

the confusion is purposeful, because it is easier to convince people that 1.0 is okay, which makes 2.0 appear like a version bump of the same thing.

layer82• 14 days ago

“Chat Control”, along with the version numbers, is a naming invented by the opponents, not by the proponents.

iLoveOncall• 14 days ago

I think it's the contrary. People don't want Zuckerberg reading their private messages, and everyone in Eutope uses WhatsApp, which is advertised as E2E encrypted.

Therefore it makes Chat Control 2 a harder sell.

To be fair I think "<anything> Control" makes it pretty clesr it's nefarious. They missed the opportunity to call it "Chat Safety".

IshKebab• 14 days ago

Yes but that's how all of these objectionable legislations are introduced - first it's voluntary, then they wait a bit and say "companies aren't doing it, we'll need to make it mandatory".

Easier to push through if the only thing they're changing is "may" to "must".

account426• 14 days ago

The Chat Control 1.0 rule is simply that organisations like Meta are allowed to scan messages if they want to. In other words your Facebook messages are not private from Facebook. Surely we already knew and expected that.

Actually, I would expect the EU to limit the ways in which these platforms can access private messages as much as technically possible. That's the only thing that would be in line with recent privacy legislation.

pton_xd• 14 days ago

I don't understand the EU's position on privacy. On the one hand, they enacted GDPR to give you control over access to your personal data.

On the other, they need access to all of your data.

ggirelli3• 14 days ago

Not "access to ALL of your data". Also, as confusing as it might be, it is in the nature of EU (at least IMHO) to not have a clear position over multiple legislatures.

varispeed2• 14 days ago

This is a wedge.

munk-a• 14 days ago

The EU's position on privacy seems pretty consistent to me - they're against your data being monetized by private entities but not against building governmental tools to monitor private entities.

In good faith this could be summarized as "Personal data should be used for public safety but not for profit" - but that philosophy is definitely a strong contrast with the basic American philosophy towards civil liberties.

watwut2• 14 days ago

basic American philosophy towards civil liberties.

Errrr, america does not look like country that cares about that. It does care about liberties of rich companies tho.

mhitza• 14 days ago

Maybe big tech weren't good a lobbying bureaucrats against GDPR but got better at lobbying in the EU for this. There's also been a slight shift towards authoritarianism in the last decade, which naturally love the possibilities of stricter communication control.

Children protection and russian propaganda are the tried and tested covers at enforcing age verification, message scanning, and probably any future pan-european surveillance network.

JoshTriplett2• 14 days ago

I think the position can best be approximated as "companies should not be able to do this, but you should trust your government to do this to you". (That's a bad position that needs to be defeated every time it arises, but it's a consistent position.)

sscaryterry8• 14 days ago

Given the choice of trust between, lets say Amazon/Meta/Google and the EU (or some European government), 9 times out of 10, the EU is the lesser evil.

inigyou5• 14 days ago

The one that passed doesn't give them access to anything. It is different from the scary one.

bossyTeacher• 14 days ago

It is simple. GDPR is aimed at private entities misusing your data. Keyword private.

spwa44• 14 days ago

Not even that. The government outsources a lot of their functions, so a LOT of organizations have access to extremely private data, where necessary.

For example, Palantir gets access to "large and diverse (government) databases with Dutch citizens’ data for analysis" (including mental health treatment data) under the GPDR to help police in the Netherlands do terror investigations (from 2012 to 2019). I'm sure you can appreciate the wisdom and privacy-enhancement in that just as much as me!

There are large lists of private organizations that get access to government data about citizens ... every country has multiple (public and secret ones).

Oh, they also "failed to mention" this to parliament, and this was only discovered after a journalist got a tipoff and requested financial data about the deal ... for about 5 years. Of course, there was never even the slightest investigation into this.

https://nltimes.nl/2025/08/22/dutch-police-also-use-controve...

(paywalled) https://www.volkskrant.nl/tech/ook-nederlandse-politie-gebru...

coldtea• 14 days ago

There's no position on privacy. They make whatever laws the corporate laws and elites like, and that furthers their own bureucratic reach. GDPR is a good way to create a "compliance moat" against smaller players, and to give the EU bureucrats more power.

joe4633692• 14 days ago

The unquestioned view in certain circles - including here - is that when the EU/UK does something that chips away at people's online privacy, there's un ulterior motive.

It's entirely possible that politicians just want to do something about CSAM and young people having their mind twisted by social media. The electorate do seem to be keen on some sort of action.

vlian2088• 14 days ago

It's entirely possible that politicians just want to do something about CSAM

except that honest-to-God child rapists get extremely lenient sentences in Western Europe and rarely (if ever) get deported afterwards.

budududuroiu3• 14 days ago

Other governments across the Channel also want to protect children online, while at the same time dismissing thousands of reports of grooming, for fear of being labelled "racist".

MaKey2• 14 days ago

This is being heavily pushed by certain actors so it's not just politicians wanting to do something about CSAM: https://balkaninsight.com/2023/09/25/who-benefits-inside-the...

Many abuse survivors and youth advocates strongly oppose Chat Control; here is one voice detailing why: https://www.linkedin.com/pulse/why-i-dont-support-privacy-in...

laylower• 14 days ago

Ban social media then, don't scan everyone's info. We know it's going to end up in the US. They can't claim to be working for the European project if the implement legislation that entrenches US majors and goes against the interest of their citizens.

0dayz• 13 days ago

I don't doubt it sort of by why then go through these bizarre loops and secrecy, etc.

arjie• 14 days ago

It seems fairly consistent, doesn't it? CC 2.0 is that the government must be able to access things, and GDPR has a legal basis exemption that is defacto used every time by government entities. The general idea is that private parties cannot consent to things to each other but that residents of a place consent to being governed by the government. e.g. you can't consent to having someone jail you; but you also can't opt out of jail by the government.

Personally, the politics of Europe is really not for me, but I can see why others might find it attractive. In the end, history will show us which path is adaptive.

Puts• 14 days ago

The thing is that according to the Universal Declaration of Human Rights privacy and the right to private communication is a basic human right. And GDPR was literally enacted to enforce this human right.

Now one basic principle of democracy is that supreme courts are superior to the people in power. Someone needs to watch the lawmakers so to say. Because it could actually be that the European commission enacts laws that are illegal. And Chat Control 2.0 could actually be illegal because it violates the Universal Declaration of Human Rights. However, somebody has to take them to The Court of Justice of the European Union to test it.

nurumaik• 14 days ago

Very clear position: they want absolute control over both companies and citizens

kubb2• 14 days ago

When is it coming online? I have seen so many of these headlines that I feel it's always about to kick in, but I never get any closure.

watwut2• 14 days ago

This was online already. It is existing law that is being extended rather then expired.

SiempreViernes• 14 days ago

Somewhat unsurprisingly too, since the negotiations about a more comprehensive CSAM legislation (the one that now doesn't contain chat control 2.0) isn't done yet.

kubb2• 14 days ago

Hmm, so… what happened while it was online? Any scandals?

spwa44• 14 days ago

2 August 2021.

It already was in force, and EU states are presumably using it right now despite that being illegal. Only to protect the children, of course.

ggirelli3• 14 days ago

Had expired in April. This is a tentative of bringing it back up even though it expired after a number of previous extensions.

mctwo• 14 days ago

Each passing day we are moving closer to a dystopian state and nobody is doing anything.

layer82• 14 days ago

People are doing something (e.g. [0][1][2]). That’s why Chat Control 2.0 hasn’t passed and is unlikely to pass in the foreseeable future.

[0] https://www.patrick-breyer.de/en/posts/chat-control/

[1] https://edri.org/our-work/european-commission-must-uphold-pr...

[2] https://freiheitsrechte.org/en/themen/freiheit-im-digitalen-...

mattrighetti• 14 days ago

Give it time. I’ll see you in 5 years

Nidhug• 14 days ago

For my fellow EU citizens, you can contact your representatives here: https://fightchatcontrol.eu/

sir_brickalot• 14 days ago

I did.

rckt• 14 days ago

I did. Only 1 replied.

budududuroiu3• 14 days ago

The Internet Watch Foundation, an organisation funded by almost all of big tech, is already at work pushing for client side scanning next [1], for the children, of course.

[1] https://www.iwf.org.uk/policy-work/preventing-the-upload-of-...

peyton• 14 days ago

Interesting. It would be easy to detect hate speech client-side too I’d imagine. My phone already listens for certain words.

anonym29• 14 days ago

Why stop there? This system can easily be used to target welfare recipients, immigrants, LGBT+ people, black/brown/indigenous people, pretty much any disfavored group of choice!

You're just one election away from "that was during the previous term of office"

https://media.mullvad.net/web/chatcontrol2_en.jpg

xienze2• 14 days ago

for the children, of course.

Kind of surprised they don't just pitch it as a way to root out Russian propaganda and right-wing extremism. Public opinion would shift overnight. They'd practically demand it!

bee_rider• 14 days ago

Actually, what are the partisan leanings of the parties actually actively pushing this, since you’ve brought it up?

Despite being fairly left-leaning I wouldn’t automatically blame the right for this particular type of invasive nonsense… is this a centrist spawned nuisance, or something?

cucumber37328422• 14 days ago

Kind of surprised they don't just pitch it as a way to root out Russian propaganda and right-wing extremism. Public opinion would shift overnight. They'd practically demand it!

Because the masses are already pretty damn sick of exactly the demographics and groups that that marketing would garner support from.

slg9• 14 days ago

I feel like if people wanted to counter this push, the more effective route would be addressing the "for the children" motivations seriously rather than fully dismissing them. You could cut the legs out of this effort by capturing the part of the population that does have an honest desire to protect children by offering an alternative that actually protects children. Instead, that concern is treated as 100% disingenuous which pushes many normal people to the side of wanting to enact these controls. This is a political problem, you need to solve it with politics.

matthewdgreen• 14 days ago

I know a number of people who have gone down this route, including Senators. For example, here's Senator Wyden's proposal to add $5 billion in mandatory funding to investigate and target sexual abusers [1]. The problem with these efforts is that they're expensive: fighting child exploitation requires enormous amounts of funding.

Guess what doesn't require billions of dollars? Mandatory scanning paid for by tech companies, followed by dumping the billions of hits they produce [2] on overworked police and clearinghouses that mostly ignore them.

[1] https://www.wyden.senate.gov/news/press-releases/wyden-eshoo... [2] https://www.hstoday.us/subject-matter-areas/cybersecurity/su...

InvertedRhodium2• 14 days ago

I don't think I agree - "think of the children" is not primarily a rational argument, it's more an emotional and political lever that is used to frame anyone in opposition as being opposed to more child safety, which is very obviously a bad thing.

It creates a moral asymmetry where one group is "defending children" and another group is "defending an abstract concept", but group A wins out primarily due to millions of years of human evolution. It has very little (IMO) to do with the actual underlying concepts being debated.

AnthonyMouse3• 14 days ago

You could cut the legs out of this effort by capturing the part of the population that does have an honest desire to protect children by offering an alternative that actually protects children.

There are many, many things we can do that actually protect children -- and we generally already do them. That's the nature of the problem. After you do all of the things that are reasonable and cost effective, it solves 90% of the problem, 95% of the problem, 99% of the problem, but never 100% of the problem.

So you can't give them something that does that. The thing they're proposing doesn't even do that. Nothing does. And then disingenuous opportunists keep proposing the thing that should never be done because they know it lets them paint you as the bad guy for having to tell them no again and again.

What you need instead is to identify and strip power and resources from the people who keep proposing it.

ClumsyPilot3• 14 days ago

> would be addressing the "for the children" motivations seriously rather than fully dismissing them

Like actually finding and arresting Eipstein clients?

There’s no need to protect children when it’s higher ranking people doing the crime I guess

paisawalla2• 14 days ago

an organisation funded by almost all of big tech

Agreed, and this sucks, but what should be done about this? Some NGO called "We Stop Bad Guys" approaches your company with its hand out. You have two choices:

1. kick down some money, get great headlines

2. don't, and then have it known that you don't support stopping Bad Guys -- then maybe write ten thousand never-to-be-read words about how your position is actually quite principled

I hate it, but the first is obviously rational?

account426• 14 days ago

How is it rational? What's going to stop a different We Stop Really Bad Guys NGO from showing up next. Corporations are perfectly capable of not getting involved when they don't want to.

bellowsgulch2• 14 days ago

lol, say someone publishes an E2E distributed extension to an existing chat protocol.

Are you going to arrest someone for writing code? Are you going to arrest people who use private communications? Sounds like a legislator carve out hot and ready to happen.

I get the point, ban E2E, OK sure, but what if some software is designed in such a way that the company doesn't provide it, but it just happens to be compatible with the protocol extension? Are you going to arrest the authors if they don't explicitly ban it?

Yeah, right.

McDyver• 14 days ago

It's all coming together: Even if an open protocol was developed and published, and everyone would just use AI to create their own app in order to be private, Google is shutting down that path by preventing "unsanctioned" apps from being installed (not to mention Apple, which already does it).

People wouldn't be arrested for writing code, but as it happened in Spain, people with Pixels and GrapheneOS are already treated as drug dealers

bellowsgulch2• 14 days ago

The government's worse nightmare: People who own Pixels talking to their family members.

ggirelli3• 14 days ago

Do you have any references to the Spain thing?

red_admiral2• 14 days ago

This is about 1.0, which sounds ok - it basically allows providers a legitimate exception from data privacy laws to scan for CSAM in not E2EE communications. I reckon gmail, iCloud mail and the like already scan attachments for malware and emails for phishing scams, now they can also scan for child abuse.

cc 2.0 is a different beast.

budududuroiu3• 14 days ago

"We decide on something, leave it lying around, and wait and see what happens. If no one kicks up a fuss, because most people don't understand what has been decided, we continue step by step until there is no turning back." -- Jean-Claude Juncker

MaKey2• 14 days ago

It's still objectionable with a false positive rate of 50-80%.

63stack• 14 days ago

Can anyone explain something? Since there are so many open source chat applications, what keeps anyone from "just" exchanging a key with someone else out of band, and then modifying the client so that it uses that key to encrypt all communication? I understand that this does not scale to big groups, but surely whoever is pushing this crap must have thought about this? Or is the idea that we will have completely locked down PCs as well ala android and ios so you can't run anything unapproved?

peterlk• 14 days ago

Nothing is stopping people from doing that. It’s just more inconvenient than other available options. If I were a politician trying to remove private communication, I would first pass something that allows scanning communications, then pass something that allows e2ee messages to be scanned, then make it illegal to use non-scannable e2ee messaging. People could still do it, but now they could be punished if they’re ever caught

red_admiral2• 14 days ago

What is the US legislation on this - I thought providers were already mandated to take action against distribution of CSAM, or is that only for public-facing posts?

tangenter• 14 days ago

Waiting to see what the Europeans do. They talked the talk. Let’s see what is the next move.

hagbard_c2• 14 days ago

Some of 'm have been doing things for decades now, moving to self-hosted services free from the government censors. The harder they squeeze, the more people will move to that server-under-the-stairs or hitch a ride on one hosted by a family member or friend.

wewewedxfgdf• 14 days ago

Even if defeated, this is Terminator legislation - it will never stop coming back until it wins.

Jensson• 14 days ago

And then the anti terminator legislation where people will propose to end this over and over until its ended. EU isn't like USA, you have endless proposals in both directions.

Aerroon2• 14 days ago

I'm surprised that the EU keeps doing this, because every time they do this it pushes more people into the anti-EU camp. That's what the "anti terminator legislation" might end up being.

hagbard_c2• 14 days ago

They won't scan my messages since I run my own XMPP server and clients using only free software - prosody for the server, Conversations/dino/gajim/converse.js for the clients. OMEMO (the encryption scheme used by 'modern' XMPP systems) uses the same double-ratchet encryption as Signal without the dependency on a central Signal server.

Prosody can run on just about anything and is mostly maintenance-free, give it a try I'd say. You'll want to get a domain for it but that's easy and cheap.

luizamarns• 14 days ago

nice

klipklop• 14 days ago

Of course they are. They will boil the frogs slowly until they get the frog soup they so desire. Each time the water gets a little bit too hot (public outrage) they will turn it back down for a bit.

Every major global region has this problem. I would tell you the slope is slippery, but I already fell down and cracked my head open.

Joking aside, this privacy invasion will keep happening until there are laws passed (a foundational constitution perhaps?) that make it impossible to attempt to even create such laws/rules.

billynomates• 14 days ago

The EU already has exactly that! The Charter of Fundamental Rights is binding constitutional law, and the Council's own lawyers said the CC2.0 would probably be annulled by the CJEU if passed. The problem isn't the absence of this constitutional right, it's that constitutional review is retrospective. Someone has to pass the law, it runs for years, harm accumulates, a case reaches the court, and then it gets struck down.

hahooh• 9 days ago

...they were doing it secretely but now they are tired of hiding it.

EU now one step away from reviving private message scanning rules

Related Stories