Chat control: Tech companies warn ministers over EU encryption plans

Client-side scanning

Client-side scanning technologies compare hash values of encrypted messages against a database of hash values of illegal content stored on a user’s own phone or computer. It has been widely criticised by security experts and cryptographers.

In 2021, 14 of the world’s top computer scientists, including cryptography pioneers Ron Rivest and Whit Diffie, warned in a scientific paper that client-side scanning “creates serious security and privacy risks” and could be exploited by hostile nation-states, malicious actors and even child abusers to harm others or society.

Key events

May 2022: The European Commission presents a proposal, which becomes known as chat control, to require all email and messaging providers to conduct mass scanning of all messages and emails sent on their platforms, including end-to-end encrypted messages, for child abuse material without the need for any prior suspicion of wrong-doing.

November 2023: The European Parliament sets out its negotiating position, opposing the EC’s proposal for blanket scanning of all messages on the grounds that they would breach the fundamental rights of EU citizens and would not survive legal challenges. It opposes client-side scanning technology and other mechanisms to scan the content of encrypted messages.

January 2024: Belgium takes over presidency of the Council of the European Union.

Late 2024: A “trialogue” meeting of the European Commission, the European Parliament and the European Council is expected to decide on the final text of the “chat control” legislation.

Last year, scientists and researchers from more than 30 countries warned that the scanning technology proposed by the European Commission was “deeply flawed” and vulnerable to attacks. They said that the technology would leak “illegal information” and would struggle to detect illegal content “reliably”.

Leaked internal legal advice shows that the Council of Europe’s own lawyers have serious questions about the lawfulness of the planned measures, which they say could lead to the de facto “permanent surveillance of all interpersonal communications”.

Digneaux said that once mass scanning has been introduced for one purpose, policymakers would face inevitable pressure to expand its use for other purposes, such as terrorism or organised crime.

The technology could be used by repressive regimes to monitor political dissent. “We have a lot of users in countries like Russia or Iran that rely on our services, such as journalists or people just expressing their political opinions,” he said.

Risk to cyber deposit

According to the letter, the EU’s strong focus on data protection has led to the growth of ethical, privacy-focused tech companies in Europe that have been able to compete with larger American and Chinese companies.

The tech companies argue that the EC’s proposals are at odds with other EU regulations, including the Cyber Resilience Act (CRA) and the Cybersecurity Act that encourage the use of end-to-end encryption to manage cyber security risks.

Supporting an opposite approach for the CRA regulation would “undermine the EU cyber security framework” and lead to “incoherent and inefficient measures” that tech companies would not be able to enforce without putting citizens at risk.

Proposals from the European Parliament include alternatives to mandatory scanning that would be “more effective”, “prioritise data protection and security” and “better protect children online”, they claim.

Tech companies willing to discuss solutions

Digneaux told Computer Weekly that tech companies were willing to discuss solutions with the European Commission and were not “simply saying no”.

“We are saying, ‘Let’s build something as close as possible to the European Parliament’s proposals and have this text adopted as quickly as possible and have a proper framework in place for child protection’,” he said.

He added that Proton had automated systems in place, which were checked by humans to identify suspicious interactions and relied on reports from its users, but that it was not technically possible for Proton to see the content of its users’ encrypted emails.

Proton cooperates with law enforcement under Swiss law which places limits on what information Swiss companies can disclose. 

“Our goal is to be able to cooperate with police [under Swiss law], and we can do without necessarily providing the content of conversations,” said Digneaux. “We will not deliver the number one greatest evidence that will convict someone, that is true, but we can help police with their investigations.”

Matthias Pfau, founder of Tuta Mail, said: “Security experts agree that the chat control proposal by the European Commission to scan every chat message and every email would create a backdoor – one that could and will be abused by criminals.”

The legislation “would hinder economic growth and stop businesses from trusting EU-based companies with their data”, he added.