The EU wants to scan your WhatsApp chats – and privacy experts are furious

On Thursday, June 20, 2024, EU lawmakers will vote on a bill that, if passed, would require tech companies to scan all your private messages looking for child sexual abuse material (CSAM).

What is known as Chat Control has attracted strong criticism since it was first proposed in 2023. Last May, the Belgian presidency tried to find a compromise by drafting a so-called watered-down proposal.

Under the revised Chat Control Act, users must agree to have their shared photos, videos, and URLs scanned if they want to continue using this functionality. The bill also introduces the concept of ‘upload moderation’ to, they say, prevent encryption from being broken as content is supposed to be scanned before being encrypted.

Make no mistake: tech experts don’t buy it. Cryptographers, privacy advocates, and tech companies, including some of the top VPN and messaging app providers, all viewed the new proposal as a dangerous rebranding that will plunge us all into mass surveillance. They are now urging people in Europe to contact their national representative in the EU and vow to prevent the bill from entering the next stage of legislation.

Just “rhetorical games”

“Let us be very clear again: mandating mass scanning of private communications fundamentally undermines encryption. Period,” Meredith Whittaker, president of the Signal Foundation, wrote in a statement on Monday (see tweet below).

Signal has spoken out against what was previously called “side-scanning” from the beginning. The company said it would leave Britain rather than undermine encryption. Although this still appears in the Online Safety Act, it has been halted until it is “feasible to do so”. Whittaker reiterated such a position when EU lawmakers began considering Chat Control last year.

Now Whittaker, like many other experts, has pointed out that “upload moderation” is simply a “rhetorical game” because no matter how and when scanning is implemented, it can still create a vulnerability that hackers and hostile nation states can exploit.

She said: “We ask those playing these word games to please stop and acknowledge what the expert community has repeatedly made clear. Either end-to-end encryption protects everyone and ensures security and privacy, or it is for everyone Broken.”

Many other security and privacy experts have endorsed her statement so far. Among them is Edward Snowden, the American whistleblower who first shed light on NSA surveillance tactics on civilians.

He tweeted: “EU apparatchiks aim to pass a terrifying mass surveillance measure into law, despite UNIVERSAL public opposition (no thinking person wants this) by inventing a NEW WORD for it – ‘upload moderation’ – and hoping no one learns what it means until it’s too late Stop them, Europe!”

Companies including Proton (the Swiss company behind the popular Proton Mail and Proton VPN services), Tuta, Element, Mullvad and Threema have also warned their online community of the risks and urged EU governments to reject random mass scanning.

Experts have also sharply criticized the ability to ask users for permission to scan their communications.

“If people cannot use the core communications infrastructure without first ‘consenting’ to mass surveillance, we should understand this as coercion, not an exercise in meaningful choice,” Whittaker told Ny Breaking, adding that the provision is not the way reflects how detection commands work. law.

Similarly, Matthew Green, professor of cryptography at Johns Hopkins University, viewed the proposal as “coercion into a mass surveillance regime, with some branding.”

He also pointed out that focusing solely on shared media instead of entire messages could only be a “temporary decline” from the original intent. “Their plan seems to be: get the law in place and then it won’t matter so much,” he wrote in a message tweet.

Rand Hindi, CEO of open-source cryptography company Zama, called out the EU’s apparent double standards when it comes to data privacy. “Europe is so hypocritical here: on the one hand, they force companies to comply with strict privacy regulations (this is good!), but at the same time they demand that governments have TOTAL surveillance capabilities.” He wrote.

“What’s happening now with Chat Control is a disaster in the making. It’s not a hypothetical scenario, it’s one of the most dangerous proposals to ever come this far, and we must fight it aggressively.”

What’s next?

As we mentioned, lawmakers are expected to vote on Chat Control 2.0 on June 20, after it was postponed to a day later than the original date.

According to Patrick BreyerMEPs from the German Pirate Party, Italy, Finland, Czech Republic, Sweden, Slovenia, Estonia, Greece and Portugal are still undecided on tomorrow’s vote. Germany, Luxembourg, the Netherlands, Austria and Poland, on the other hand, are “relatively clear that they do not want to participate.”

Although France was initially against it, it seems that France is currently more inclined to vote in favor, with the pact that will initially leave Signal, WhatsApp and other platforms that use end-to-end encryption outside the scope of the law will be left untouched. However, the risks of scanning still remain for the photos and videos you might share on social media DMs, game chats, and the like.

It is also worth noting that lawmakers plan to exempt intelligence, police and military personnel from the CSAM scanning. Moreover, last February the European Court of Human Rights deemed attempts to break the encryption illegal.

Now Breyer is urging everyone in Europe to take action before it may be too late. If you would like to learn more about the steps you can take, I recommend you visit him special page here.