[TRANSLATED ARTICLE]

EU chat control comes – through the back door of voluntariness

The EU states have agreed on a common position on chat control. Data protection advocates warn against massive surveillance. What is in store for us?

After lengthy negotiations, the EU states have agreed on a common position on so-called chat control. Like from one Minutes of negotiations of the Council working group As can be seen, Internet services will in future be allowed to voluntarily search their users’ communications for information about crimes, but will not be obliged to do so.

The Danish Council Presidency wants to get the draft law through the Council “as quickly as possible”, “so that the trilogue negotiations can begin promptly”, the minutes say. Feedback from states should be limited to “absolute red lines”.

Consensus achieved

The majority of States supported the compromise proposal. At least 15 spoke in favor, including Germany and France. Germany “welcomed both the deletion of the mandatory measures and the permanent anchoring of voluntary measures”, said the protocol.

However, other countries were disappointed. Spain in particular “continued to see mandatory measures as necessary, unfortunately a comprehensive agreement on this was not possible”. Hungary also “seen voluntariness as the sole concept as too little”.

Spain, Hungary and Bulgaria proposed “an obligation for providers to detect, at least in open areas”. The Danish Presidency "described the proposal as ambitious, but did not take it up to avoid further discussion.

The organization Netzpolitik.org, which has been reporting critically on chat control for years, sees the plans as a fundamental threat to democracy. “From the beginning, a lobby network intertwined with the security apparatus pushed chat control”, writes the organization. “It was never really about the children, otherwise it would get to the root of abuse and violence instead of monitoring people without any initial suspicion.”

Netzpolitik.org argues that “encrypted communication is a thorn in the side of the security apparatus”. Authorities have been trying to combat private and encrypted communication in various ways for years.

A number of scholars criticize the compromise proposal, calling voluntary chat control inappropriate. “Their benefits have not been proven, while the potential for harm and abuse is enormous”, one said open letter.

According to critics, the planned technology, so-called client-side scanning, would create a backdoor on all users’ devices. Netzpolitik.org warns that this represents a “frontal attack on end-to-end encryption, which is vital in the digital world”.

The problem with such backdoors is that “not only the supposedly ‘good guys’ can use them, but also resourceful criminals or unwell-disposed other states”, argues the organization.

Signal considers withdrawing from the EU

Journalists’ associations are also alarmed by the plans. The DJV rejects chat control as a form of mass surveillance without cause and sees source protection threatened, for which encrypted communication is essential. The infrastructure created in this way can be used for political control “in just a few simple steps”, said the DJV in a statement Opinion.

The Messenger service Signal Already announced that it would withdraw from the EU if necessary. Signal President Meredith Whittaker told the dpa: “Unfortunately, if we were given the choice of either undermining the integrity of our encryption or leaving Europe, we would make the decision to leave the market.”

Next steps in the legislative process

The Permanent Representatives of the EU states are due to meet next week on the subject, followed in December by the Ministers of Justice and Home Affairs, these two bodies are due to approve the bill as the Council’s official position.

The trilogue then begins, in which the Commission, Parliament and Council must reach a compromise from their three draft laws. Parliament had described the original plans as mass surveillance and called for only unencrypted suspect content to be scanned.

The EU Commission had originally proposed requiring Internet services to search their users’ content for information about crimes without cause and to send it to authorities if suspected.