Big tech again allowed to scan Europeans’ messages via Chat Control after procedural trick

Only one session left before the parliamentary summer break? No problem! The European Parliament narrowly voted to extend the controversial legal basis for Chat Control 1.0 for another two years. Big tech lobby is happy as companies will be able to keep automatically scanning users’ private messages.

Critics are screaming about foul play, and even if procedural tricks are common in the healthiest of democracies, what transpired surely seems a little fishy.

It’s not exactly surprising that the European Parliament (EP) has voted to extend legislation known as Chat Control, or Chat Control 1.0, allowing tech companies to voluntarily scan users’ private messages for child sexual abuse material (CSAM).

Since Chat Control 1.0 expired in April, lawmakers have been urgently seeking a solution to restore a legal basis for scanning private text, email, and social media messages.

Unsurprisingly, tech firms supported the regulation – targeted scanning would be many times pricier than automation, and the European Union member states say those voluntary scans have already helped identify and rescue victims of online child sexual abuse.

“We cannot go to the summer recess knowing that our children are not protected,” the European People’s Party’s vice-chair, Tomas Tobé, told lawmakers earlier this week.

What was unusual, though, was the method, called by some “Orwellian.” That’s because supportive lawmakers resorted to a clever procedural maneuver that allowed them to bypass significant opposition to Chat Control in the EP.

Exemption only symbolic?

Indeed, 314 EP members voted to scrap Chat Control, while only 276 voted to keep it. But the vote against keeping the regulation required an absolute majority of 361 lawmakers.

In other words, efforts to block Chat Control from resurfacing in its original form have failed. Critics are furious.

“The fact that Chat Control is moving forward against the will of the majority of voting MEPs is a farce and damages democracy,” said Patrick Breyer, civil rights activist and former member of the EP.

“Our children are the real losers in this undemocratic process. The passage of a genuine, permanent child protection regulation is now in serious jeopardy.”

German Socialists & Democrats MEP Birgit Sippel also condemned the short-notice expedited procedure without the involvement of the responsible committee, calling it unfair maneuvering.

One glimmer of hope is that the lawmakers have seemingly successfully narrowed the scope of the chat-scanning measures by securing a majority for excluding end-to-end encrypted platforms such as WhatsApp and Signal from Chat Control’s scanning provisions.

This means that only material, previously known or reported by trusted flaggers, can be searched for. In theory, proactive scanning language has been removed from the law.

Our children are the real losers in this undemocratic process. The passage of a genuine, permanent child protection regulation is now in serious jeopardy,

Patrick Breyer

Breyer disagrees and calls this exemption “symbolic” because service providers don’t scan encrypted communications anyway. Plus, the goals of Chat Control and encryption are hardly compatible.

Chris McCabe, co-founder of Session, an end-to-end encrypted and decentralized messaging app, said: “This is still a blow to individual rights and personal privacy. Sad day for the EU.”

Is the measure even effective?

Besides, even though already in March, when Chat Control was about to expire, lawmakers reasonably called to apply monitoring measures only with judicial authorization, this particular amendment also fell short of the required absolute majority.

Finally, late last year, the European Commission’s own evaluation of Chat Control revealed severe shortcomings in the mass scanning of private messages.

The evaluation found that algorithms generate high rates of irrelevant junk data and false positives (nearly 48%), leading to a massive police overload without demonstrating a measurable correlation to actual criminal convictions.

What happens now? Bureaucracy, again. The EP’s amended stance will now be sent back to the Council of the European Union for approval – or rejection – within the next three months.

If approved, Chat Control 1.0 – once again, an interim regulation – will be valid until 2028. The long-term goal is to pass Chat Control 2.0, a permanent and mandatory legal basis for all providers.

According to Breyer, the EP is demanding:

• Mandatory, targeted detection orders against actual criminal suspects, rather than blanket mass scanning left to the tech industry’s discretion.
• An EU Child Protection Centre tasked with the systematic removal of known abuse material from the public internet.
• Strict security standards for messaging apps (“Security by Design”) to prevent cyber grooming.