European ‘chat control’ plans in the name of ‘child safety’ threaten end-to-end encryption

Client-side scanning

IT security experts warn against client-side scanning for several reasons.

First, to check whether the content flagged by the algorithm is actually prohibited, a manual review would need to take place. This requires a technical feature allowing third parties to check the content of the normally encrypted communications – a backdoor.

Backdoors fundamentally jeopardise the security of end-to-end encryption, due to external adversaries such as intelligence services or criminal hackers being able to find and abuse these vulnerabilities. Nor is private correspondence – especially nude images – safe in the hands of the provider or the authorities, as reports of misuse of intimate data by US agencies as well as big tech companies have demonstrated.

Most importantly, the scope of client-side scanning methods can easily be extended to screen correspondence for other purposes, such as targeted advertising, the sharing of legitimate content or blocking of political communications.

Bearing in mind that no judicial order would be required to authorise the monitoring, the privacy of citizens would be in the hands of closed source algorithms and hash databases controlled by global tech companies. Whoever controls the database of hashes would be able to intercept any content of interest.

False positives

The scope of the proposed chat control legislation has already been extended beyond pictures and videos to search text messages for possible “child grooming” attempts. We can expect the rate of false positives to be staggering.

A former judge of the European Court of Justice, Ninon Colneric, concluded that the proposed chat control legislation on indiscriminately and permanently screening all private communications would violate the fundamental rights of EU citizens. Yet the European Commission is determined to propose such legislation.

If the EU mandates backdoors in end-to-end encrypted messaging clients to scan for suspicious content, it is only a small further step to mandate such backdoors for law enforcement interception. This would break end-to-end encryption altogether and expose personal, business and state secrets to foreign intelligence services and hackers.

Destroying safe communications channels would endanger whistleblowers and risk the life of dissidents in dictatorial regimes such as Hong Kong and Belarus. It is no surprise, therefore, that the “Five Eyes” intelligence alliance advocates chat control legislation with a view to undermining encryption.

Targeted police work

Protecting children is undoubtedly a pressing issue. However, this cannot and should not be done by sacrificing the secrecy of electronic communications. In fact, indiscriminate monitoring destroys safe spaces for abuse victims to receive counselling and disproportionately targets minors themselves, while serious criminals just continue to use self-operated end-to-end encrypted systems.

The shutdown of the “Boystown” child porn platform earlier this month demonstrated that targeted police work is key to prosecuting the organised structures behind this horrendous crime.

Instead of unleashing an unprecedented mass surveillance system on all of us, children need to be better protected by educating the public, offering more therapy and support, and by reducing the backlogs of criminal investigators.