EU plans to expand chat control

The EU Commission, supported by European governments, is working quietly to lift digital mail secrecy. As part of the fight against child abuse, a regulation is to be passed that will require communication service providers to screen communication content for signs of child abuse or attempts by adults to attract children (so-called “grooming”). But that’s not all, the draft law should now also include the monitoring of audio communication!

User devices can be searched for images or content of potential child abuse should such an order be issued. This so-called client-side scanning (CSS) checks before a message is sent whether it contains a depiction of child abuse. Client-side scanning undermines the privacy of letters, which is protected by end-to-end encryption is guaranteed for communication services, since data is searched through before encryption without concrete suspicion. Apple had planned a similar process, despite opposition from recognized IT security researchers. In a study, they came to the conclusion that client-side scanning represents a threat to privacy, IT security, freedom of expression and overall democracy.

What is planned?

According to a survey by the Swedish Presidency, which was answered by 20 EU member states, many EU states want to expand the controversial plans for so-called chat control. Ten countries spoke out clearly in favor of monitoring audio communications in order to combat child sexual abuse. On the other hand, six countries, including Germany, expressed concerns and are more inclined to oppose this proposal. Seven Member States have not yet taken a position on this issue.

Controlling and monitoring these communication channels, also known as “chat control“, also presents a significant challenge. While text messages can be scanned for inappropriate or illegal content with relative ease, the Monitoring audio content is technically much more difficult, and error-prone.

How do the countries feel about the plans?

The current proposal by the EU Commission for the so-called CSAM regulation (Child Sexual Abuse Material) makes no fundamental distinction between different types of media. However, it is mainly images, videos and texts that are spoken of, not audio files. Article 13 states that abuse reports must include “all content data, including images, videos and text”. Here, texts mainly relate to attempts at sexual initiation (grooming), which are to be identified in the communication.

Croatia therefore argues: “Audio communication can be used for grooming. It should be included in the CSAM proposal provided there are appropriate means of identifying grooming via audio communication.“

However, Romania emphasizes the complexity of this task, since “audio files may not contain the same visual cues as images or videos“.

The Netherlands argues that monitoring audio communications “would be disproportionate to the intended purpose“. In addition, “in the case of end-to-end encrypted voice communications, it will most likely also require measures that are incompatible with the case law of the European Court of Justice on data retention“.

In Slovakia, interception of audio communications would “constitute the most serious interference with the fundamental rights of data subjects and an exception to the principle of confidentiality of communications” set out in the E-Privacy Directive is anchored. In addition, the relevant providers would hardly be able to create a necessary risk assessment, since the communication should not be monitored.

Spain explicitly states: “Ideally, we would prefer it to be legislated that service providers based in the EU cannot use end-to-end encryption. An alternative would be transport encryption, similar to that used in most email communications, which could be searched by the provider on their servers. However, this approach is “very controversial”.

The German government has already announced that it has “considerable concerns about the provisions on disclosure orders provided for in the draft regulation”. A high level of data protection and cyber security, including complete and secure end-to-end encryption in electronic communications, is essential for the federal government. “For this reason, Germany considers it necessary, among other things, to emphasize in the draft that no techniques may be used that disrupt, weaken, circumvent or modify the encryption“, the statement continued.

Seven member countries, including France, Austria, Sweden and Portugal, have not yet commented. It is therefore currently uncertain whether the consideration of audio communication will be included in the Council of Ministers’ negotiating position. However, should this be the case, it could likely intensify resistance to overall chat control even further.

Mass surveillance by order

Per Disclosure Order should enable authorities to oblige online services to automatically check the content of their users systematically and impartially. For such an arrangement, there must be a “significant risk” that, for example, depictions of abuse are disseminated via the service. Critics fear that this term could potentially apply to any service through which users share content.

The German Lawyers’ Association (DAV) shares this view and believes that the provisions are “extremely vague and also so low-threshold that they can basically be applied to all hosting and communication services, especially social networks would be.“

The DAV also notes that the associated obligation to evaluate communication content on a large scale would be incompatible with fundamental freedom rights, would represent a particularly serious encroachment on the confidentiality of communication and, in addition, all users of e-mail, chat and hosting services under general suspicion. There is a risk of significant “chilling effects“, i.e. self-censorship by EU citizens . In addition, interference with the relationship of trust with persons subject to professional secrecy such as lawyers, doctors and journalists could be feared.

This planned mass evaluation of communication content would also contradict the case law of the European Court of Justice (ECJ) in relation to data retention. The court has repeatedly declared excessively broad storage requirements to be unlawful.

The ECJ assessed the handling of traffic and location data. An inappropriate and mass evaluation of content, as envisaged in the current Commission draft, would go “far beyond the previously discussed measures of the data retention“, according to the statement of the DAV. The chances of the law surviving litigation would be correspondingly poor.