Chat Control 2.0 (CSAR): a risk list

CSAR is a proposed EU Regulation whose purpose is "to prevent and combat child sexual abuse" (procedure 2022/0155(COD))¹.

Most of the public opposition to CSAR boils down to "no surveillance" as a first principle, full stop. On the other side, there are at least some documented cases where the existing, voluntary Chat Control 1.0 has helped catch people committing crimes against children — which is usually where the counter-argument lands: "yes, but we will save the kids". Both of these are too short to be useful.

Here are my notes, and a huge list of references for further investigation.

There are two similarly named EU laws

CSAR is not to be confused with the Child Sexual Abuse Directive — a separate EU law with an almost identical name, currently also under revision.² The Directive is criminal law: it defines the offences and the penalties — what counts as child sexual abuse and how it is prosecuted. CSAR defines what online services must do about it: detection, reporting, and removal. This post is only about CSAR.

What happend on July 9?

On 9 July 2026, the European Parliament voted on a proposal to reject the Council's extension of the temporary ePrivacy derogation commonly called "Chat Control 1.0".³

Of the MEPs voting, 314 supported rejection and 276 opposed it. However, rejecting the Council text required an absolute majority of all Parliament's members — 361 votes — so the rejection failed.⁴ The temporary framework allowing providers to voluntarily scan certain private communications for child sexual abuse material therefore moved forward, with additional Parliament amendments intended to exclude end-to-end encrypted communications and limit the scope of scanning.

This vote concerned the temporary "Chat Control 1.0" rules, not the permanent CSAR proposal commonly called "Chat Control 2.0".

CSAR remains under negotiation and has not yet been adopted, so there is currently no confirmed date on which it will take effect.⁵

Scanning private communications without consent becomes legal

EU law is clear that scanning private communications is illegal without consent.⁶

CSAR practically changes this, by permitting "voluntary" scanning of content.⁷

before: scanning was prohibited unless covered by a (temporary) exception.³
after: scanning becomes an ordinary, permanent legal possibility under EU law.

Note

Even the "voluntary" version has been questioned by the Council's own lawyers, who warned that indiscriminate scanning of private communications is incompatible with EU fundamental rights.⁸

On-device scanning is the only technically viable option

What does scanning mean?

A chat app may scan the content (your texts, photos, videos) either on-device, in transit (as the message is transmitted) or in storage (when the message is stored in their servers).

Modern apps apply cryptography to encrypt these messages, and the strongest model is end-to-end encryption (E2EE). This means that the message is encrypted before leaving your device and it can only be decrypted on the device of the recipient. If properly implemented, it is computationally infeasible to decrypt the message without the keys stored in the recipient's device.

The initial version of CSAR did not exempt end-to-end encrypted services from detection obligations.⁹ In practice, complying would mean weakening encryption — for example, by adding backdoors — so that messages could be decrypted without the sender's or recipient's consent. This approach introduces many problems, including the possibility of a security leak that would jeopardize the security of every user's communications to criminals and foreign adversaries.

The Commission repeatedly stated that it was not banning end-to-end encryption. At the same time, depending on the final text, providers may be required — or permitted — to detect known CSAM (Child Sexual Abuse Material), unknown CSAM, and grooming.

Which leaves providers with only one option: scan all content, on-device, before it is encrypted.

Millions of false positives

So, your phone, or your laptop, will have to scan content you send and receive to identify CSAM.

Scanning can be classified under two categories:

Match a content hash (a digital fingerprint) against a database of known CSAM hashes.
Try to use machine learning and fuzzy algorithms to identify unknown CSAM.

The first one is a mature and very low-error method. The second one is much more prone to errors.

But here is where big numbers are important. Even 0.1% false positives, across billions of daily messages, produces enormous volumes of flagged innocent content — and every flag is a person suspected of one of the worst crimes that exist.¹⁰

That photo you sent to your doctor in a moment of despair, when the rash on your kid's belly looked extremely alarming? It could flag you in some database as a potential child offender.

Not to mention consensual sexting between teenagers. How would you feel if your 17-year-old, who is texting and exchanging photos with their partner, was accused of CSAM or grooming? In order to "protect" our kids, we may be actually harming them.

Keep in mind that wrongful suspicion is not the only consequence in these cases: flagging may lead to house searches and police database entries.¹¹

Note

The European Parliament's own study concludes that no technology can detect CSAM or grooming without unacceptable error rates, and that consensual teen imagery is a known weak spot of the classifiers.¹²

CSAM scanning is an attack vector

On-device models and hash databases can be extracted and reverse-engineered.¹³

Perceptual hashes admit adversarial collisions — i.e. innocent-looking images crafted to match database hashes. This isn't hypothetical. Shortly after Apple announced NeuralHash in 2021, researchers demonstrated practical hash collisions.¹⁴

This is a new attack vector: an adversary can send victims content that appears innocuous but will trigger reporting. People already harass journalists by sending them CSAM and then reporting them to the authorities. Automated reporting might provide a means to scale up such attacks.

Dear politician, you will be the victim too

Keep in mind that politicians may be among the first victims of such an attack.

How would you feel if, before an important vote or election, it was relatively easy for your opponents to trigger an investigation accusing you of distributing Child Sexual Abuse Material?

Now, add to this that flagged users are not notified, cannot contest the classification, and may enter police databases as CSAM suspects on automated evidence — with downstream effects on employment vetting, custody, border crossings.⁹

The remedy for false positives is even worse

OK, you may say, we will put guardrails, to protect innocent citizens from being wrongfully accused. We can't entirely depend on automated systems, we will also have humans review these flags.

CSAR has this covered: flagged content may be reviewed by provider staff, by the EU Centre, and by law enforcement.⁹

Not really a remedy

So, the remedy for machine error is industrial-scale human reading of the most private content, and the EU Centre becomes a standing archive of Europe's most sensitive flagged material: a breach target without precedent.

Purpose creep: once the infra is in place, it can be used for any type of content

Once the technical ability, the legal framework and the legal procedures for client-side scanning against a centrally distributed database exist, extending it to other content categories is a political decision, not a technical project.¹⁵

Child sexual abuse is something everyone agrees on, so it's always the first step of such frameworks. But it is important to understand CSAR is not just a law. It is also a technical framework and infrastructure that makes flagging additional types of content just a database update.

The next target could be something more controversial, like immigration. Then maybe something even more controversial like copyrighted material. Then a vague definition of misinformation. Then some type of dangerous political speech.

You may say that most or all of these things are already covered by existing laws. But these laws have processes and visibility, cases have to be brought to justice, and they can be challenged, and the prosecuting authorities have to pick where they spend their time and resources; which is a welcome limitation that makes the system work better.

CSAR is automated enforcement: no friction, zero cost to scale. You can't sue 1,000,000 EU citizens in one afternoon, but you can easily flag them under the suspicion that they sent illegal material.

The blocklist is secret and unauditable

And, what is in the blocklist, anyway?

Ordinary users cannot inspect the hash lists the EU Centre would distribute, and independent public auditability is inherently limited — reviewing the source material (CSAM) used to build it is itself illegal.

So, we have a scanning system that we can't review what it is scanning for, and even curation errors (not to mention intentional abuse) propagate silently to every device in Europe.

If you think shadow banning in social media is bad, think about a centralized blocklist, blessed by EU Regulation, that you can't review, and which — for some weird reason — is blocking your content.

No need for bad actors

It requires no future bad actor, only ordinary bureaucratic error, for a photo or an image to be classified as suspicious.⁹ It could be the embarrassing photo of a politician, or a famous work of art, or just a meme.

Exporting the risk outside the EU

While EU citizens may accept that they can trust their local legal framework, messaging is global. Protocols and clients are shared.

If EU compliance weakens clients or protocols, it degrades the security of at least everyone who communicates with EU users, including journalists, dissidents, and abuse victims outside the EU whose threat models are far worse.

It also exposes EU users when they communicate with users outside the EU to these threat models too, since other jurisdictions may flag other types of content.

Worth mentioning

Podchasov v. Russia (2024)¹⁶ is the mirror image: the European Court of Human Rights found that forcing a provider to weaken encryption for all its users violates the right to respect for private life — in a case where Russia's FSB required Telegram to hand over information that would allow decrypting users' messages.

The small-provider / fediverse problem

CSAR's core obligations — risk assessment, mitigation, reporting, exposure to detection orders — apply to hosting and communication services of any size. There is no exemption for small providers, unlike other EU digital laws.¹⁷

What does a risk assessment mean for a single-admin Mastodon or Matrix homeserver? What about a decentralized, open source project? Who serves a detection order on software with no company behind it?

This leads to compliance costs only Big Tech can absorb and further centralization of communications onto the platforms whose scanning produced the justifying dataset.

I thought we wanted to disentangle from US-based Big Tech

This may be the best way to kill any EU-based startup, or open source community, building a messaging alternative and proliferate US-based services dominance.

Is it even worth it?

Client-side scanning in mainstream apps is trivially defeated by motivated users: pre-encryption, custom clients, self-hosted servers, non-compliant platforms.

Even assuming a perfect classifier, the users reliably covered are practically the ones who aren't hiding anything.

This is the big question

So, given all the risks to privacy, freedom of speech, the introduction of new attack vectors, the collateral damage caused by false positives and their mitigation mechanisms, and a system that EU citizens will rightfully distrust, is it worth it?

Are there concrete data proving that CSAR will actually have any effect in combating the sexual abuse and sexual exploitation of children?¹²

blog.vrypan.net