Why Nym is against Chat Control
They call it "child protection. What it is in practice is a machine that reads every message before you send it.


Share
Chat control is back, and Brussels has changed the rules to force it through. This week the European Parliament voted to reinstate the "temporary" regime that lets platforms like Meta scan private messages for child sexual abuse material — the same extension MEPs rejected in March, 311 votes to 228. The European People's Party revived it through a rare procedure that flips the math: the law now passes unless at least 361 MEPs actively vote it down. Today they didn't.
The permanent version, the Child Sexual Abuse Regulation (CSAR), grinds on. Its supposedly final trilogue collapsed on 29 June over the Council's demand for suspicionless scanning, and the fight now passes to the Irish presidency. The branding keeps changing — "upload moderation," "detection orders," "voluntary" derogations. The idea does not: software that inspects your private messages before you hit send. Here is why Nym fiercely opposes it.
1. Chat Control is mass surveillance wearing the mask of child protection.
Every version of this zombie makes the same move: take a real horror, the sexual abuse of children, and use it to justify inspecting everyone else's private messages.
The objective is one almost everyone shares. The method — scanning a whole population to find the guilty few — is what surveillance always looks like. EDRi calls this the most criticized draft EU law of all time. Mass surveillance never arrives as surveillance. It arrives as safety.
2. It reads your messages before they're encrypted. That's the whole trick.
Chat Control can't break end-to-end encryption head-on, so it goes around it. Client-side scanning inspects the files on your own device before encryption is applied.
Picture your phone checking every photo and message against a government-supplied list, then reporting matches to the authorities. The message is still "encrypted in transit," that is, after a copy has already been read. Let's just call it a backdoor with better manners.
3. The technology does not work, and Europe's own scientists proved it.
This isn't just Nym's opinion. More than 700 of the world's leading cryptographers say so in an open letter co-authored by Bart Preneel — KU Leuven professor, one of the most cited cryptographers alive, and a Nym advisor. Their verdict: the detection technology is doomed to be ineffective.
Every method fails in its own way. Exact-match hashing catches only unmodified files. Crop or recompress an image and it slips through. Perceptual hashing can be defeated by changes invisible to the eye, or tricked into flagging innocent pictures to bury investigators in noise. Machine-learning detectors are so context-blind they can't tell abuse from a parent's medical photo. The people who build this technology are telling governments, in writing, that it can't do what the law promises.
4. At internet scale, "rare mistakes" become hundreds of thousands of innocent people.
A detector that's 99.9% accurate sounds impressive until you run billions of messages through it daily. Then the false positives arrive in the millions.
This isn't hypothetical: the Swiss federal police found that up to 80% of machine-generated reports weren't criminally relevant: holiday photos, kids at the beach, teenagers texting or sexting. Every false hit is a private moment pulled out and read by a stranger just to clear it. Chat control manufactures suspicion against the innocent at industrial scale.
5. "Upload moderation" is a rebrand, not a redesign.
As usual, watch the language. When "breaking encryption" drew too much fire, the proposal returned as "upload moderation," then as a "voluntary" scheme you "consent" to. Signal's president Meredith Whittaker cut through it: "We can call it a backdoor, a front door, or upload moderation. But whatever we call it, each one of these approaches creates a vulnerability."
The consent is, of course, a fiction. Refuse the scan and you're blocked from sending images or links at all. Preneel called the rebranding smoke and mirrors. It's not consent if you don't have a viable alternative.
6. A backdoor for the good guys is a backdoor for everyone.
There is no scanning system that reads only criminals' messages. Once the power to inspect private communications sits on billions of devices, it's available to anyone who can reach it: hostile governments, hackers, and future officials with new priorities. Encryption works for everyone or it's broken for everyone.
7. Once the scanner is installed, the target list can be changed silently.
The detector doesn't understand what it's hunting. It matches against a list or a trained model, and that list can be swapped with a remote update. The scientists' letter is explicit: nothing technical limits scanning to abuse material. The content depends on what political operators decide to feed it. Do you trust your politicians today even? What about the next batch that come along?
Add the fingerprint of a banned pamphlet, a protest flyer, or a leaked document, and the same machinery reports those instead. Because the list can't be inspected, no user can verify it looks only for what it claims to. A tool built for one purpose, on every phone, waiting for a configuration change: that is what the surveillance state looks like as hardware.
8. To enforce it, they have to come for the tools that protect journalists and dissidents.
Scanning only works if you can't opt out. So the encrypted apps that refuse to comply get pushed out, and the privacy tools people use to reclaim their communications get blocked. The same infrastructure that stops abuse material from being shared protects a journalist's source, an activist under an authoritarian government, and an ordinary person in a censored country. You can't dismantle private communication for the guilty without dismantling it for the people who need it most.
9. Signal and others will leave before they comply, and the courts are already skeptical.
Signal has said plainly it will leave the EU rather than weaken its encryption. So the law's first achievement could be to drive the most secure messenger off the continent while serious abusers move to tools beyond EU reach.
The legal ground is shifting too. In Podchasov v. Russia, the European Court of Human Rights ruled that weakening end-to-end encryption for everyone can't be justified. The EU would be mandating exactly what its own human-rights court says states may not do.
10. It keeps dying because Europe keeps rejecting it. It keeps coming back anyway.
Chat control has been voted down, postponed, and rebranded for four years. A blocking minority led by Germany killed the mandatory-scanning version in October 2025. The "voluntary" regime expired in April 2026. Parliament rejected its extension in March. Now it's back in July, through a trick designed to make rejection harder. This isn't democracy.
This is how surveillance law passes: not in one vote, but by returning until the public stops watching. The way to protect children is the way experts keep pointing to: funding investigators, prevention, and better platform design, not scanning half a billion people's messages. Nym is against chat control because privacy is not the enemy of safety. Mass surveillance is.
Nym opposes chat control for the same reason we build what we build: privacy has to be designed into the technology we use. Metadata – who you talk to, when, and from where – is as revealing as any message, and a system that scans your communications maps your life.
The alternative isn't "nothing." It's real end-to-end encryption, technology that proves what it needs to without exposing who you are, and resources aimed at the crime instead of the population. As Preneel keeps asking, it's unclear why governments reach for mass surveillance instead of preventing the abuse itself. Until they answer that, the scanning stays automated and pointed at you. We won't pretend that's protection.
Another type of internet is still possible.
About the authors

Casey Ford, PhD
Communications LeadTable of contents
Keep Reading...

Why Nym is against age-verification laws
They claim it's about protecting children. It's really about surveilling everyone.

The fight for the Internet is a human one: What Nym can do to help
The tools for creating and open and private Internet are being forged, and you can help

Nym is building a private internet without walls
NymVPN’s 2026 roadmap for censorship resistance and resilient online privacy for all


