This week marks a critical time for the EU as the Council of Ministers and allies in the EPP push for an urgency procedure to re-instate the ePrivacy Derogation (aka Chat Control I) as an entirely new law with identical text to the derogation that was already voted down by the Parliament on the basis that it does not respect the fundamental right to privacy and the interference fails ot meet the strict proportionality requirements that form the bedrock of EU law.
I have fought this law (both Chat Control I and II) as a survivor of child sexual abuse - I told my story nearly 15 years ago leading to arrests and convictions for my abuse and the abuse of over 20 other boys who went to my school.
Without privacy, without confidential communications and without encryption - I would not have told my story and those convictions would never have happened and those victims/survivors would never have seen justice.
So please, if you are reading this - write your MEPs - you can find all their email addresses here:
https://fightchatcontrol.eu/downloads
Below is a copy of the open letter I have sent to 836 of them.
Dear MEP,
Tomorrow you're being asked to vote, under an urgency procedure, to bring back the Chat Control derogation this Parliament has already rejected. I'm asking you to stop and look hard at what's being done here because it's being rushed at you deliberately - a rejected, expired law rewritten as a formally new one with identical content, pushed through at speed precisely so it skips a fresh opinion from the European Data Protection Supervisor and a fundamental-rights impact assessment before landing on your desk right as you break for summer. Whatever you think of the substance, that alone should trouble you.
I'm a survivor of child sexual abuse. I'm also a technologist and social scientist who, back in 1992, started one of the first online efforts to track down the people who produce and share this material, working with law enforcement across the world. So I'm the last person who wants abusers to walk free - and I understand the technology being proposed better than most, which is exactly why I'm begging you not to do this.
Detection happens after the fact. By the time there's an image to scan, the child has already been raped - and I use that word on purpose, since "abuse" softens what is actually done to us. Scanning the whole of Europe's private communications does not save that child. It drives the abuse further underground, where it becomes far harder to find. There's only one thing harder than finding a needle in a haystack - finding the same needle once you've buried it in a stack of identical needles, which is exactly what scanning hundreds of billions of messages a day creates.
Survivors depend on confidential communication to find help and to find the courage to speak. I didn't have that as a child - my communications were watched by the very people abusing me and there was no one I could safely turn to, part of why it took me twenty years to report the crimes against me. When I finally did, it was the existence of encrypted, private messaging that gave me the courage to tell my story - and that reporting led to multiple convictions. Take confidential communication away and you don't protect the next child in my position. You silence them.
This is why the Parliament was right to reject it - and why proportionality, the keystone of EU law the Court of Justice has upheld again and again, cannot be met by mass surveillance. If we genuinely want to protect children, we have to go upstream and ask why so many are ending up in the water in the first place - and fund the research into the causes that politicians have dodged for decades while throwing money at silver bullets that turn out to be blanks.
I've attached my Master's thesis on this exact Proposal. I wrote it as a privacy lawyer and as a survivor of the crime it claims to address - and it sets out in full why this approach fails the very people it says it protects and why it can't be lawful under the Treaties. So I'm asking you to do two things: refuse to let this be rushed through under urgency, stripped of the scrutiny, the EDPS opinion and the impact assessment it is deliberately trying to escape - and before you cast your vote, please read it. You owe the children this Proposal claims to be for at least that much.
Thank you for reading this - and for whatever courage you can find tomorrow.
Alexander Hanff (LLM, CIPP/E, CIPT) Privacy expert, technologist and survivor
Please make the effort - privacy is too important to throw away on surveillance disguised as "protecting children" - the technology doesn't work and even if it did it wouldn't stop child abuse because the abuse has already happened before the images are ever shared online.
I was abused, I ran one of the World's first online support groups for abuse survivors, I worked directly with law enforcement around the world tracking down those who distribute CSAM and I wrote a dissertation 29 years ago on the issues we face why and how to combat them - my Master of Laws thesis 27 years later illustrated the same issues - nothing has changed.
Survivors and victims need confidential communications, don't take that away from us.
