The editorial argues that swapping 'mandatory' for 'voluntary' scanning while simultaneously expanding provider liability for CSAM transit converts a constitutional debate about mass surveillance into a procurement decision about liability insurance. Providers will functionally have no choice but to deploy client-side scanning to secure safe harbor, making the distinction cosmetic rather than substantive.
Breyer's office warns that the leaked trilogue text preserves the surveillance architecture by layering 'voluntary' detection on top of expanded liability exposure for providers like Signal, WhatsApp, Apple iMessage, and ProtonMail. He frames this as a double threat — the substantive concession is illusory, and the closed-door procedure prevents democratic scrutiny.
The submitter's chosen framing — 'EU to legislate about Chat Control behind closed doors' — foregrounds the procedural critique over the technical one. The 498-point upvote count suggests the HN community shares the concern that trilogues produce take-it-or-leave-it texts with no public amendment trail, making meaningful opposition nearly impossible before plenary votes.
The editorial highlights that trilogues have no live stream, no published inter-round amendments, and typically produce final texts days before plenary votes. It draws a parallel to the June 2024 Belgian presidency push that only collapsed at the last minute via German abstention, suggesting the procedural opacity is a structural feature being exploited by the Danish presidency's end-of-year deadline.
The editorial invokes Apple's shelved 2021 NeuralHash proposal as proof that the technical reality hasn't changed: you cannot scan E2EE content server-side, so the scanner must live on the device, which fundamentally breaks the E2EE security model. Calling such on-device scanning 'voluntary' does not change the cryptographic consequences for every E2EE app subject to the regulation.
MEP Patrick Breyer's office relaunched fightchatcontrol.eu this week with a specific warning: the EU's so-called Chat Control regulation — formally the *Regulation laying down rules to prevent and combat child sexual abuse* — has moved from open Council debate into closed-door trilogue between the Council, Parliament, and Commission. According to Breyer, the version on the table drops the headline-grabbing language about *mandatory* scanning of private messages and replaces it with a 'voluntary' regime layered on top of expanded provider liability.
The mechanics matter. Under the leaked text, messaging and hosting providers — Signal, WhatsApp, Meta, Apple iMessage, ProtonMail, Matrix homeservers, anyone with a message field — would not be *ordered* to install client-side scanning. Instead, they would be exposed to enforcement risk if 'known' or 'unknown' CSAM material transits their service, and offered a safe harbor if they 'voluntarily' deploy detection. The word 'voluntary' is doing a lot of work here: it converts a constitutional fight about mass surveillance into a procurement decision about liability insurance.
The Hacker News thread (498 points at time of writing) flagged the procedural angle as much as the substantive one. Trilogues are not public. There is no live stream, no published amendments between rounds, and the final text typically lands as a take-it-or-leave-it package days before a plenary vote. The last time this file moved this fast was the Belgian presidency push in June 2024, which collapsed when Germany abstained at the last minute. The Danish presidency, which holds the chair through end of year, has signaled it wants a deal before January.
The technical reality of 'voluntary' client-side scanning hasn't changed since Apple shelved its 2021 NeuralHash proposal. You cannot scan end-to-end encrypted content on a server, so the scanner has to live on the device, which means every E2EE app shipping in the EU becomes a delivery vehicle for a regulator-blessed content classifier running with the user's keys. The 2022 paper from Abelson, Anderson, Rivest, Schneier, and 12 other cryptographers — *Bugs in our Pockets* — remains the canonical takedown: client-side scanning is indistinguishable, architecturally, from a wiretap that the user pays for and carries voluntarily.
The shift from 'mandatory' to 'voluntary' is the part practitioners should read carefully. In EU regulatory tradition, *voluntary-with-liability-stick* is how the GDPR's 'legitimate interest' basis works, how the DSA's 'trusted flagger' regime works, and how the Terrorist Content Regulation's one-hour removal window works. The pattern is consistent: the law doesn't compel the behavior, it just makes any other choice commercially untenable. Signal Foundation's Meredith Whittaker has already said publicly that Signal will leave the EU before integrating a scanner. WhatsApp has been quieter but Will Cathcart's 2023 line — 'we would rather see WhatsApp blocked' — is still on the record. Apple has said nothing since killing NeuralHash.
The second-order effects are where this gets ugly for anyone building infrastructure. The regulation's scope, as drafted, covers 'interpersonal communications services,' which the Commission has previously interpreted to include any feature that lets two users exchange a message. That includes GitHub issue comments, Slack DMs, Discord, Notion comments, Linear mentions, and — by at least one reading floated in the 2023 IMCO committee draft — the chat window in a multiplayer game. The hash-matching databases (NCMEC, INHOPE) are US-controlled, which raises a separate sovereignty question the European Data Protection Board flagged in its 2022 opinion and has not retracted.
Community reaction on HN tracked three threads. First, resignation: a heavily-upvoted comment noted this is the fourth attempt since 2020 and the surveillance machinery doesn't get tired. Second, the technical absurdity of perceptual hashing — false positive rates of ~1-in-a-billion sound impressive until you multiply by the EU's daily message volume and get tens of thousands of innocent images forwarded to law enforcement weekly. Third, the jurisdictional escape hatch: several commenters pointed out that self-hosted Matrix, XMPP, and SimpleX deployments are functionally out of scope, which means the regulation pushes serious privacy users further into infrastructure most governments would prefer they didn't run.
If you ship a messaging product, a file-sync client, or any consumer app with EU users and a text field, three things change. First, your threat model now includes a regulator-mandated classifier running inside your own binary, with update channels you don't fully control, scanning content before encryption. That is not a hypothetical — it is the architecture the 'voluntary' regime is designed to incentivize. Audit your client codebase for any third-party SDK that could plausibly be repurposed as a scanning surface (analytics, crash reporting, content moderation libraries) because that's the integration path of least resistance.
Second, your legal exposure shifts. Under the current text, providers who decline the 'voluntary' scheme face a higher bar to demonstrate they've taken 'all reasonable measures' against CSAM transit. For a small open-source messenger or a self-hosted SaaS, 'all reasonable measures' is undefined and will be defined by case law, which means by whichever provider gets sued first. Talk to counsel about whether your EU entity structure exposes you to direct enforcement or only via your hosting provider. Matrix, Element, and the SimpleX team have all published threat-model updates in the last 18 months; they're worth reading even if you're not in that subfield.
Third, if you operate any infrastructure that *isn't* a messenger but processes user-generated content — a comments system, a forum, a Slack alternative, a GitHub-style code host — read the recitals, not just the articles. Scope creep in EU regulation happens at the recital level and gets locked in by the Court of Justice years later. The DSA's 'very large online platform' threshold started at 45 million users and is now being floated at lower numbers for specific obligations.
The Danish presidency wants a deal before its term ends December 31. The German government, which killed the file in June 2024 by abstaining, has a new coalition with a less clear position on digital rights. If you have an EU policy lead, this is the week to brief them — once trilogue closes, the text is functionally locked, and the difference between a workable carve-out and a binary leave-or-comply decision often comes down to a single recital. fightchatcontrol.eu has MEP contact templates by member state. Whether or not you agree with Breyer's politics, the procedural point is correct: legislation drafted in rooms with no transcript and voted on with no amendments is a worse process than the one that produced GDPR, and GDPR was already bad enough that everyone reading this has billed hours fixing cookie banners.
I have to admit that I don't understand how they can push for this so often! Wasn't this rejected not so long ago?
Just 4 countries are against: Czech Republic, Italy, Netherlands, and Poland.https://fightchatcontrol.eu/
Related recent discussion:>European Commission's Metsola Overrides MEPs to Force Through Chat Controlhttps://news.ycombinator.com/item?id=48657675 (45 comments)
Instead of the usual knee-jerk it would be nice to see some level-header analysis on mechanics of these things - who pays for the time of the people that decide to push this particular piece of legislation, how they manage to get into the door, who personally makes the proposal, how they gather supp
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
The common fallacy people have regarding chat control (and should be clarified) is that it's not like internet is made of a few select providers, anyone can open an encrypted tcp connection from an ip to another, and the global traffic is too massive to be scrutinized, also the most widely avai