Breyer argues the regulation is being deliberately pushed into closed-door trilogue negotiations precisely because public Council debate killed it twice before. He frames the relaunch of fightchatcontrol.eu as a response to a 'double threat': backroom dealmaking combined with cosmetic concessions designed to disguise the underlying mass-scanning architecture.
By submitting Breyer's warning with the framing 'EU to legislate about Chat Control behind closed doors,' the submitter amplifies the procedural critique — that the trilogue format itself is the story, not just the policy content. The 259-point score suggests HN readers strongly endorse this framing.
Breyer dissects the concessions on offer — narrower scope, opt-in elements, age verification carve-outs, professional account exemptions — and argues they are window dressing. The mandatory client-side scanning hooks built into messengers remain the core mechanism, meaning the technical capability for mass surveillance gets deployed regardless of which categories of user are initially exempted.
Breyer reiterates the cryptographic community's three-year-long objection: scanning content before it is encrypted is not 'compatible with E2EE' as the Commission claims — it is a bypass of E2EE by definition. He frames the Commission's continued insistence otherwise as either technical illiteracy or deliberate misdirection.
The editorial argues developers reflexively file this under 'EU privacy drama' and tune out, but that instinct will age badly. Chat Control would be the first serious legislative attempt in a major democratic bloc to mandate client-side scanning as infrastructure — once that hook exists in messengers, the scope of what it scans for is a political question, not a technical one.
Patrick Breyer — the former Pirate Party MEP who has been the loudest civil-liberties voice on Chat Control since the file dropped in 2022 — published a sharp warning this week: the EU's mass-scanning regulation is being pushed back into trilogue, the closed-door negotiation format between Council, Parliament, and Commission where the most consequential compromises happen with no public record. The fightchatcontrol.eu campaign has been relaunched in response, and the post (currently 259 on HN) reads less like activism and more like a procedural autopsy waiting to happen.
The headline mechanic hasn't changed since the proposal first surfaced. Messaging providers operating in the EU would be ordered to scan private communications — text, images, links — for child sexual abuse material (CSAM) and grooming patterns, with detection orders that apply at the client side, *before* encryption. The Commission has insisted this is compatible with end-to-end encryption. Cryptographers and civil-liberties groups have spent three years explaining, with increasing exasperation, that it is not.
What's new is the political choreography. After the Belgian and Hungarian presidencies failed to land a Council position, and after the German government's flip to a no vote temporarily killed the file in late 2024, the topic has resurfaced under a presidency willing to push for a 'compromise' text in trilogue. Breyer's argument is that the concessions on the table — narrower scope, opt-in elements, age verification carve-outs, exemptions for 'professional' accounts — are cosmetic, and the underlying architecture (mandatory client-side scanning hooks built into messengers) survives intact.
Developers tend to file this under 'EU privacy drama' and tune out. That instinct will age badly. Chat Control is the first serious legislative attempt in a major democratic bloc to mandate client-side scanning as infrastructure — not a feature an app might add, but a regulated capability every messenger must ship.
Three things make this round different from the 2022–2024 cycles. First, the venue: trilogues happen behind closed doors with no released drafts and no roll-call votes. The Council position, the Parliament position, and the Commission's preferences get reconciled in rooms where the only public artifact is the final text. That cuts off the lobbying and press pressure that defeated previous versions — there is no draft to leak, no MEP to call, no rapporteur amendment to whip against. Second, the framing has shifted from 'detection of known CSAM' (hash-matching, narrow, technically defensible) to 'detection of unknown CSAM and grooming' — which requires ML classifiers running on user devices, with all the false-positive surface area that implies. Third, several governments that previously balked are now signaling flexibility, and the Commission has telegraphed that it considers the file too politically important to abandon.
The technical objection has not changed and will not change. Client-side scanning is end-to-end encryption with a court-ordered side channel; calling it anything else is marketing. Once a messenger ships a scanning hook, the only questions are who controls the match lists, who audits the classifiers, and what other content categories get appended later. The 'only CSAM' promise has a poor track record — the UK's Online Safety Act, Apple's withdrawn 2021 CSAM proposal (which collapsed under cryptographer scrutiny within weeks), and every export-controlled crypto carve-out in history have demonstrated that scoped surveillance scopes itself outward.
Signal's president Meredith Whittaker has said publicly that Signal will withdraw from the EU rather than implement client-side scanning. Threema has indicated the same. Session and SimpleX, structurally, can't comply even if they wanted to. WhatsApp and iMessage will not withdraw — they have too much European revenue to walk away from — which means the regulation effectively splits the messenger market into 'compliant and scanned' and 'withdrawn from your app store'. For developers building anything with E2EE — password managers, healthcare apps, journalist tooling, secure note apps, encrypted backups — the precedent matters: if EU law can mandate that Signal scan messages, the legal scaffolding for mandating that 1Password scan vaults the same way is already built.
If you ship a messaging or E2EE product into the EU, three things are worth doing now rather than after a final text drops.
Audit where your encryption boundary actually lives — if your 'end-to-end' design has any unencrypted hook at the OS, keyboard, accessibility, or notification layer, that's the wedge a detection-order regime will use. Document the boundary the way you'd document SOC 2 scope, because regulators will ask. Pay particular attention to anything that touches plaintext for indexing, search, or 'AI features' — those are exactly the surfaces a detection order can be served against.
Second, decide your jurisdictional posture in advance. If you're a small team, the realistic option is geofencing — disabling the app for EU app store regions and accepting the revenue loss. If you're large enough that withdrawal isn't survivable, start the legal review now on what 'good-faith compliance' looks like, because the trilogue text will land with implementation deadlines measured in months, not years. Several EU constitutional courts (Germany's Bundesverfassungsgericht has form here, having struck down both data retention and the BND surveillance regime) are likely destinations for challenges; budget for that as a multi-year line item, not a one-off legal expense.
Third, if you build adjacent — federated protocols, decentralized messengers, self-hosted stacks — expect a wave of attention. Matrix homeservers and XMPP deployments have already been cited in Council working documents as 'circumvention vectors,' which is how regulators usually announce the next file. The political calculus is that mandating scanning on Meta and Apple captures 95% of European messaging traffic; the long tail becomes a 'preventing circumvention' follow-on regulation 18 months later, and the operators of small federated servers are the ones who get the compliance letter.
For backend and infra teams who don't ship E2EE: watch the precedent on liability. The Chat Control draft contemplates fines up to 6% of global turnover for messengers that fail to implement detection orders. The DSA established the template; this extends it to the message layer. Future EU files in adjacent domains — age verification, AI Act enforcement, hosting-provider takedown timelines — will inherit the same enforcement structure and the same 'pre-compliance by design' expectation.
The trilogue cycle will likely produce a compromise text before the end of 2026, and the political incentives point toward passage rather than collapse — too many capitals have invested too much credibility in 'doing something about CSAM' to walk away empty-handed. The fight that matters now is not whether Chat Control passes in some form, but whether the final text contains a client-side scanning mandate or settles for the weaker hash-matching-only floor that already exists under voluntary regimes. The fightchatcontrol.eu relaunch is a signal that civil-society groups think the trilogue is going badly; if you build software that touches private communications in Europe, the next six months are when 'watching the file' stops being a hobby and starts being engineering planning.
I have to admit that I don't understand how they can push for this so often! Wasn't this rejected not so long ago?
Just 4 countries are against: Czech Republic, Italy, Netherlands, and Poland.https://fightchatcontrol.eu/
Related recent discussion:>European Commission's Metsola Overrides MEPs to Force Through Chat Controlhttps://news.ycombinator.com/item?id=48657675 (45 comments)
Instead of the usual knee-jerk it would be nice to see some level-header analysis on mechanics of these things - who pays for the time of the people that decide to push this particular piece of legislation, how they manage to get into the door, who personally makes the proposal, how they gather supp
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
The common fallacy people have regarding chat control (and should be clarified) is that it's not like internet is made of a few select providers, anyone can open an encrypted tcp connection from an ip to another, and the global traffic is too massive to be scrutinized, also the most widely avai