The End of Chat Control?

The Regulation to Prevent and Combat Child Sexual Abuse (better known – and much better framed - as Chat Control) dates back to at least the year 2020, when the European Union first started considering its options in this regard. In 2021, a temporary derogation to the ePrivacy Directive (a piece of much older legislature, but still in effect) was adopted. The derogation did not affect end-to-end (ETE) encrypted communications, and service providers were not obligated to integrate it into their systems. Despite this, it is often dubbed ‘Chat Control 1.0’ - a test run of what was to come.

Skip forward to 2025: Denmark assumes the EU Presidency at the beginning of July, and shortly after that, a new and revised draft of Chat Control is unveiled; this time including mandatory and broad-scale monitoring (i.e, not affecting only those under suspicion, but all EU citizens, with the exception of government employees and representatives, naturally). This monitoring would extend to videos and images sent not only through unencrypted communication channels, but even those that relied on ETE encryption, such as Signal or WhatsApp

Experts were quick to point out the dangers of such legislation. Firstly, encryption standards would need to be drastically lowered. This would make all EU citizens vastly more susceptible to the whims and schemes of not just foreign intelligence agencies, but also wildcard non-state actors (hackers, scammers, and many other nefarious threat actors). It certainly wouldn’t be the first nor last time a government database was compromised. Secondly, should any semi-authoritarian or authoritarian regime arise in or join the European Union, it could make simple use of such a system to surveil investigative journalists and political dissidents on all levels of society. For more arguments against Chat Control, see the striking https://stopchatcontrol.eu/ – we need not reproduce them all here.

The Latin phrase cui bono should be familiar to all students of law – it can be translated as who benefits? Most commonly used as a foundation for determining a criminal suspect’s motive, it rests on the premise that people generally act in their own self-interest. Outside of the usual suspects that we have here (ruling governments, police forces, militaries, and others), there is also the curious case of the specific software - and the organization behind it - that was to allegedly be the covert heavyweight champion of Chat Control.

Enter Thorn: an American organization classified as a charity and nonprofit by the US Internal Revenue Service (IRS). It was - somewhat bizarrely - founded in 2010 by none other than Hollywood stars Ashton Kutcher and Demi Moore (THE DEMI AND ASHTON FOUNDATION, per IRS data). Despite allegedly being a charity/nonprofit, one can inspect their website and with relative ease discover that they offer both ‘products’ and ‘services’ (as well as clearly having a dedicated ‘sales’ department - https://www.thorn.org/solutions/contact-sales/) designed to mitigate harm to children in the digital space. Their “For Platforms” solutions section specifically mentions a solution dubbed “Safer CSAM and CSE-text detection” – this directly echoes what we can observe in Chat Control 1.0.

Thorn has been identified as one of the leading lobbyists behind Chat Control (see https://www.euractiv.com/news/chat-control-european-ombudsman-condemns-revolving-door-between-europol-and-ai-company/). It is an entity operating in and registered in the United States. As such, it could easily be the object of a US government data request or subpoena, thusly providing vast amounts of personal information about virtually any EU citizen. Even more alarming is the potential of a backdoor giving complete access – something that would very much play into US strategic interests. One only need recall the scandal involving the bugging of Angela Merkel’s mobile phone (allegedly revealed by Edward Snowden, see https://www.bbc.com/news/world-europe-24690055).

Nevertheless, the battle has been won for now. The official vote on Chat Control has been postponed, in large part thanks to the efforts of German citizens and activists (and a last-minute decision by the Czech government). To quote Dr. Patrick Breyer, "[t]he proponents of Chat Control will use every trick in the book and will not give up easily. We will keep fighting until this proposal is defeated once and for all, and the privacy of our digital lives is secure for everyone." Though Chat Control 2.0 may be dead, Chat Control 3.0 is coming.

The war goes on.

Stay Alert.

Sylvester, 20/10/2025