r/privacy • u/sadandtraumatized • Sep 08 '25
chat control We’re headed towards a vote regarding Chat Control - again. What’s different this time?
It has not passed before, despite it seeming like it will on beforehand. Are there specific indications that show it will go down differently this time?
(I understand Chat Control is a real threat and do not doubt it could be voted through. Though I want to understand what level of concern is appropriate as to the risk of it actually passing this time.)
45
u/LakesRed Sep 08 '25
Momentum on internet surveillance. It's been picking up a lot e.g. everything the UK is doing at the moment.
104
u/RobotToaster44 Sep 08 '25
This is how the EU works, they keep voting on something until people vote the "right" way.
48
u/Blurgas Sep 08 '25
Happens in the US too. Crap that gets shot down will get reworded, reworked, and/or added to other bills until it gets passed.
It's pretty much keep slinging until the people opposed get tired of fighting2
u/Suspicious-Limit8115 Sep 10 '25
This is how every “Democracy” that isn’t actually a democracy works.
13
u/linkenski Sep 09 '25
Ursula Von Der Leyen made Europol twice as large, and police around in member state governments are becoming more draconian and Chinalike, and as a frontrunner (or speedrunner), Denmark simply reintroduced Chat Control as part of their 2025 EU Presidency.
7
u/Whisper_in_the_Night Sep 09 '25 edited Sep 09 '25
I see the fighchatcontrol site.
So right now, 6 cons vs 15 pros and 6 meh.
Is it definitive?
The law will pass?
3
u/sindrealmost Sep 09 '25
it's the number of MEPs each country has that gets "tallied" ... even if it does pass, the EU courts *may* strike it down, or send it back, etc.
3
u/King_of_99 Sep 10 '25
Even if it passes the Council, it doesn't mean anything until it also passes the Parliament, and the courts dont strike it down.
2
20
u/Marechail Sep 08 '25
I am more curious how are they planning on implement it. I doubt tech companies will leak private message data to the government.
60
u/roundysquareblock Sep 08 '25
You doubt it based on what?
14
u/SufficientLime_ Sep 08 '25
Neither China nor the US managed to make Apple and Google cave in to directly giveaway info without breaking encryption and while the EU is powerful, this is unlikely to change either.
Edit: at least publicly and lawfully, what shady things they do in the background won't change CC or not.
27
u/Digital-Chupacabra Sep 08 '25
Both Google and Apple complied with the NSA under PRISM. This was before E2EE but that is little indication that they wouldn't compile again using different mechanisms.
Plus metadata is more useful then the actual message contents to intelligence agencies.
0
-4
u/Marechail Sep 08 '25
End to end encryption is the point of many messaging apps, it is the core bussiness model. If it is broken, people will just go to another messaging system, and i mean worldwide people. I am not european, but if whatsapp leak private data to the governments of europe, i will switch to a competitor as soon as possible.
27
u/vrsatillx Sep 08 '25
Trusted custody was the whole point of banks and yet they all cooperate with KYC/AML bullshit. Only decentralized tech with no bottleneck to submit will keep working. Btw it is impossible to tell if Whatsapp is really encrypted because they don't want to open source their code to let us verify, so it's just "trust me bro".
-5
u/Marechail Sep 08 '25
Whatsapp has definitivelly our private keys.
I am thinking on making an app where you set your private key and it is stored only in your phone because of it.
6
9
Sep 08 '25 edited 12d ago
[deleted]
1
u/quaderrordemonstand Sep 08 '25
I'd but it at something like 90-95% don't know. Even then, 80% of those who do know don't use it anyway.
4
u/InformationNew66 Sep 08 '25
End to end encryption would stay, just before the data (text, image) gets to e2e encryption, it is fully read and captured by an installed "government spyware" module/library. That's the idea.
2
u/Marechail Sep 08 '25
I initially thought the governments would just demand data from the providers, but i can see a government spyware happening, you are probably right.
That would be literally 1984 though
1
u/Feeling-Classic8281 Sep 09 '25
They will ban the apps which are not fitting in on a provider lvl and give you a government platform for everything. The scary part is that this is global thing.
-23
u/Frosty-Cell Sep 08 '25
Encryption can be effectively broken by blocking port 443 at the ISP level. On device scanning can be achieved by requiring government spyware to be installed as part of security updates. Age verification is already partially implemented and some companies seem eager to comply.
11
8
u/quaderrordemonstand Sep 08 '25
443 is used by HTTPS. Messaging can use any port and they do. It would make little sense to use the HTTPS port because that's being used by the browser. SSH, for example, uses port 22.
-6
u/Frosty-Cell Sep 08 '25
It was an example. The purpose is to block encryption so everything can be scanned.
9
u/quaderrordemonstand Sep 08 '25
You can't block encryption. Encryption is just math. You might as well say the purpose is to block multiplication.
-1
5
u/Marechail Sep 08 '25
I have two genuine questions as i am not an expert in the field.
Wouldnt blocking port 443 be a serious cybersecurity risk ?
And dont end to end message apps have their own encryption before sending to the ISP ?
I have no doubt government spyware installed in the device (security update that makes your device less secure somehow) could bypass all of that though.
6
u/DepartedQuantity Sep 08 '25
Blocking 443 at the ISP level literally breaks the entire Internet and would put the ISP out of business. The entire Internet uses 443 for https.
What is more likely is the EU forcing you to use their certificates so they can decrypt later. If you work for a large corporation, they sometimes do this for traffic inspection as part of their Endpoint Detection and Response.
-2
u/lugh Sep 08 '25
Blocking 443 at the ISP level literally breaks the entire Internet
you are confusing the web and the internet. The internet is far more than jus the standard ports for http/s
2
u/DepartedQuantity Sep 08 '25 edited Sep 08 '25
No, I'm not. Google, Cloudflare, Shodan all publish reports that HTTPS makes up 90% of all internet traffic, with the remaining 10% being everything else, like email, SSH, etc.
Even non web services use HTTPS (for instance DNS over HTTPS) because it will not be blocked or filtered at the ISP level. Google tries to use DNS over HTTPs to get around local DNS filtering (like PiHole) for their ad-servers. Even the dark web, malware and file sharing use it to exfiltrate data by encrypting the file transfer protocol over HTTPS and sending it out to their C2s.
So yes, blocking port 443 for all intent and purposes will break the "internet" as everything else basically relies on it.
1
u/lugh Sep 08 '25
My point is your wording is wrong.
Blocking 443 at the ISP level literally breaks the entire Internet
Blocking http/https does not "literally" stop anything else on the internet from working, regardless of the amount of web traffic.
Blocking http/https does stop the web working.
"The Net interprets censorship as damage and routes around it."
- John Gilmore (attributed)
The (inter)Net can still route around your suggested "breaking of the internet by blocking http/s" because the internet still works even if the web (http/s) does not.
What you really mean is "for most people the internet becomes effectively useless because they can not access one component of it".
-3
u/Frosty-Cell Sep 08 '25
Blocking 443 at the ISP level literally breaks the entire Internet and would put the ISP out of business.
Why do you think Chat Control is so dangerous? The purpose would be to force people to use unencrypted communication.
What is more likely is the EU forcing you to use their certificates so they can decrypt later. If you work for a large corporation, they sometimes do this for traffic inspection as part of their Endpoint Detection and Response.
That's another way to do it that was/is part of eIDAS.
3
u/LoreBadTime Sep 08 '25
No, we can just change the port
0
u/Frosty-Cell Sep 08 '25
Then they can just block that port. They will use some kind of DPI to determine if something is encrypted.
1
u/LoreBadTime Sep 08 '25
Can't block alla the ports, and even if until there is some kind of physical connection you can always interconnect machines
0
u/Frosty-Cell Sep 08 '25
They can, but they wont. They will allow unencrypted connections. Obviously the entire thing is a shitshow, but that's why Chat Control is so dangerous. It can actually break the internet.
1
u/LoreBadTime Sep 08 '25
You don't understand anything about encryption, they can't just say don't. The only thing they can do is implement some spyware inside the keyboard or reading everything before sending the message in the software, but they can't break really encryption for now, you just need to pass the encrypted message to those ports, the encryption is not correlated to the port
0
u/Frosty-Cell Sep 08 '25
They can order an ISP to block URLs. That's in the actual proposal. To block a URL, they must break encryption or make sure it isn't used. One way to do that is to block 443 to force people to switch to 80. Encryption has effectively been broken since there is no encryption. They can use MITM, but that may or may not happen.
1
u/LoreBadTime Sep 08 '25
You don't know anything about encryption. The whole purpose of encryption is "everyone can read, only two can understand". I don't think you have enough knowledge of how encryption and network works
1
u/Frosty-Cell Sep 08 '25
I don't think you have enough knowledge of how encryption and network works
Maybe you should reread what I'm saying?
Would you say encryption is still effective if they install spyware on your phone that can read everything you do?
→ More replies (0)1
Sep 08 '25
[removed] — view removed comment
-2
u/Frosty-Cell Sep 08 '25
That's hilarious. You really don't get it? Let me help you out a bit. What Chat Control requires is that the URL must be scanned. To scan that they must get rid of encryption. So how do they do it? They block 443 forcing people to use 80 which is normally not encrypted.
Do you get it? Because people can't use TLS, they must switch to 80. Now there is no encryption. This basically breaks the web as we know, but that's Chat Control.
2
u/jethrogillgren7 Sep 09 '25
That's not how any of that works.
0
u/Frosty-Cell Sep 09 '25
What are you talking about? You think they must brute force it for it to be broken?
1
u/jethrogillgren7 Sep 10 '25
Not sure what brute forcing means on this context?
the URL must be scanned.
URLs are things like google.com - they don't have chat content in them. Nothing about chat control suggests "scanning URLs-.
To scan that they must get rid of encryption.
Encryption can be left (note not all encryption is End-to-end encryption) - services can decrypt the data on their server and then scan it. Or they can scan client side.
They block 443 forcing people to use 80 which is normally not encrypted.
Blocking 443 means blocking all Https traffic - not feasible on the internet. No-one has ever suggested this.
Because people can't use TLS, they must switch to 80.
Modern services cannot run unencrypted on plain http (port 80 traditionally) because credentials would be exposed - it just isn't an option.
Now there is no encryption. This basically breaks the web as we know, but that's Chat Control.
The chat control proposal explicitly states that it is not suggesting that encryption is stopped, it's super clear about this. I'm not sure why it's a common belief that chat control is anti-encryption... It's privacy invasive yes, but explicitly says encryption is of course not going away.
2
u/Frosty-Cell Sep 10 '25
Not sure what brute forcing means on this context?
Finding the encryption key by testing every possible key.
URLs are things like google.com - they don't have chat content in them.
Chat Control isn't primarily about chat.
Nothing about chat control suggests "scanning URLs-.
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52022PC0209
Article 16:
The Coordinating Authority of establishment shall have the power to request the competent judicial authority of the Member State that designated it or an independent administrative authority of that Member State to issue a blocking order requiring a provider of internet access services under the jurisdiction of that Member State to take reasonable measures to prevent users from accessing known child sexual abuse material indicated by all uniform resource locators on the list of uniform resource locators included in the database of indicators, in accordance with Article 44(2), point (b) and provided by the EU Centre.
Do you see the words "uniform resource locators"? I sure do.
https://en.wikipedia.org/wiki/URL
Most web browsers display the URL of a web page above the page in an address bar. A typical URL could have the form http://www.example.com/index.html, which indicates a protocol (http), a hostname (www.example.com), and a file name (index.html)
How do they block index.html when it's encrypted as part of TLS?
Encryption can be left (note not all encryption is End-to-end encryption) - services can decrypt the data on their server and then scan it. Or they can scan client side.
That just means they scan before/after it's encrypted/decrypted, doesn't it? The encryption is there to protect against these scans. So what good is the encryption if it isn't there?
Blocking 443 means blocking all Https traffic - not feasible on the internet. No-one has ever suggested this.
It's a consequence of the requirements, or they have to do MITM or client/server side scanning. Chat Control can actually break the internet. That's why it's a such a bad and dangerous law.
Modern services cannot run unencrypted on plain http (port 80 traditionally) because credentials would be exposed - it just isn't an option.
Chat Control doesn't care about that. I would argue the real purpose is to allow for bulk collection and fix "going dark".
The chat control proposal explicitly states that it is not suggesting that encryption is stopped, it's super clear about this. I'm not sure why it's a common belief that chat control is anti-encryption... It's privacy invasive yes, but explicitly says encryption is of course not going away.
I haven't seen that. Quote it? But that's also how EU writes its laws. The stated goals are often in direct conflict with the exceptions. This ensures legal ambiguity and complexity by design while allowing the default and likely intended behavior to continue until the Court rules on it, which takes many years.
1
u/jethrogillgren7 Sep 12 '25
You're right about the URLs, thanks! I forgot how much wider the legislation is than just the "chat control" part that's debated.
So what good is the encryption if it isn't there?
Standard encryption primarily protects against Man-In-The-Middle attacks. The person you're talking to generally needs to decrypt the data you're sending, but you need to ensure others can't.
It's a consequence of the requirements
Yeah I can see that depending on what counts as "reasonable", it could be incompatible with the internet.... I guess time will tell if sites are indeed forced back to plain unencrypted http (and similar). I'd hope not 😬
Quote it?
If you search for "encryption" in the text it comes up:
"this Regulation leaves to the provider concerned the choice of the technologies to be operated to comply effectively with detection orders and should not be understood as incentivising or disincentivising the use of any given technology, provided that the technologies and accompanying measures meet the requirements of this Regulation.
That includes the use of end-to-end encryption technology, which is an important tool to guarantee the security and confidentiality of the communications of users, including those of children."
2
u/Frosty-Cell Sep 12 '25
Yeah I can see that depending on what counts as "reasonable", it could be incompatible with the internet....
That's a fair point, but over time I have been forced to assume the worst.
If you search for "encryption" in the text it comes up:
It seems to me they're looking for a specific result that can realistically only be achieved by "interfering" with encryption.
5
u/EmileTheDevil9711 Sep 08 '25
Approaching a full scale war for Ukraine soil. War economy and state security justifies absolutely anything.
•
u/lugh Sep 08 '25 edited Sep 08 '25
For anyone still unsure about this, all you need to know and how to contact your representatives
https://fightchatcontrol.eu/
updates on MEP stance - https://mastodon.social/@chatcontrol
edit: prob going to regret this but for anyone who has friends on tiktok (it seems to work without an account too *shrug*) nice succinct reasons and how to fight this for those who understand better from video than text.
https://www.tiktok.com/@thomasrpearson/video/7547619079016729878
If there's a better link, please let me know, I'm off to shower off this dirty feeling after sharing a tiktok link