An unprecedentedly broad range of stakeholders have raised concerns that despite its important aims, the measures proposed in the draft EU Child Sexual Abuse Regulation are fundamentally incompatible with human rights. This Article was orignally published at edri.org.

The proposed EU ‘Regulation laying down rules to prevent and combat child sexual abuse‘ (2022) (CSA Regulation, or CSAR) has raised concerns that it is incompatible with EU fundamental rights and case law – perhaps more so than any other EU law in recent memory.

Whilst all stakeholders agree on the importance of the aim to protect children, all formal legal and technical assessments have concluded that the proposed measures could amount to disproportionate violations of everyone’s privacy, personal data and free expression online, and rely on technically infeasible or dangerous measures.

Read on to see how a wide range of stakeholders, including child protection experts, survivors of CSA, police, national governments, UN officials, companies, NGOs and others have warned that the proposed measures are misguided and could do more harm than good.

“[The CSA Regulation] could become the basis for de facto generalised and indiscriminate scanning of the content of virtually all types of electronic communications of all users in the EU/EEA”
– The European Data Protection Board (EDPB) and Supervisor (EDPS)

EU institutions and case law

The Court of Justice of the EU enforces strong protections for privacy, data protection, free expression, non-discrimination and other fundamental rights both online and off, for children and adults alike, on the basis of the Charter of Fundamental Rights. The serious and widespread threat posed by the draft CSAR to fundamental rights is reflected in all formal legal analyses from EU institutions about the proposal.

• The European Commission‘s own impact assessment (SWD(2022)209) to the CSAR recognises that there are no scanning methods that have good levels of privacy, security and feasibility. Available via local download here.
• The European Commission‘s regulatory scrutiny board (RSB) warned before the law was officially proposed that it might amount to unlawful general monitoring.
• The EU Council‘s official Legal Service Opinion – in a rarely-seen major critique of a legislative proposal – warned of a “serious risk” of generalised monitoring, undermining encryption and violating the very essence of the right to privacy. Description available here and full document published here.
• The European Data Protection Supervisor (EDPS) and Board (EDPB) warned that the proposal will severely harm innocent people with little to no evidence that it will protect children.
• The independent impact assessment undertaken on behalf of the European Parliament‘s civil liberties (LIBE) committee assessed the balance between safeguarding the privacy of users in general, and children’s rights. It found that the CSAR lacks evidence of effectiveness and could not justify the serious extent to which it violate Articles 7 and 8 (privacy and personal data rights) of the EU Charter of Fundamental Rights.
• Furthermore, the European Commission has admitted that the proposal is based on claims of technical accuracy directly from suppliers, which have never been independently verified.

Young people

International child rights law requires that children’s views are incorporated into laws which relate to their rights and safety, in order to respect their autonomy.

• According to a large representative survey, 80% of children in the EU say that they would not feel comfortable and safe being politically active or exploring their sexuality if authorities were able to monitor their digital communications on the basis of finding child abuse material.
• The same survey shows that around two-thirds of young people in the EU rely on encrypted message services for communication, and around the same number disagree or totally disagree with the premise that providers should be allowed to scan their private chats. Instead, improving media literacy and reporting mechanisms are overwhelmingly favoured by the children surveyed.
• Young activists warn of being suppressed by the CSAR.

Child sexual abuse survivors

• CSA survivor Alexander Hanff warns that the CSAR will discourage survivors from seeking support.
• Survivors representative group MOGiS e.V. warn that the proposal will harm survivors and other young people.
• Deputy Chairperson of MOGiS e.V. spoke to lead MEPs working on the CSAR as a representative of CSA survivors, in a speeach to alert them to how the law will do more harm than good for survivors of CSA, and how the Commission’s proposed approach is “fundamentally flawed”.
• Survivor of sexual violence, Marcel Schneider, is currently suing Facebook for the automated scanning of private messages, removing confidentiality for victims of abuse and criminal defendants.
• As pointed out by MEP Patrick Breyer, several survivors of CSA have also provided feedback to the Commission’s CSAR proposal, criticising it for harming survivors.
• Weisser Ring, a German CSA victim support group, and the Portuguese Association for Victim Support (APAV) collectively warn that despite important aims, the proposal could harm confidential communications, putting people at risk of blackmail and fraud, will lead to false positives, and has a risk of mass surveillance whilst lacking evidence of effectiveness.

Child rights & child protection experts

• Expert in online child protection issues, Dr Sabine K Witting, has warned that the proposed grooming detection would criminalise self-expression between consenting adolescents.
• The German child protection hotline, eco, calls the proposed measures in the CSAR “fundamentally questionable”.
• The Dutch child protection hotline, EOKM (now known as Offlimits), has frequently warned that the generalised scanning measures will likely be harmful and ineffective. Founder of EOKM, Arda Gerkens, warns that the CSAR proposal “goes too far”.
• The German child protection association, the Kinderschutzbund, has warned that the proposed measures are disproportionate and likely ineffective.

Police and prosecutors

• Public prosecutors in Germany have warned that the CSAR will not help them to find perpetrators, as it does not tackle the actual issues that they face.
• Police officers specialised in child protection in Germany have warned that the proposed measures will not help find more perpetrators, only more false alarms.
• A senior police officer in the Netherlands warned that the police will be unable to deal with the volume of reports predicted as a result of the proposal.
• The FBI warned Members of the European Parliament from the LIBE committee in a mission to Washington in May 2023 that “already now they [the FBI] do not have sufficient resources to deal with all CSAM cases they detect and they need to prioritize some of them. From this perspective, mass scanning of communication would not result in an increase in law enforcement”.

Technology experts

• At the time of writing, 465 scientists and academics in cybersecurity, privacy and related fields have warned that the proposed measures are dangerous and untenable.
• 47 digital human rights NGOs in the EDRi network have warned that the proposal will jeopardise everyone’s online privacy and free expression and lacks evidence that it will achieve its goals, and therefore must be rejected.
• Feminist technology researchers warn that the CSAR is a paternalistic and disempowering approach to gender-based violence.
• Public interest technologists in Europe warned against the CSAR’s proposed measures.
• The Council of European Professional Informatics Societies (CEPIS) warned about the threat to encryption.
• Researchers at TU Delft warn that the technological claims on which the CSAR is based are misleading or false.
• Professor Matthew Green warns about the risk of poisoning images in order to manipulate scanning technologies, among other serious concerns.
• President of the Signal Foundation, Meredith Whittaker, warned of the major risk of mass surveillance.
• 14 eminent scholars warn of “bugs in our pockets”, or the dangers of client-side scanning, a method proposed by the European Commission in order to execute the CSAR’s proposed detection orders. The academics explain that these methods are ineffective, with a high potential for misuse or abuse.
• Professor of Cyber Security and Policy, Dr. Susan Landau, has warned that “there is simply no technology” to do what the EU’s CSAR wants to do.
• Edward Snowden warns that the CSAR is an “authoritarian” move which would restrict “basic human liberty”.
• Security expert Alec Muffet calls the proposal a “war on end-to-end encryption”.
• Professor of Security Engineering, Ross Anderson, outlines not just the technical issues with the CSA Regulation proposal, but also its failing to engage with broader social issues that lead to CSA, as well as other strategic concerns relating to the development and sale of surveillance technologies. Professor Anderson further highlights researching showing that centralised takedowns, as proposed in the CSA Regulation, can add weeks to the time it takes to remove CSA from the internet.

Independent legal analyses

• A legal assessment from the University of Amsterdam’s Institute for Information Law (IViR) confirmed the threat to encryption.
• Director of CDT, Iverna McGowan, a former Senior Advisor to the UN Office of the High Commissioner for Human Rights, warns that the proposed Detection Orders are based on a flawed logic which would undermine procedural rights and the presumption of innocence.
• Assistant Professors at Leiden University, Center for Law and Digital Technology (eLaw), Dr Witting and Dr Leiser, warn that the proposal likely violates the EU prohibition of general monitoring, and its content moderation measures could put children at risk of harm.
• Former EU Court of Justice judge, Professor Dr. Ninon Colneric, published an assessment that filtering for CSAM in a generalised and indiscriminate manner would be incompatible with EU case law.
• Legal researcher at KU Leuven Center for IT & IP law, Charlotte Somers, calls the proposal “an attack on Europeans’ privacy and data protection” and notes the high likelihood of CJEU annulment.

National governments and parliaments

• ?? The government of Poland has slammed the CSAR for the risk of mass surveillance.
• ?? The Austrian Parliament has agreed to reject the CSAR unless it can guarantee the protection of encryption, contains no general monitoring obligation and respects human rights. All parties in the Austrian parliament voted against the CSAR proposal.
• ?? ?? ?? ?? ?? Governments of Estonia, Finland, Malta, Italy and the Netherlands have all raised serious problems.
• ?? The government of Sweden attempted to fully protect end-to-end encryption from the proposed measures and to stop general monitoring.
• ?? A resolution from the French senate warned about risks with many parts of the proposal, especially the search for “unknown” material and grooming.
• ?? The Irish Parliament’s justice committee raised serious concerns about the CSAR.
• ?? The Digital committee of the German Parliament hosted experts including police and child protection experts, and found unanimous criticism of the CSAR. This led to the committee raising their concerns.
• ?? The legal service of the German Parliament regards the proposal’s measures as generalised monitoring and thus violating the Charter of Fundamental Rights. It furthermore warns that the proposed measures might be adopted in other areas (i.e. scope creep).
• ?? ?? The governments of Austria and Germany have committed to fully protecting end-to-end encryption from this regulation.
• ?? The human rights committee of the Czech Parliament raised serious human rights concerns, especially regarding the protection of encryption.
• ?? MPs in the Dutch Parliament adopted a motion calling on their government not to allow a CSAR to go ahead which would – as per the draft – violate end-to-end encryption and violate the right to confidentiality of communications.

The European Parliament

• 14 MEPs from the lead Parliamentary committee (Civil Liberties, or LIBE), coming from 4 political groups, demand rejection of the CSAR.
• They are joined by many MEPs in the supporting IMCO (Internal Markets) committee who criticised the proposal’s scope, the threat its measures propose to encryption, and the serious risks posed by Detection Orders, with Renew group MEPs Hanh and Körner proposing full deletion of these parts.
• MEP David Lega (EPP), co-chair of the European Parliament’s Intergroup on Children’s Rights, speaks out against the CSAR proposal.
• The aforementioned complementary impact assessment to the CSAR on behalf of the LIBE committee further confirmed the lack of proportionality and fundamental rights compliance of the proposal.

Companies

• Microsoft warned that the claimed 88% accuracy figure for grooming detection that the European Commission put forward is not reliable (see especially annex 9, pages 285 – 315).
• An article from PhotoDNA user Cloudflare shows the ease of generating false alerts, despite claims from PhotoDNA developer Dr Hany Farid (which the European Commission has relied on in the draft CSAR) that this is as rare as 1 in 50 billion.
• 9 European industry associations representing members like Google, Meta, Microsoft and Mozilla have voiced their concerns.
• LinkedIn reports a false-positive rate of 59% for its current voluntary use of PhotoDNA, which strongly contradics the accuracy of PhotoDNA often cited by the European Commission and other proponents of the CSAR.

Privacy-tech companies

• Swedish VPN company Mullvad VPN explains the technological issues with the CSAR.
• ProtonMail CEO explains that they are concerned about the CSAR and the threat it poses to encryption and privacy.

The United Nations

• The UN High Commissioner for Human Rights warns of generalised surveillance risk of CSAR.

Professional secrecy associations (journalists, lawyers, etc.)

• The two biggest Austrian journalistic associations have warned about the CSAR and the risks it would undermine the constitutional protections for journalistic freedom and protection of sources.
• The Austrian lawyers association has assessed that the proposal undermines fundamental rights and warns against it.
• The German Bar Association (DAV) Committee on Surveillance published a position warning that whilst they support the aim of the draft regulation; they criticise the proposed automated mass analysis of communi­cation (content) data.

Civil society

• 134 NGOs across a wide range of human rights, digital rights, children’s rights, women’s rights and online safety have called on the EU to reject the CSAR.
• Belgian NGOs have questioned whether the Belgian government is failing to protect human rights by not opposing generalised surveillance in the CSAR negotiations.
• 11,000+ Europeans ask the EU to reconsider this dangerous and misguided law.