Bogdan's Blog

September 25, 2025

TL;DR: The EU is flirting (again) with authoritarian practices. This time it's "Chat Control" (CSAR): mass scanning of private messages, including on end-to-end encrypted apps, via client-side scanning. That breaks encryption for everyone, nukes digital privacy, and chills investment/innovation.

Politicians, ministries, and the well-connected aren’t sweating it, because government/military comms aren’t affected.

Rules for thee. Not for me.

Want to fight against it? Use this: fightchatcontrol.eu/#contact-tool

I've been hearing about the CSAR proposal for a while now, and I've been meaning to write about it. But everyone has been talking about it, and I'm not even sure what else to add.

But I should probably just go ahead with the article, for the sake of awareness.

I'm gonna start by saying that as a Web Developer, and as a fellow human being ( not a bureaucrat), I'm not its biggest fan.

Honestly, it goes against everything I believe in, and it assumes people should be treated like cattle, or rather, incompetent children that need to have each of their choices and actions micromanaged by the government.

Actually, that's exactly what it is - daycare for adults.

It treats citizens like suspects and developers like janitors for state surveillance.

Hard "No" and "Big Yikes" from me, all the way.

Anyway, enough of my rambling, let's just get into it.

What is Chat Control?

CSAR/Chat Control is a push to force providers to scan private communications to detect CSAM.

Denmark necromanced it for 2025; Council votes/discussions are slated around mid-October.

It essentially works by hashing all the content that is being sent and comparing it to a database of known CSAM. That defeats end-to-end encryption, by design.

Despite years of backlash (Apple killed its own CSAM scanning plan after experts said it would be abused), the EU Council keeps trying to resurrect this stinky zombie.

For a clear breakdown, here's Louis Rossmann explaining what Chat Control is (far better than I ever could):

As a sidenote, I really enjoy Louis Rossmann's videos. If you live under a rock and never heard of him, definitely check out his channel.

He started making videos about macbook repairs and general life advice, but nowadays he's talking about a lot of related stuff, like right-to-repair, privacy, dumb things politicians say, dumb things companies say and so much more.

And he's a great guy, too.

Is this really who we want to copy?

If "scan everything by default" sounds familiar, it’s because authoritarian regimes have been doing this for a while:

Russia (Yarovaya laws): data retention + decryption/on-demand access.
China (Cybersecurity/National Intelligence laws): localization, spot-checks, compelled access, "cyber-sovereignty."

I really don't want to live in a world where these oppressive regimes are a source of inspiration for the EU.

The UN has already warned how surveillance infrastructures erode fundamental rights.

Won't somebody think of the children?!

This is their manipulative playbook: "We're saving kids here, don't you care about them? What are you? A monster? A sick abuser?"

And it's very effective for the brainwashed masses - "If you have nothing to hide, you have nothing to fear".

It's moral blackmail, it's disgusting, and they're doing every time they want to encroach on our rights.

They did it before, too - remember the web-wide SOPA/ACTA protests? The same lazy conflation: oppose bad law = you support abuse. ( wOuLD yOU dOwNLoAD a CAR? - yes Mr. Bossman, I definitely would)

What their garbage CSAR does in reality:

Breaks E2EE: scanning before encryption is a backdoor just waiting to be exploited.
False positives overload: AI + perceptual hashing = innocent people flagged, investigators overwhelmed.
Not an actual solution: determined abusers route around it; everyone else loses privacy.
The opposite effect: encryption protects victims, journalists, activists, LGBT+ youth, and ordinary users.

And to make it worse, this runs head-first into GDPR principles: data minimization, purpose limitation, privacy by design, proportionality - all tossed in the trash. But I guess consistency is too much to ask from our braindead legislators, as drool pours out of their mouths.

If you disagree and think we should really implement this, let's speedrun it. I've included a form, just for you, where you can graciously donate all your passwords. Kindly donate your credentials below so we can "protect" you better.

Where's the European innovation?

Mandate on-device spyware and you’ll see:

Startups geo-fence or leave
VCs avoid regulatory minefields
Users flee to forks/underground clients

So, worse security, weaker ecosystems, less trust.

Is this "European innovation" in the room with us
now?

I don't know what else to tell you, but if you wanna kill any ounce of innovation in Europe, well, this is it - by far the best way to do it. EDPB/EDPS warned of serious rights and security risks with the proposal’s approach (check the sources section).

A braindead solution in search of a non-existent problem

I really, really want to hammer it home for those who still don't get it, this is just spyware cosplaying as security. Burn the house down to catch the mice is the motto here.

If you actually care about protecting kids, you're supposed to make an effort:

Targeted, court-authorized investigations (not blanket scanning)
Properly fund specialized units and cross-border operations
Attack the infrastructure (hosting, payments, distribution networks)
Improve reporting pipelines and survivor support
International cooperation that respects rights and due process

Final word: Act NOW

Ok, hear me out - what if - and I know this is going be sound radical - instead of “guilty until proven innocent,” we used our brains and punished the guilty? I know, revolutionary concept in the current year.

Chat Control is a solution in search of a problem, it hurts everyone, empowers abusers and destroys privacy. It only serves the interests of the powerful and the corrupt.

If you value privacy, security, and a Europe that doesn’t LARP as an authoritarian state, do something today:

Email your MEPs (it takes 2 minutes): fightchatcontrol.eu/#contact-tool
Tell them: No client-side scanning. No E2EE backdoors.
If this advances, show up: write, call, organize, protest. Rights aren’t gifts; they’re boundaries we defend.

These out-of-touch legislators and insulated rich people keep speed-running society into the ground, cosplaying “safety” while shredding rights and calling it progress, and it's our duty to stop them.

And finally, I should do a list of shame, containing the countries that currently support spying on their citizens:

Bulgaria, Croatia, Cyprus, Denmark (obviously), France, Hungary, Ireland, Lithuania, Malta, Portugal, Romania and lastly, Spain.

Sources

Unhinged AI Generated SEO Section (definitely not dystopian)

Introducing: ScanEverything™, cloud-first, citizen-friendly, safety-focused compliance suite.

ScreenPipe: 24/7 desktop mirroring to the Ministry of Safety.
PermaConsent: Click once, agree forever.
Doorbell Mode: Microphones stay “helpfully” alert, even when “off.”
GuiltHash: Your photos get scored for “vibes.” Low vibes = paperwork.

Best of all, it’s AI-powered.

And next year, we’re shipping BrainChip Lite™; just a tiny implant so we can verify you don’t have any impure thoughts. Opting-out is not available. Voting against it is treason.

Allow the government to x-ray you daily, for safety.
Grant permanent screen access, for safety.
Share your location, contacts, camera roll, for safety.

Now breathe into the webcam and say it with me:

All of this is for the safety of children.