I had other plans for the weekend. Family, a bike ride, maybe finally fixing the printer. Instead, I sat between espresso and VIM, writing emails to German politicians. The occasion was the so-called “chat control,” an EU proposal that wants to scan messages first and only then encrypt them — the digital equivalent of “we’ll read your postcard and then put it in an envelope.” From the perspective of a professor in pattern recognition with a strong sense for ethics and security, that’s not a noble compromise; it’s a design flaw of the first order.
My name appears on a public list of scientists who oppose mass scanning of private communications. We didn’t assemble for fun; we did it because the technology behind the idea — client-side scanning — doesn’t deliver what politics likes to promise. If you scan content on end devices before encryption, you are installing surveillance software precisely where security should originate. From an engineering viewpoint, it’s like sterilizing the lab manual with a blowtorch. The grand promises — detecting “known and unknown” abuse material, automatic reporting, no false alarms, no misuse risks — are simultaneously ambitious and contradictory. Detection algorithms are fallible, models can be…