Loading story…
The European Union has revived the interim “Chat Control 1.0” framework, preserving a legal basis for online services to voluntarily scan private communications for child sexual abuse material and grooming activity. After a European Parliament vote failed to secure the absolute majority needed to block the measure, Regulation (EU) 2021/1232 remained in force, allowing participating email, chat, gaming, and social networking platforms to detect, report, and remove suspected abuse-related content without a separate warrant for each account. The renewed regime is set to remain valid until 2028 or until a permanent successor, widely referred to as Chat Control 2.0, is adopted.
The move has reignited a broader fight over end-to-end encryption and lawful access, as researchers and security experts warn that many government proposals to limit encrypted services misunderstand how encryption is deployed in practice. A newly highlighted academic paper argues that end-to-end encryption is not confined to messaging apps but is embedded throughout modern infrastructure, including TLS, SSH, VPNs, and Zero Trust architectures, and says broad restrictions would carry significant consequences for cybersecurity, commerce, and government operations. While the current EU framework does not extend to end-to-end encrypted services such as Signal, critics say it normalizes surveillance of private communications and could strengthen pressure for wider access mandates.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A newly summarized academic paper argued that government proposals to limit end-to-end encryption often misunderstand how E2EE works in practice and identified five distinct technical scenarios with different lawful-access implications. It also warned that broad restrictions on effective encryption would harm cybersecurity, commerce, and government operations.
On 2026-07-09, efforts in the European Parliament to block the interim Chat Control 1.0 framework failed because opponents did not reach the required absolute majority. As a result, Regulation (EU) 2021/1232 remained in force, preserving a legal basis for companies to voluntarily scan private communications for CSAM and grooming activity.
2 references tracked. Mallory keeps watching after this page renders.
schneier.com
Open sourcecysecurity.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Signal, a leading provider of end-to-end encrypted messaging services, has publicly stated it will withdraw from the European Union market if the proposed Chat Control legislation is enacted. The Chat Control proposal, currently under consideration by the European Union and spearheaded by the Danish Presidency, would require all messaging platforms, including those offering end-to-end encryption, to scan user communications and files for abusive or illegal material before messages are sent. This measure is intended to combat child exploitation and other criminal activities, but has raised significant concerns among privacy advocates, technology experts, and encrypted messaging providers. Signal Foundation President Meredith Whittaker has argued that the legislation would effectively mandate mass surveillance, undermining the privacy and security of all users, including government officials, journalists, activists, and vulnerable populations. The proposed law would require service providers to implement scanning mechanisms that could potentially be exploited by hackers or nation-state adversaries, thereby increasing the risk of unauthorized access to sensitive communications. Privacy experts warn that the requirement to scan messages before encryption would fundamentally break the security model of end-to-end encrypted services, exposing all users to potential surveillance and data breaches. The pending vote, scheduled for October 14, has become a focal point of debate, with Germany holding a pivotal swing vote that could determine the law's fate. Historically, Germany has opposed such measures, but recent political developments have cast uncertainty on its position. Denmark, currently presiding over the Council of the European Union, has been a strong proponent of the legislation and is pushing for its adoption. The controversy highlights the ongoing tension between law enforcement objectives and the protection of digital privacy in Europe. Signal's threat to exit the EU market underscores the potential impact on both users and the broader technology ecosystem if the law is passed. Other encrypted messaging platforms, such as Telegram, WhatsApp, and Threema, are also likely to be affected by the proposed requirements. The debate has drawn international attention, with privacy advocates warning that the law could set a precedent for similar measures in other jurisdictions. The outcome of the EU vote will have significant implications for the future of encrypted communications and digital privacy rights across Europe. If enacted, the law could force major changes in how messaging services operate, potentially leading to reduced privacy protections for millions of users. The situation remains fluid as stakeholders on all sides lobby for their positions ahead of the critical vote.
Jul 12, 2026
The European Union's proposed Chat Control regulation, formally known as the CSAM Regulation, seeks to combat child sexual abuse material by mandating that digital platforms detect, report, and remove illegal content, including grooming behaviors. This proposal has sparked significant controversy and opposition from privacy advocates, technology companies, and some member states. The regulation would require online service providers to implement scanning mechanisms on user devices and communications, a move that cybersecurity experts warn is fundamentally incompatible with end-to-end encryption. Benjamin Schilz, CEO at Wire, emphasized that mandated scanning would effectively introduce a universal backdoor into secure systems, undermining the privacy and security protections relied upon by millions of individuals and businesses. He argued that such measures would create new attack surfaces, increase the risk of exploitation by malicious actors, and present insurmountable compliance and liability challenges for service providers. The proposal has faced strong resistance from privacy rights organizations and secure messaging providers such as Signal and Threema, who argue that it would lead to arbitrary surveillance and heightened hacking risks. The European Commission first introduced the proposal in 2022, but it has repeatedly failed to gain consensus among member states, with previous attempts by Hungary and Belgium also stalling. Most recently, the EU Justice and Home Affairs Council postponed a scheduled vote on the measure after German lawmakers and other member states voiced opposition, removing the CSAM proposal from the agenda of their Luxembourg meeting. The Danish presidency has prioritized passing the regulation, but the lack of agreement continues to impede progress. Critics highlight that the EU's own data protection bodies and advisers have deemed the proposal unworkable, citing the fundamental conflict between mandated scanning and the preservation of privacy rights. The debate underscores the tension between efforts to protect children online and the imperative to maintain robust digital privacy and security. If enacted, the regulation would force service providers to choose between compliance and the technical impossibility of maintaining end-to-end encryption alongside mandated surveillance. The ongoing postponement of the vote reflects the deep divisions within the EU regarding the balance between child protection and civil liberties. The outcome of this legislative process will have far-reaching implications for the future of digital privacy, encryption standards, and the responsibilities of online service providers across Europe.
Jun 29, 2026
Denmark has withdrawn its proposal to mandate client-side scanning of electronic communications for child sexual abuse material (CSAM) across the European Union, following significant domestic and international backlash. The proposed law, known as Chat Control, would have required online service providers to scan user messages and files, including those on end-to-end encrypted platforms, for CSAM. The initiative lost critical support after Germany publicly withdrew its backing, and the Danish Moderates, a key coalition party, also failed to support the measure. Danish Justice Minister Peter Hummelgaard confirmed that the government will no longer pursue mandatory scanning and will instead support the continuation of voluntary CSAM detection by technology companies. The current EU authorization for voluntary anti-CSAM scanning by communication providers is set to expire in April 2026, with the European Parliament having recently extended it until then. Hummelgaard emphasized the need for Europe to act on a CSAM proposal before the expiration of voluntary scanning, warning of the risk of losing a vital tool in combating child sexual abuse. Privacy advocates, including the president of the Signal Foundation, strongly opposed the mandatory scanning proposal, citing concerns over mass surveillance and the potential impact on confidential communications for all users, including government officials and journalists.
Jul 12, 2026