Tallinn: In a country that built its public life around encrypted digital identity, the prospect of a law obliging platforms to scan private messages lands with particular force. Estonia is among the governments most uneasy about the proposal that has come to be known, to its drafters’ irritation, as chat control, and the unease is shared widely enough that the file has spent years stuck between competing visions of what online safety should cost.
The underlying aim commands near-universal support. The proposed Child Sexual Abuse Regulation is meant to force digital platforms to detect, report and remove material depicting the abuse of children, replacing a patchwork of voluntary scanning with a binding legal duty. Almost no one disputes that the trade in such material is a horror the current system fails to contain. The fight is over the method, and specifically over a mechanism that would require services to inspect the contents of private communications, including messages protected by end-to-end encryption, before they are sent.
That requirement is what splits the room. Civil-liberties groups, security researchers and a bloc of member states argue that there is no way to scan encrypted messages for forbidden content without breaking the encryption itself, and that a tool built to find abuse imagery could be repurposed to hunt for anything a future government dislikes. Once the architecture of mass scanning exists, they warn, the question of what it looks for becomes a political decision rather than a technical limit. Supporters counter that refusing to act leaves children unprotected for the sake of an abstraction, and that detection can be designed with safeguards.
The European Parliament has staked out the more protective position. In late March it rejected pressure to extend the older, voluntary scanning arrangement indefinitely, agreeing only to a temporary prolongation of the existing derogation while the permanent regulation is hammered out. The message from a large cross-party majority was that any lasting regime must respect encryption and avoid blanket surveillance, a red line the Parliament’s negotiators carry into the talks with them.
Those talks are the crux. The trilogue process, in which Parliament, Council and Commission try to reconcile their texts behind closed doors, resumed this spring after earlier rounds failed to bridge the gap. The Council has historically leaned toward the detection duties the Parliament resists, and the Commission, which authored the original proposal, sits somewhere between. The arithmetic inside the Council has shifted as several capitals grew wary of signing their citizens up to message scanning, leaving the file without the comfortable majority its backers once assumed.
The deeper question the negotiation forces into the open is whether privacy and child protection are genuinely in conflict or only appear to be. Campaigners on the safety side resent being cast as enemies of encryption; campaigners on the rights side resent being cast as indifferent to abuse. Both framings are caricatures, and the legislation will be judged on whether it can escape them. A regulation that mandates scanning everyone’s messages to catch a few offenders would be a profound expansion of surveillance; one that does nothing would abandon the children it claims to defend. The drafters are trying to find a third path, and the resumed talks will reveal whether one exists or whether the file remains, as it has for years, suspended between two goods that refuse to be reconciled.
