6 min reading time<\/p>\n
502 cryptographers warned that Signal threatened to exit the European market – and Germany\u2019s Federal Constitutional Court struck down parts of \u201con-device\u201d communications interception. Yet the EU continues negotiating chat surveillance rules. The CSAR Regulation is now in trilogue negotiations, and the ePrivacy exception permitting voluntary scanning expires on 4 April 2026. What does this mean for businesses relying on encrypted communication?<\/strong><\/p>\n The debate is often framed as a battle between child protection and privacy. For cybersecurity teams, it\u2019s far more concrete: any legally mandated weakness in encryption systems affects everyone – including attackers.<\/p>\n According to Telecom Reseller, use of SOCKS5 proxies in Europe has surged nearly 1,770% – a clear signal that technically savvy users and enterprises are already taking preventive action. Anyone designing corporate communication infrastructure today must consider the possibility that encrypted messaging services will come under regulatory pressure. This doesn\u2019t affect chat apps alone: end-to-end encrypted email services, zero-knowledge cloud storage, and VPN providers could also be implicated. The CSAR Regulation deliberately defines \u201chosting services\u201d and \u201cinterpersonal communications services\u201d very broadly.<\/p>\n Another issue many companies overlook: legal liability. If a platform provider implements scanning after a detection order enters into force – and due to a software bug or compromised update – leaks confidential corporate data to unauthorized third parties, who bears responsibility? The provider that implemented the scanning mechanism? Or the legislator who mandated it? This question remains legally unresolved – and won\u2019t be clarified until the first incident occurs\u2026 far too late for affected businesses.<\/p>\n This article contextualises what has been agreed, what remains pending, and what German companies must prepare for<\/a>.<\/p>\n After three years of negotiations, the Council of the EU adopted a common position on the CSAR Regulation (Regulation on Combating Child Sexual Abuse) on 26 November 2025. At its core: mandatory detection orders have been dropped.<\/strong> Platform providers must conduct risk assessments and may voluntarily scan – but no one will be legally compelled to inspect messages before encryption.<\/p>\n Germany, alongside a blocking minority, halted an earlier draft that did<\/em> include mandatory scanning. Justice Minister Stefanie Hubig clearly articulated the government\u2019s stance: mass, suspicionless chat surveillance violates the fundamental principles of a constitutional democracy. The German Data Protection Conference, chaired by Meike Kamp – Berlin\u2019s Data Protection Commissioner – explicitly urged the federal government to reject chat control.<\/p>\n But the agreement contains a review clause:<\/strong> Within three years, the European Commission must assess whether mandatory detection orders are \u201cnecessary and feasible.\u201d Privacy experts and the Electronic Frontier Foundation warn of the risk of progressive scope creep – the backdoor for mandatory scanning remains explicitly preserved in the legal text.<\/p>\n The trilogue between the Council, Parliament, and Commission began in December 2025. The second meeting took place on 26 February; the third is scheduled for 4 May. A critical date: the ePrivacy exception<\/a> currently permitting voluntary scanning legally expires on 4 April 2026. Without extension or new legislation, the legal basis vanishes.<\/p>\n Client-side scanning means analysing messages directly on the user\u2019s device – before they are encrypted. It appears to be a compromise: encryption remains intact, and scanning happens upstream. In practice, it\u2019s precisely the opposite: the scanning code installed on every device becomes a highly attractive target for attackers.<\/p>\n 502 scientists with recognised expertise in cryptography and security engineering warned in an open letter that such measures are technically unfeasible – and would undermine the security and privacy of all European citizens. Signatories include Cas Cremers (Helmholtz CISPA), Bart Preneel (KU Leuven), Carmela Troncoso (EPFL), and Ren\u00e9 Mayrhofer (JKU Linz).<\/p>\n The argument boils down to one sentence: There is no backdoor accessible only to \u201cgood actors.\u201d<\/strong> Any mechanism granting law enforcement access also grants it to hackers, spyware vendors, and hostile intelligence services. History proves it: the NSA\u2019s Clipper chip – a 1990s encryption system built with integrated state access – failed in 1994 when Matt Blaze of AT&T Bell Labs demonstrated its key escrow mechanism was manipulable.<\/p>\n The same debate is unfolding simultaneously in Canada. Bill C-8 – nearly identical to the failed C-26 – authorises the Canadian government to order telecom operators to lower encryption standards via administrative decree. The term \u201csystemic vulnerability\u201d is undefined in the bill – a gap that may be intentional or negligent, but either way dangerous. The University of Toronto\u2019s Citizen Lab has formally warned of the cybersecurity consequences. The pattern is global: governments attempt to impose backdoors in encryption systems; cryptographers sound the alarm; courts rein them in – and pressure begins anew.<\/p>\n For CISOs and IT leaders across DACH (Germany, Austria, Switzerland), the conclusion is pragmatic: chat control is not approved – but neither is it ruled out. The Council\u2019s review clause keeps mandatory scanning on the table. Anyone designing communication infrastructure today must factor in this uncertainty – with an architecture flexible enough to migrate, if necessary, to alternative providers or decentralised systems. This isn\u2019t alarmism. It\u2019s risk management.<\/p>\n \n\u00abMass, indiscriminate surveillance – which subjects millions of EU citizens to blanket suspicion – is disproportionate.\u00bb On 24 June 2025, Germany\u2019s Federal Constitutional Court issued its \u201cTrojaner II\u201d ruling (1 BvR 180\/23), declaring parts of \u201con-device\u201d communications interception unconstitutional and void. The court set clear limits on state interference with encrypted communication.<\/p>\n Key conclusions: On-device interception may not be applied to offences punishable by less than three years\u2019 imprisonment. Its use is restricted to communications that could also be intercepted using traditional telephone surveillance methods (the principle of synchronicity). Both the secrecy of telecommunications (Article 10 of the Basic Law) and the fundamental right to informational self-determination – the right to confidentiality and integrity of IT systems – are affected.<\/p>\n This is directly relevant to the chat control debate. If the Federal Constitutional Court already deems targeted on-device interception disproportionate for minor offences, then mass, indiscriminate surveillance<\/strong> of all encrypted messages would fail even more decisively under the same standard. The fundamental right to informational self-determination – established in the 2008 \u201cdata retention\u201d ruling – protects the integrity of end-user devices – and client-side scanning precisely violates that integrity.<\/p>\n This ruling has direct economic consequences for Germany. Companies using end-to-end encrypted communication – including, per Bitkom, 58% of all firms with more than 20 employees – operate on a constitutionally protected foundation. A European regulation mandating client-side scanning would be immediately challenged in Germany. The question is not whether<\/em>, but when<\/em>, such a regulation would land before the Federal Constitutional Court – or the Court of Justice of the EU.<\/p>\n The consequences are not theoretical. If detection orders become mandatory in a future version of the regulation, they will affect all encrypted platforms:<\/strong> Microsoft Teams, Slack, Signal, WhatsApp – and any end-to-end encrypted email solution.<\/p>\n Compliance teams face three concrete risks. First: internal communications – contract negotiations, M&A processes, personnel files, source code – would be automatically scanned, with a documented false-positive rate in detection. False positives could transmit confidential corporate data to authorities without the company\u2019s knowledge or consent.<\/p>\n Second: divergent requirements between the EU and the United States make a uniform global encryption architecture impossible. Companies would need to manage separate communication channels for EU and non-EU contexts.<\/p>\n Third: Loss of trust.<\/a> Meredith Whittaker, Signal\u2019s president, has warned the company will exit the European market if client-side scanning becomes mandatory. For businesses relying on Signal as a secure channel – many, especially in cybersecurity – this would mean immediate infrastructure loss.<\/p>\n First: document your messaging infrastructure.<\/strong> Which encrypted channels does your company use? Signal, WhatsApp, Teams? Who communicates what – and with whom? This inventory forms the foundation for any future adjustments.<\/p>\n Second: review your encryption policy.<\/strong> Which communications use end-to-end encryption – and which rely solely on transport-layer encryption? Under mandatory detection orders, E2EE communications would be affected, but transport-only encryption would not. Understanding your own architecture is decisive.<\/p>\n Third: actively track regulatory developments.<\/a><\/strong> Trilogue negotiations will continue at least through June 2026. Every company with a compliance department should monitor EDRi\u2019s document collection and Council press releases.<\/p>\n Fourth: evaluate alternative communication channels.<\/strong> If Signal does exit the European market, teams will need alternatives offering comparable security. Wire (Swiss provider), Threema (also Swiss), and Matrix\/Element (decentralised and open-source) are strong candidates – all with distinct regulatory compliance profiles.<\/p>\n The chat control debate reveals a fundamental pattern: any regulation that weakens encryption weakens everyone<\/em> – not just the intended target group. The Federal Constitutional Court set constitutional boundaries with \u201cTrojaner II.\u201d The 502 cryptographers set technical boundaries. Whether politics respects those boundaries depends on decisions made in the coming months.<\/p>\n One thing is clear: encryption is neither a luxury nor an obstacle to criminal investigations. It is the foundation of confidential business communication, whistleblower protection, journalistic source confidentiality, and trust in digital infrastructure. Every attempt to weaken it undermines the entire system – confirmed by 502 scientists, confirmed by the Federal Constitutional Court, and proven by the history of the Clipper chip. The question is not whether<\/em> encryption must be protected. The question is whether Europe understands this – before it\u2019s too late.<\/p>\n Every question is locked. A tap unlocks the answer.<\/p>\n The CSAR Regulation (Regulation on Combating Child Sexual Abuse) aims to compel platform providers to search for illegal content on their services. Critics warn of mass surveillance of encrypted communications. The Council\u2019s current text no longer includes mandatory detection orders – but does contain a review clause.<\/p>\n<\/details>\n No. The Council adopted its position in November 2025; the trilogue with Parliament and the Commission began in December 2025. A final agreement is expected no earlier than summer 2026.<\/p>\n<\/details>\n Meredith Whittaker, Signal\u2019s president, has announced the company will exit the European market if client-side scanning becomes mandatory. As the Council\u2019s current text imposes no such obligation, Signal remains in the market – for now.<\/p>\n<\/details>\n The \u201cTrojaner II\u201d ruling, issued in June 2025, declared parts of on-device communications interception unconstitutional. Mass, indiscriminate surveillance would fail even more clearly under this standard – as it infringes both the secrecy of telecommunications and the fundamental right to informational self-determination.<\/p>\n<\/details>\n If mandatory detection orders are imposed, all encrypted platforms (Teams, Slack, Signal) would need to implement client-side scanning. False positives could send confidential corporate data to authorities without the company\u2019s knowledge or consent.<\/p>\n<\/details>\n Messages are analysed directly on the user\u2019s device before encryption. The scanning mechanism itself thus becomes an attack target. 502 cryptographers have warned this undermines security for all users.<\/p>\n<\/details>\n Wire and Threema are Swiss-based providers offering end-to-end encryption. Matrix\/Element is decentralised and open-source. All three would be less directly exposed to an EU scanning mandate than US-headquartered providers.<\/p>\n<\/details>\n The surge in proxy usage across Europe shows businesses and users aren\u2019t waiting for regulation to advance. According to Telecom Reseller, SOCKS5 proxy usage in Europe rose nearly 1,770% – a clear indicator that preventive action is already underway. The question is whether the EU will succeed in imposing a regulation that will be technically circumvented and constitutionally challenged – or whether it will honour the Council\u2019s agreed compromise: risk assessment instead of mass surveillance, prevention instead of backdoors.<\/p>\n More from MBF Media Netzwerk<\/p>\n Header Image Source: Pexels \/ Dan Nelson (px:4489171)<\/p>\n","protected":false},"excerpt":{"rendered":"6 min reading time 502 cryptographers warned that Signal threatened to exit the European market – and Germany\u2019s Federal Constitutional Court struck down parts of \u201con-device\u201d communications interception. Yet the EU continues negotiating chat surveillance rules. The CSAR Regulation is now in trilogue negotiations, and the ePrivacy exception permitting voluntary scanning expires on 4 April […]","protected":false},"author":55,"featured_media":5580,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"chat control","_yoast_wpseo_title":"EU Chat Control: What Companies Need to Know Now","_yoast_wpseo_metadesc":"EU Chat Control: Keep your business compliant with new messaging regulations. Learn how to protect user privacy and avoid penalties\u2014read now.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[259],"tags":[],"class_list":["post-10785","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-strategie-governance-en"],"evm_reading_time_minutes":13,"wpml_language":"en","wpml_translation_of":9020,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/10785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=10785"}],"version-history":[{"count":3,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/10785\/revisions"}],"predecessor-version":[{"id":19733,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/10785\/revisions\/19733"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/5580"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=10785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=10785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=10785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}TL;DR<\/h2>\n
\n
What the Council agreed – and what it didn\u2019t<\/h2>\n
Why backdoors don\u2019t work technically<\/h2>\n
\n – Meike Kamp, Berlin Data Protection Commissioner \/ Chair of the German Data Protection Conference (BfDI, October 2025)<\/cite>\n<\/p><\/blockquote>\nBVerfG \u201cTrojaner II\u201d: The constitutional limit<\/h2>\n
What this means for businesses<\/h2>\n
What IT security teams must do now<\/h2>\n
Frequently Asked Questions<\/h2>\n
What is the EU\u2019s chat control?<\/strong><\/summary>\n
Has chat control already been approved?<\/strong><\/summary>\n
Would Signal leave the EU?<\/strong><\/summary>\n
What does the Federal Constitutional Court say about surveillance of encrypted communications?<\/strong><\/summary>\n
What does chat control mean for businesses?<\/strong><\/summary>\n
What is client-side scanning?<\/strong><\/summary>\n
Are there Signal alternatives based in Switzerland?<\/strong><\/summary>\n
Editorial reading recommendations<\/h2>\n
\n