If the only tool you propose is a hammer, perhaps the problem is not that all problems are nails, but that you only know how to build hammers.
The Chat Control debate has been stuck for years in a false dichotomy: either all communications are scanned, or no CSAM is detected. This dichotomy is as convenient for regulation defenders (they present scanning as the only option) as it is for encryption defenders (they can denounce scanning as unacceptable without offering alternatives). But reality, as almost always, is more nuanced.
This document explores alternatives to mass scanning, classified by their technical maturity, privacy impact, and political feasibility.
Evaluation framework
Every alternative must be evaluated against three criteria:
- Detection effectiveness: what proportion of CSAM would it detect compared to mass scanning?
- Privacy preservation: does it respect E2EE encryption and the privacy of non-suspicious users?
- Political feasibility: is it implementable within the current European legal framework?
| Alternative | Effectiveness | Privacy | Feasibility |
|---|---|---|---|
| User reporting | Low | High | High |
| Metadata detection | Medium | Medium | High |
| Hotlines and cooperation | Medium | High | High |
| Detection on public upload | High (only public content) | High | High |
| Network analysis | Medium | Medium | Medium |
| Report threshold | Medium | High | Low |
| Scanning in large groups | Medium | Medium | Low |
Technical alternatives
1. Strengthening reporting systems
The most obvious and least disruptive alternative is improving existing reporting mechanisms. Today, most platforms allow reporting suspicious content. The problem is that these systems are slow, manual and have low response rates.
Current system:
User → Reports → Human moderation → Verification → Action
Proposed improvement:
User → Reports + [context metadata]
→ AI-assisted moderation (only on reported content)
→ Automatic prioritization
→ Human verification within 24h
Advantages: compatible with E2EE, proven, scalable, does not require changes to encryption infrastructure.
Disadvantages: only detects content that users report; does not detect CSAM that no one reports (victims who cannot report, content shared in closed groups without whistleblowers).
Effectiveness estimate: internal platform studies suggest user reporting detects between 30-50% of the CSAM that automated systems detect. The gap is not trivial, but neither is it an absolute failure.
2. Metadata detection (not content)
Communications metadata —who talks to whom, when, from where, how often, message sizes— can be more revealing than it seems. An analysis of communication patterns could identify suspicious behavior without inspecting content:
Useful metadata signals for CSAM detection:
- Adult user communicating intensely with multiple minors
- Recurring sending of image/video files at night
- Use of disposable or newly created accounts
- Forwarding patterns matching known distribution networks
- Cross-communication between already identified suspicious users
Advantages: does not require access to content, compatible with E2EE, already in use (Signal and WhatsApp do this to identify and report suspicious accounts to authorities).
Disadvantages: high false positive rate (a teacher talking to students, a parent sending nighttime photos of their children), mass profiling of the population, risk of algorithmic discrimination.
Necessary caution: metadata systems must be transparent, auditable and limited to specific CSAM signals, not open to "any suspicious behavior." The history of metadata-based surveillance (NSA, telephone metadata program) shows they tend to expand.
3. Detection on unencrypted content (public upload)
Content that users upload publicly (not in private messages) can and should be analyzed. This includes:
- Images and videos on public profiles
- Content shared in public groups
- Files uploaded to public storage services
Advantages: does not affect E2EE, captures most CSAM content circulating on platforms (studies indicate >70% of CSAM detected today comes from public or semi-public uploads, not private messages).
Disadvantages: does not detect CSAM shared exclusively in encrypted private messages.
Current status: already implemented (PhotoDNA, hash matching on Facebook/Instagram, YouTube Content ID). It is the alternative with the best cost-benefit ratio.
4. Report threshold systems
A hybrid approach proposed by cryptographers from Signal and academics: a user's content is only scanned when it has received a sufficient number of independent reports (for example, 5 reports from different users within 24 hours).
User A sends M to B, C, D...
B reports M → counter = 1
C reports M → counter = 2 (threshold not reached)
D reports M → counter = 3 (threshold not reached)
...
If counter ≥ K → M is scanned (with judicial or trusted oversight)
Advantages: scanning is not mass but reactive to reports; protects the vast majority of users from scanning; preserves E2EE for unreported communications.
Disadvantages: vulnerable to harassment attacks (5 people coordinate false reports against a target); requires a careful threshold to avoid both false positives and evasion; does not detect CSAM that no one reports.
Improved variant: the threshold is not the number of reports but source diversity (reports from different social groups, without apparent coordination). This reduces the risk of coordinated attacks.
Policy and institutional alternatives
5. Reforming the NCMEC reporting system
The National Center for Missing & Exploited Children (NCMEC) in the US currently receives ~30 million CSAM reports per year (2023), of which only a fraction is investigated. The bottleneck is not detection but investigation and prosecution capacity.
A policy alternative would be:
- Strengthen national reporting centers (INHOPE and national hotlines in Europe)
- Increase investigation capacity of Europol and national police forces
- Improve cross-border cooperation for prosecution
Advantages: addresses the real problem (lack of investigative capacity, not detection), compatible with all fundamental rights, does not require technical changes.
Disadvantages: less politically spectacular than a new law; requires budgetary investment; does not respond to the demand to "do something" against CSAM.
6. Judicial oversight framework for exceptions
If it is determined that an exceptional access mechanism to encrypted communications must exist (as exists for traditional legal interception), it must be subject to the same guarantees:
- Individualized judicial authorization
- Proportionality and subsidiarity
- Deferred notification to the affected party
- Independent oversight
- Strict temporal limits
- Prohibition of mass scanning
Advantage: coherent with the existing European legal framework (legal interception is already regulated).
Disadvantage: does not scale for CSAM (millions of judicial authorizations would be needed); does not solve the initial detection problem (a suspect is needed to request the order).
7. Encryption in small groups, scanning in large groups
A compromise proposal: preserve E2EE for 1:1 communications and small groups (e.g., ≤10 participants), and allow limited forms of scanning in large groups (channels, communities, groups of >100 participants) where E2EE is technically more complex and the expectation of privacy is lower.
Advantage: protects interpersonal communication (where the expectation of privacy is highest) while allowing detection in semi-public spaces.
Disadvantage: arbitrariness of the threshold (why 10 and not 50?); small groups can also be used to share CSAM; creates a perverse incentive for abusers to keep groups small.
Aggregate comparison
| Alternative | Privacy | CSAM Detection | Political cost | Technical cost | Necessary caution |
|---|---|---|---|---|---|
| Improved reporting | High | Medium | Low | Low | Reporting biases |
| Metadata | Medium | Medium | Medium | Medium | Mass profiling |
| Public upload | High | High | Low | Low | Already implemented |
| Report threshold | High | Medium | High | Medium | Coordinated attacks |
| Strengthened hotlines | High | Medium | Medium | Low | Needs investment |
| Judicial oversight | High | Low | Medium | Medium | Does not scale |
| Large groups | Medium | Medium | High | High | Arbitrary threshold |
Conclusion
No alternative to mass scanning is perfect. But that is not an argument in favor of mass scanning, because mass scanning is not perfect either —it has its own problems of false positives, evasion, cost and, above all, structural breakdown of encryption.
The right question is not "which alternative detects as much CSAM as mass scanning?" but "what combination of alternatives maximizes CSAM detection subject to the constraint of preserving end-to-end encryption?"
Under that formulation, the answer is a package of measures:
- Short term: strengthen reporting systems, hotlines and international cooperation
- Medium term: implement metadata-based detection with strict transparency and auditing guarantees
- Always: maintain detection on public uploads and unencrypted content
- Research: explore report threshold systems with cryptographic guarantees
- Policy: increase the investigative capacity of authorities instead of delegating mass surveillance to platforms
What no alternative can offer —and what the debate should honestly acknowledge— is a technical solution that detects all CSAM in encrypted communications without breaking encryption. That solution does not exist, not because technology is insufficient, but because the problem is ill-posed: you cannot know what is inside a sealed envelope without opening it. And an envelope that can be opened is not a sealed envelope.
Related documents: