Encryption and surveillance — Why mass scanning breaks E2EEEncryption and surveillance — Why mass scanning breaks E2EE

A lock that the homeowner cannot open, but the guard on the corner can, is not a lock. It is an invitation.

---

The Chat Control proposal does not debate whether end-to-end encryption is desirable. It touches on that, but that is not the center of the debate. The center is whether it is possible to preserve encryption while introducing the ability to scan encrypted content. The cryptographic community's response has been as unanimous as it is unsettling: not only is it not possible, but claiming otherwise reveals a fundamental misunderstanding of what encryption is.

What is end-to-end encryption?

An E2EE system guarantees that:

$$\text{Only}(\text{Sender}, \text{Receiver}) \xrightarrow{\text{can read}} \text{Message}$$

Formally, given a message $M$, a sender $A$ and a receiver $B$, the encryption scheme $E$ produces a cryptogram $C = E_{k_{AB}}(M)$ where $k_{AB}$ is a key derived from an ephemeral Diffie-Hellman exchange between $A$ and $B$. The platform server —the intermediary— possesses $C$ but not $k_{AB}$.

This property is not an accident nor an optional feature. It is the very definition of E2EE. If the server can decrypt $C$, then it is not E2EE. It is encryption in transit with server storage, which is something else.

Real E2EE:        A —[Encrypted with k_AB]—> Server —[Encrypted with k_AB]—> B
                  The server does NOT have k_AB

Encryption in transit: A —[Encrypted with k_AS]—> Server —[Encrypted with k_SB]—> B
                       The server DECRYPTS and re-encrypts

Mandatory scanning: A —[Encrypted with k_AB]—> Server + [Copy for scanning]
                    The server needs access to the content

The third case is not E2EE. It is encryption in transit with mandatory inspection. And that inspection, even if performed through a supposed "client-side scan," still requires that the content be accessible to a third party at some point in the flow.

Client-Side Scanning (CSS)

The technical proposal that has been most discussed is client-side scanning (CSS). The idea is that the sender's device runs a local classifier that compares the content against a database of known CSAM hashes (such as Microsoft's PhotoDNA database) before encrypting the message.

                  ┌─────────────────────┐
  A writes M →    │  Local Classifier   │ → Is M ∈ B? → Report
                  │  Then encrypt M     │ → C → Send C to server
                  └─────────────────────┘

The problem is that this does not resolve the fundamental tension. The local classifier needs:

1. 
   

   Access to M before encrypting — which means the messaging software must be able to inspect the content. If the software is open source (like Signal), this is verifiable. But if the classifier is updated dynamically (as required for detecting new CSAM material), independent verification becomes impossible.

   
   
2. 
   

   A reference database that is updated and shared with the authority. This database can be expanded (by court order or political pressure) to include other types of content: terrorism, disinformation, hate speech, criticism of the government.

   
   
3. 
   

   Forced classifier updates — if the government can require the classifier to include new categories of content, CSS becomes a censorship mechanism with legal backing.

   
   

The backdoor problem

There is a recurring argument in the debate: "it's not about creating a backdoor, but a front door with judicial oversight." This distinction is misleading.

A backdoor is an undocumented mechanism that allows an attacker to bypass security. A front door would be a documented and legal mechanism for an authority to access content. But from the perspective of system security, both are equivalent:

Backdoor:  Attacker exploits vulnerability → Accesses M
Frontdoor: Authority uses legal mechanism → Accesses M
----------- Difference: who, not how ----------
State attacker: uses the frontdoor as a backdoor
Cybercriminal: seeks the vulnerability that the frontdoor creates
Hostile regime: adopts the same legislation as a model

The problem is that any mechanism that allows a legitimate authority to access encrypted messages necessarily creates an attack surface that can be exploited by illegitimate actors. There is no way to build an access mechanism that can only be used by "the good guys." Encryption does not distinguish between a German judge and a Russian hacker. It only distinguishes between who has the key and who does not.

The asymmetry of detection

The Chat Control debate reveals an asymmetry that is rarely made explicit:

The deep asymmetry, however, is not technical but ontological: the watcher needs the content to know if it is illegal, but the content is only illegal if the watcher examines it. It is the paradox of the inspector who needs to open the box to know if the box contains something prohibited, but in opening it has already violated whatever the box contained, regardless of what they find.

The quantified slippery slope

One of the strongest arguments against CSS is not philosophical but historical. Every mass surveillance system initially implemented for a limited purpose has ended up expanding:

1994: CALEA (US) — Only for legal interception
    → 2001: Post-9/11 expansion
    → 2015: Includes VoIP and messaging
    → 2020: Debate on including E2EE

2006: SWIFT (Finance) — Only terrorism
    → 2010: Expanded to serious crimes
    → 2015: Expanded to tax evasion
    → 2020: Mass exchange of banking data

2016: Internal Security Law (Spain) — Only terrorism
    → 2019: Serious crimes
    → 2025: Public order maintenance

There is no reason to believe that Chat Control would be different. History suggests that every mass surveillance mechanism tends to expand until it occupies all available legal space. Not necessarily out of malice, but because the logic of the system is incremental: if it works for CSAM, why not for terrorism? If it works for terrorism, why not for serious crimes? Each expansion is individually reasonable; the aggregate result is not.

The proportionality argument

European law requires that any restriction of fundamental rights (such as the privacy of Article 7 of the EU Charter and data protection of Article 8) be proportional. This implies:

1. Suitability: the measure must be adequate to achieve the intended purpose
2. Necessity: there must be no less restrictive measure that is equally effective
3. Proportionality stricto sensu: the sacrifice of the right must be proportionate to the benefit

The cryptographic community has argued that CSS does not pass the proportionality test because:

• It is not suitable (it has false positive rates that would make judicial oversight unsustainable)
• It is not necessary (there are less harmful alternatives: reporting lists, hotlines, metadata-based detection)
• The sacrifice of encryption is disproportionate to the potential benefit

---

Related documents:

• Chat Control — Definition and context
• Criptografía homomórfica — Promises and limits
• Pruebas de conocimiento cero — Applications to the detection problem
• Alternativas al escaneo masivo