Chat Control + Structural privacy — The sealed envelope problem

"You cannot know what is inside a sealed envelope without opening it. And an envelope that can be opened is not a sealed envelope."

— axiom of structural privacy

There is a question that underlies the entire Chat Control debate but is rarely explicitly formulated: what does it really mean to "know" the content of a communication without having seen it?

This question, which seems metaphysical, has immediate practical consequences. Because if we cannot answer it, any detection system will necessarily be false: either it does not really know (and therefore does not detect), or it really knows (and therefore has broken privacy).

The inspector paradox

The structure of the problem is as follows:

1. To know if M is illegal, one must examine M
2. If M is examined, the privacy of M has been violated (regardless of M)
3. Therefore: either one does not know (privacy intact, inspection failed)
              or one knows (privacy violated, inspection successful)

There is no middle ground. You cannot "know a little" whether a message is illegal. Either you access the content or you do not. And if you access it, privacy no longer exists, even if the content turns out to be legal.

This paradox is not technical. It is structural: it describes a property of knowledge and inspection that does not depend on the technology employed.

The blind classifier problem

Defenders of CSS argue that the classifier does not "see" the content; it only produces a verdict. But this is an illusion. A classifier that determines whether $M \in \mathcal{B}$ needs, to function, access to a representation of $M$ that contains enough information to make the classification.

Formally, a classifier $f: \mathcal{M} \to \{0, 1\}$ that determines whether $M \in \mathcal{B}$ requires a feature function $\phi: \mathcal{M} \to \mathbb{R}^n$ such that:

f(M) = g(\phi(M))

where $g$ is the classifier's decision function. The problem is that $\phi(M)$ contains information about M. The more accurate the classifier $f$ , the more information about $M$ that $\phi(M)$ contains. A perfect classifier would contain all the information of $M$ .

Simple binary classifier:
    M → [hash] → [0, 1]        → Knows nothing about M (only if it matches)
                                 But only detects known CSAM

Content-based classifier:
    M → [CNN embedding] → [0, 1]  → Knows a lot about M (structure, colors,
                                     textures, objects)
                                 Detects new CSAM... at the cost of
                                 extracting substantial information from M

The blind classifier paradox is that the better it classifies, the more information it extracts, and therefore the more it violates privacy. A classifier that does not violate privacy does not classify anything useful.

The ontological asymmetry

In the article The cost of protecting oneself (Obscura), an asymmetry is formulated that is replicated here:

For the attacker, identity is data. For the defender, identity is an experience.

In Chat Control, the corresponding asymmetry is:

For the surveillance system, the message is data to be classified. For the user, the message is a private expression.

The surveillance system does not suffer when it inspects an innocent message. It does not experience the violation, the intrusion, the loss of the private. For the system, it is just another classification: f(M) = 0 (not CSAM) and it is discarded. For the user, it is a boundary that has been crossed without their knowledge or consent.

Kierkegaard wrote: "Anxiety is the dizziness of freedom." Contemporary anxiety is different: it is the dizziness of knowing that our freedom —our ability to communicate without being observed— depends on a classifier deciding that it is not worth looking at.

The need to lose (communicative) identity

The series The need to lose identity concludes that the only genuine form of resistance against fingerprinting is learning not to be: dissolving into the statistical crowd until becoming indistinguishable.

In Chat Control, the same logic applies to communication: the only way not to be scanned is to be indistinguishable from a user who has nothing to hide. But this requires:

Not encrypting externally (you would be detectable)
Not using additional privacy tools (you would be detectable)
Behaving like the average user (to avoid generating metadata signals)

That is: protection demands submission to the expected profile. Resistance demands dissolution into the common. It is the same paradox that Obscura documents: protecting yourself betrays that you are protecting yourself, and not protecting yourself leaves you exposed.

Toward structural privacy

The conclusion that emerges from crossing Obscura's research with the analysis of Chat Control is that privacy is not a collection of technical tools but a structural property of communication systems. And as a structural property, it cannot be added a posteriori through scanning, classification or key escrow mechanisms.

Structural privacy requires:

That content is only accessible to the endpoints: this is the definition of E2EE
That the platform has no inspection capability: this is the definition of encryption
That the user is not penalized for protecting themselves: this is the condition of possibility for privacy

Chat Control violates all three. Not because CSAM is not a real threat, but because the proposed approach destroys the structure that makes privacy possible for everyone, including those who have nothing to hide.

As Paul Tillich wrote, and as we cited in The probability of the improbable:

"The courage to be is the ability to affirm one's own being in spite of the threat of non-being."

The courage to be private —to affirm one's own communication as an inviolable sphere— is the ability to affirm it despite the threat of surveillance. And that affirmation is not made through more sophisticated tools, but through the structural decision that the system cannot inspect what it does not have the key to open.

Related documents: