No mass surveillance mechanism has ever remained within the limits for which it was created. Not out of malice. Because the internal logic of the system always pushes toward expansion.
There is a pattern that repeats with a regularity that should concern us: mass surveillance systems are created with a limited and explicit purpose, and over time they expand to cover areas that their original creators never imagined. This is not a conspiracy theory; it is a phenomenon documented by political scientists, historians and intelligence analysts.
The pattern
Phase 1: Specific threat → "We need a limited tool"
Phase 2: Tool created → "Only for this purpose"
Phase 3: New threat → "If it works for X, why not for Y?"
Phase 4: Expansion → "It's a natural extension of the original law"
Phase 5: Normalization → "No one questions the expanded tool anymore"
Phase 6: New threat → Return to Phase 3 (until occupying all legal space)
Documented cases
1. CALEA (USA, 1994-present)
| Year | Scope | Justification |
|---|---|---|
| 1994 | Traditional telephony | Organized crime |
| 2001 | VoIP, broadband | Terrorism (post-9/11) |
| 2015 | Messaging, social networks | Serious crime |
| 2020-2024 | Debate over E2EE | CSAM, terrorism |
2. SWIFT (Global financial system, 2006-present)
| Year | Scope | Justification |
|---|---|---|
| 2006 | Specific financial data | Terrorism (Post 9/11, OFAC) |
| 2010 | Serious crimes | Organized crime |
| 2015 | Tax evasion | Tax havens |
| 2020 | Mass data exchange | Global financial transparency |
3. NSA metadata program (USA, 2001-2015)
| Phase | Scope | Justification |
|---|---|---|
| 2001 | Call metadata of suspects | Terrorism |
| 2005 | Mass metadata (revealed by Snowden) | Expanded terrorism |
| 2015 | USA Freedom Act limits the program, but it still exists | Compromise |
4. Internal Security Law (Spain, 2016-present)
| Phase | Scope | Justification |
|---|---|---|
| 2016 | Terrorism | National security |
| 2019 | Serious crimes | Organized crime |
| 2025 | Public order maintenance | Protests, disorders |
Chat Control in the sequence
If we apply the pattern to Chat Control:
Phase 1: CSAM is a real and serious threat (it is)
Phase 2: CSAR proposes scanning only for CSAM (the current proposal)
Phase 3: "If it works for CSAM, why not for terrorism?" (debate already started)
Phase 4: Expansion to terrorism, serious crimes (foreseeable)
Phase 5: Normalization of communications scanning (consequence)
Phase 6: "If it works for crimes, why not for disinformation?" (next step)
This is not speculation. Members of the European Parliament and several governments have already suggested that the mechanism, once created, could be applied to other crimes. The Commission has denied it, but the institutional structure offers no guarantees against expansion: once the scanning infrastructure exists, changing the law to expand it is a smaller political step compared to creating it from scratch.
The consensus trap
Expansion does not happen because legislators are malevolent. It happens because it operates through what political scientists call incrementalism: each expansion step is individually reasonable.
Step 1: Scan CSAM → "It's to protect children"
Step 2: Scan terrorism → "It's to prevent attacks"
Step 3: Scan serious crime → "It's to catch murderers"
Step 4: Scan disinformation → "It's to protect democracy"
Step 5: Scan criticism of government → "It's to protect institutions"
No step is irrational by itself. The problem is the aggregate.
Chat Control will not be voted on as "mass scanning of communications for any future crime." It will be voted on as "scanning limited to CSAM with safeguards." But safeguards are only as strong as the political will to maintain them, and political will changes with each crisis.
The temporal asymmetry
There is a temporal asymmetry that favors expansion:
| Factor | In favor of expansion | Against expansion |
|---|---|---|
| Political cost of creating the system | Once created, expanding it is cheap | Creating it is expensive (already paid) |
| Political cost of protesting | Protesting expansion is "being against security" | Protesting creation is "being against protecting children" |
| Evidence | No evidence needed to expand; a new threat suffices | Evidence is needed to prove expansion will be abusive |
| Urgency | Each crisis creates urgency to expand | There is no urgency to protect abstract rights |
The lesson for Chat Control
The debate on Chat Control should not focus only on whether scanning CSAM is desirable. It should focus on whether it is desirable to create a mass scanning infrastructure that will inevitably expand. Because the historical pattern is unequivocal: that infrastructure will not remain within its original limits.
It does not matter how solid the safeguards are in the initial legal text. History shows that safeguards weaken with each crisis, that limits are redefined with each new threat, and that surveillance infrastructure, once created, is never dismantled.
Quoting Michel Foucault, who analyzed this phenomenon long before encrypted messaging existed:
"Surveillance is not an instrument that is used from time to time. It is a mechanism that tends to spread throughout the entire social body."
Chat Control is not the exception to this rule. It is the most recent confirmation.
Related documents: