EU: “Chat Control” proposals may threaten businesses

Privacy advocates say the EU's "Chat Control" proposals pose a threat to businesses.

Privacy advocates have warned that any celebration of the news that the European Union (EU) has abandoned its plans to crack down on end -to-end encryption in messaging apps may be short-lived. According to one expert, the announcement should be a “red flag” for organizations and businesses operating within Europe.

There has been a long-standing threat to end-to-end encryption in Europe. Tech companies have clashed with lawmakers, who have argued that they should be able to access communications citizens’ to limit messages shared by criminals and child sexual abusers. Seeking to allay companies’ fears, the Council issued a statement saying that all monitoring of communications would be carried out by providers on a voluntary basis. It also announced a modified approach to automated scans, dubbed Chat Control by privacy advocates, as a new way to tackle online child abuse.

See also: X launches Chat – The new encrypted messages

However, privacy advocate and former member of the European Parliament, Patrick Breyer, noted that “the business dimension is often overlooked in this debate.” While there has been much talk about protecting individuals, Breyer said that for CISOs and businesses, the EU proposals should be a red flag. He stressed that there is a real risk of sensitive data being leaked. “The technology has high error rates. For a business, a ‘false positive’ could mean that confidential internal documents, code or strategic plans are flagged and sent to external authorities or police forces without the company’s knowledge,” he said.

Breyer had been critical of the EU proposals and believes that the move to voluntary surveillance of communications is not sufficient protection. “The headlines are misleading: Chat Control is not dead, it is just being privatized,” Breyer wrote on his website. “What the Council approved today is a Trojan Horse. By entrenching ‘voluntary’ mass scanning, they legitimize the warrantless, error-prone mass surveillance of millions of Europeans by American companies, while at the same time killing online anonymity through the age verification backdoor.”

See also: GreyNoise IP Check: Find out if your IP is “working” for hackers

Chat Control is dangerous for businesses

Breyer's position is supported by another digital privacy group , European Digital Rights (EDRi). He posted a statement on LinkedIn saying that digital rights may still be at risk. " We want to be absolutely sure that legislators do not leave loopholes that could lead to harm ," he said. " For example, the Council text would have been better if it explicitly rejected the use of 'client-side scanning ' tools , as it leaves a lot of discretion to national authorities ."

In particular, EDRi highlighted the possibility of voluntary monitoring. “This means that big tech companies can decide to scan your private messages, without any suspicion against you, and apply predictive AI tools that are prone to error to look for evidence of abuse. This kind of scanning already happens, with very little transparency and oversight, and without a proper legal basis,” the organization said.

See also: New BOF tool exploits Microsoft Teams cookie encryption

And for companies seeking to protect their intellectual property and maintain secure communications, the threat is very real, Breyer said. “In short: If this proposal passes, no European company can anymore guarantee the confidentiality of its communications.”