Press Release (CSA Regulation): Who benefits from the EU Commission’s mass surveillance law?

A newly-published independent investigation uncovered that parts of the European Commission, specifically the Directorate-General for Migration and Home Affairs (DG HOME), have been promoting industry interests in its proposed law to regulate the spread of child sexual abuse material online. 

The CSA Regulation negotiations have become the playground of powerful interests from tech companies, law enforcement bodies, and governments with the lead Commission directorate deciding what rights to trade off. 

Whose interests are at the centre of the CSA Regulation?

Today, 25 September, 6 leading news outlets published a joint investigation in which they uncovered close links between the tech industry and leading European Commission staff representatives responsible for the Child Sexual Abuse (CSA) Regulation – including Home Affairs Commissioner, Ylva Johansson and Commission President Ursula von der Leyen.

EDRi – along with over 130 NGOs, including from the Stop Scanning Me coalition – have been voicing civil society’s and experts’ concerns about the legitimacy of the proposed measures in the CSA Regulation. The law requires that private companies monitor potentially all private communication on behalf of police,.

A wide range of stakeholders, including child protection experts, survivors of CSA, police, national governments, UN officials, companies, NGOs and others have warned that the proposed measures could do more harm than good for the very children they are supposed to protect, and would have unprecedented impact of the safety and confidentiality of communications on a global scale.

Yet, Johansson continued to actively push its proposal at breakneck speed and put pressure on key policymakers to land a worryingly quick decision – even if it makes the law more likely to be overturned. This investigation proves that Commissionner Johansson’s law fosters the industry’s interest. The law would benefit the interest of tech firms like Thorn, boosting the surveillance market where people’s privacy is used to make a profit.

Tech industry gets a VIP seat at the Commission’s table

The investigation also highlights that contradiction that Johansson, the leading Commissioner on the CSA Regulation, has refused to meet with civil society representatives and failed to engage with tech experts – all whilst opening doors for surveillance tech companies.

When close to 500 academics and scientists raised privacy concerns with the proposal, Johansson tried to delegitimise the experts’ analysis.

Arda Gerkens, the Director of Europe’s oldest hotline for children and adults wanting to report abuse Offlimits, shared that none of her attempts to meet with Johansson were successful. For the investigation, she shared that “encryption is key to protecting kids as well: predators hack accounts searching for images” – a perspective missing from Johansson’s analysis of the debate.

Europol wants more surveillance, the Commission didn’t say no

The EDRi network has continuously expressed concerns about the CSA Regulation undermining encryption and leaving people’s private communications open to anyone to snoop into. We have seen an increased political push by states and law enforcement for surveillance measures and backdoors to everyone’s private spaces, with the government of Spain going so far as to call to outlaw end-to-end encryption in Europe.

Even though the CSA Regulation is meant to focus solely on tackling online child sexual abuse, it seems that the Commission is open to allowing mass surveillance for broader crime areas. When Europol officials suggested using the proposed EU Centre to scan for more than just CSAM, the Commission did not reject the idea.