Press Release (CSA Regulation): Who benefits from the EU Commission’s mass surveillance law?

A newly-published independent investigation uncovered that the European Commission has been promoting industry interests in its proposed law to regulate the spread of child sexual abuse material online. 

By EDRi · September 25, 2023

A newly-published independent investigation uncovered that parts of the European Commission, specifically the Directorate-General for Migration and Home Affairs (DG HOME), have been promoting industry interests in its proposed law to regulate the spread of child sexual abuse material online

The CSA Regulation negotiations have become the playground of powerful interests from tech companies, law enforcement bodies, and governments with the lead Commission directorate deciding what rights to trade off. 

“The investigation published today confirms our worst fears: The most criticised European law touching on technology in the last decade is the product of the lobby of private corporations and law enforcement. Commissioner Johansson ignored academia and civil society in Europe while she shook hands with Big Tech in order to propose a law that will attempt to legalise mass surveillance and break encryption. “

Diego Naranjo, Head of Policy, EDRi

Photo of Diego Naranjo

Whose interests are at the centre of the CSA Regulation?

Today, 25 September, 6 leading news outlets published a joint investigation in which they uncovered close links between the tech industry and leading European Commission staff representatives responsible for the Child Sexual Abuse (CSA) Regulation – including Home Affairs Commissioner, Ylva Johansson and Commission President Ursula von der Leyen.

EDRi – along with over 130 NGOs, including from the Stop Scanning Me coalition – have been voicing civil society’s and experts’ concerns about the legitimacy of the proposed measures in the CSA Regulation. The law requires that private companies monitor potentially all private communication on behalf of police,.

A wide range of stakeholders, including child protection expertssurvivors of CSA, police, national governmentsUN officialscompaniesNGOs and others have warned that the proposed measures could do more harm than good for the very children they are supposed to protect, and would have unprecedented impact of the safety and confidentiality of communications on a global scale.

Yet, Johansson continued to actively push its proposal at breakneck speed and put pressure on key policymakers to land a worryingly quick decision – even if it makes the law more likely to be overturned. This investigation proves that Commissionner Johansson’s law fosters the industry’s interest. The law would benefit the interest of tech firms like Thorn, boosting the surveillance market where people’s privacy is used to make a profit.

“This manufactured sense of urgency has been used as emotional blackmail, at the detriment of democratic scrutiny and good lawmaking. We urge the EU co-legislators to ensure that EU laws are not based on moral panic, but rather in evidence and with respect for human rights rules.”

Ella Jakubowska, Senior Policy Advisor, EDRi

Tech industry gets a VIP seat at the Commission’s table

The investigation also highlights that contradiction that Johansson, the leading Commissioner on the CSA Regulation, has refused to meet with civil society representatives and failed to engage with tech experts – all whilst opening doors for surveillance tech companies.

When close to 500 academics and scientists raised privacy concerns with the proposal, Johansson tried to delegitimise the experts’ analysis.

Arda Gerkens, the Director of Europe’s oldest hotline for children and adults wanting to report abuse Offlimits, shared that none of her attempts to meet with Johansson were successful. For the investigation, she shared that “encryption is key to protecting kids as well: predators hack accounts searching for images” – a perspective missing from Johansson’s analysis of the debate.

Europol wants more surveillance, the Commission didn’t say no

The EDRi network has continuously expressed concerns about the CSA Regulation undermining encryption and leaving people’s private communications open to anyone to snoop into. We have seen an increased political push by states and law enforcement for surveillance measures and backdoors to everyone’s private spaces, with the government of Spain going so far as to call to outlaw end-to-end encryption in Europe.

Even though the CSA Regulation is meant to focus solely on tackling online child sexual abuse, it seems that the Commission is open to allowing mass surveillance for broader crime areas. When Europol officials suggested using the proposed EU Centre to scan for more than just CSAM, the Commission did not reject the idea. 

“The way to protect children online is with sustainable measures that are proven to work. Instead, the European Commission’s DG HOME is opening the door to lucrative partnerships between surveillance companies and police forces and to a law that is highly unlikely to withstand a legal challenge. How will this make anyone safer?”

Ella Jakubowska, Senior Policy Advisor, EDRi