EU Caught Between Child Protection and Privacy With Encryption Rules

Sasa Mrdovic, Professor of Computer Networks at the Faculty of Electrical Engineering of the University of Sarajevo, said from a technical perspective it is difficult to clearly determine which communications should be exempted from encryption protection – i.e. to enable their decryption for the purpose of detecting criminal offences, including the most serious forms, such as child sexual abuse. He explained that the fundamental characteristic of end-to-end encryption is precisely that the content of a communication can only be read by the end users participating in the conversation. He added that removing encryption, or enabling access to communications, would raise additional questions regarding jurisdiction and security. He recalled that such an approach was simpler in traditional communication systems. In order to intercept communications, postal services or telecommunications providers could grant access, and law enforcement agencies, with court orders, could obtain access to telephone conversations. Modern digital communications operate differently. “Here, because the infrastructure through which communications are transmitted is not under the control of a state, institution, or a single organisation, it is much more complicated to find a way to enable lawful access to communications while at the same time not compromising the privacy and security of all users,” Mrdovic concluded. Agovic Djozo said a more effective approach to detecting and combating online material depicting child sexual abuse requires action at multiple points in the system before such content reaches private encrypted communications. In her view, technology companies must apply the principle of “safety by design”, meaning they should assess risks and build protective measures before products are launched on the market. Instead of focusing solely on private messages, efforts should also target the services, platforms, and infrastructure that enable the production and distribution of illegal content. As an example, she cites the Internet Watch Foundation, IWF, which identified AI-generated child sexual abuse material on a hidden version of a chatbot site where users could select sexualized personas and generate additional images. She noted that financial investigations can play an important role in combating commercial networks that distribute child sexual abuse material. According to her, data from the company Chainalysis shows that commercial CSAM networks use subscription models and cryptocurrencies, but the public and permanent nature of blockchain transactions can enable the tracking of payments, the linking of addresses, and the identification of infrastructure. In one case, according to those findings, a network was identified involving more than 5,800 crypto addresses and over $530,000 in received payments. Additional measures include simpler content reporting, more effective removal of known CSAM, digital forensics, international data sharing, specialized investigative teams, victim support, and preventive education for children and parents. BIRN also requested a comment from Meta, but no response was received by the time of publication.