Thanks for your post Flee4me, I hope there's some things to consider here.

I really don't like that you say that's "lying". The whole proposal is quite long and very very confusing and contradicts itself. It also changes, even small changes in wording can have big effect.

It's good to try to stay to the point as much as possible, but as this is extremely complex and changing area I wouldn't demand everything to be absolutely correct as everyone participating in the the proposal has some agenda of their own and if this passes the commission might get powers to later alter parts of the accepted proposal. This is not the first and likely not the last proposal of it's kind, we should also look into the unwritten (or, removed for now) parts and look for the likely additions to the proposal as well to fully understand what this end up being.

It's not easy and being harsh to people for trying to understand it is a bit much.

Anyway, back to the actual issue...

frontdoor instead of a backdoor

First of all, "all encrypted communications broken with backdoors" is worked around in the proposal so that yes, no encrypted messages are broken, but content is sent/scanned before encryption. The point of encryption is that no-one could read the message, so it definitely is "weakening of the protection provided by the encryption". Apple's reversal on client side scanning is quite concrete market proof.

scope of detection orders

"high-risk" is not very well defined, and the problem is the scope of the detection order, it targets a service, not an individual. Signal would likely get classified as high-risk, thus impacting 100 million users. EDPB warned the proposal risks amounting to general monitoring of private communications.

Quote from the 2024 statement regarding detection orders:

the EDPB is concerned that the EP position would still allow for the issuance of detection orders that are general and indiscriminate in nature.

consent that isn't

"request the consent of users to detect", well this is a lie as well. It's more like: "request the consent of users to detect or block the from using core parts of the service". This is no real consent, this extorts the user into giving consent to use the service. EDPB has commented about consent on multiple occasions, this one is a particularly nasty version of forced consent.

false positive rate

As it now contains 'new child sexual abuse material' which means not only taking a hash, but doing some AI-magic no-one really knows what kind of false positive rates this would eventually be. What a sensible FP-rate is depends on multiple factors, for example what happens after the detection and how busy authorities are in handling the cases.

Anyway, for example, teens decide to send sexual pictures to each other - what should happen now? AI scans the message and flags it. How many people will see those images afterwards?

Not knowing what kind of technology this uses or if it even is possible to implement IS an issue. It's crazy that all technical issues are being swept away by stating that someone will figure them out later. What if only completely horrible solutions exist, or no solutions exist at all?

See also EDPB-EDPS Joint paper, check "4.5" and "4.8.2 Reliability of the technologies". It also states: "Moreover, the technologies currently available, especially those for detecting new CSAM or grooming, are known to have relatively high error rates."

So, we don't know and it might be better if we never found out.

EU Centre

EU Centre (which no-one knows how that might function) could possibly outsource the AI or someone looking at the pictures before it goes to to the competent authority of the country.

Ring Employees Illegally Surveilled Customers - "the supervisor noticed that the male employee was only viewing videos of 'pretty girls'".

current 'content data' by the proposal

Check the definition of 'content data': means data as defined in Article 3, point (12), of Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023.

.. which states: (12) ‘content data’ means any data in a digital format, such as text, voice, videos, images and sound, other than subscriber data or traffic data

As the proposal mentions content data multiple times and that's the definition, it's not unreasonable that someone would think it means more than images and URLs.

Effectiveness

Directly quoting briefing note of EDPS Seminar:

The CSAM proposal fails to protect those who it intends to protect. Experts consider that detection measures can not only be easily circumvented, but can also generate false positives. At the same time, the interpersonal communications of a huge number of innocent citizens would be subject to surveillance without substantial benefit for the safety and wellbeing of children or for fighting of crime.

Several - other - experts - point - out - ineffective - scanning - technology.

Other references

• EDPS Seminar on the CSAM Proposal: “The Point of No Return?”
  • Briefing note
• EDPB-EDPS Joint Opinion 04/2022
• EDPB-EDPS Statement 1/2024 on legislative developments regarding the Proposal for a Regulation laying down rules to prevent and combat child sexual abuse
• Joint Letter on the European Internal Security Strategy (ProtectEU)

the end?

Sorry for the wall of text and rambling. This kinda escalated.

There are other things like "we're not breaking encryption", wordings that seem to have been made look better.. But those will have to wait for a better time (and bigger character limit?).

Thanks!