Europe's New War on Privacy
unherd.com
unherd.com
In 2006 the EU passed the Data Retention Directive: https://en.wikipedia.org/wiki/Data_Retention_Directive
>According to the Data Retention Directive, EU member states had to store information on all citizens' telecommunications data (phone and internet connections) for a minimum of six months and at most twenty-four months, to be delivered on demand to police authorities.
This was actually law for 8 years until the Court of Justice of the EU found it to be violating fundamental rights and was declared invalid.
Reader mode seems to work.
It was last used to convict a murderer of the murder of Emilie Meng (https://en.wikipedia.org/wiki/Murder_of_Emilie_Meng). At the time, he had kidnapped a 13 year old girl (IIRC), that he had sexually assaulted for 24+ hours, and various dashcam recordings were used to piece together what had happened. He was also convicted of attempted kidnapping of a 15 year old girl from a school.
They found the 13 year old in his home, so not much doubt about that, but the other two cases were partially proven with phone metadata logging, proving he had been in the area at the time.
In the light of that, it's hard to disagree 100% that it's a "bad idea". It's a question of balance I guess, and the mass surveillance proposed in ChatControl is way out of balance. Not only does it scan in the background, it also scans for things that are unknown to you, and alerts authorities without alerting you. That's the perfect tool for facist regimes to get rid of political dissents.
Realizing that is the first step to having any kind of productive discourse, much less a chance of influencing the outcome. It's also the step I see most commenters in discussions on this and related topics here, are unable to take.
But then, the follow-up step is:
> the problem is that these laws use the marginal benefit as an excuse to institute something that actually has massive downsides
Are they marginal though, and are the downsides that big? Or does it only seem that way from our armchairs, as we debate computer philosophy and look at the world as a diagram of interacting systems, instead of, you know, the real world?
I'm not saying these particular regulatory ideas are good - I just have a problem with this assumption (not even implicit, it's often outright spelled out here), that it's some evil elites that try to strip us off our privacy and freedom, and keep trying to push the same laws hoping to catch our vigilant protectors off-guard.
Truth is, there's plenty of people who push for these things because they actually think of the children and honestly think these are good trade-offs, and they may be even more right than we are. They definitely sit closer to the real world and real people, real problems and real policing, than we do. They may be fatally misguided, too, but we won't achieve anything unless we try and see their perspective and honestly address the issues they're concerned with.
Both have been "status quo" for decades, and subject pretty much everyone in the western world to significant, continuous surveillance. We can discuss whether it's desirable, but it's been like this for a while and people very much like benefits both provide.
Your phone (GSM anyway) continuously reports back to the cell tower it's connected to, the strength of every other cell tower it can "see". The cell network, not the handset, decides which is the better cell tower for your handset to transfer to, which is why this information is being sent in the first place.
That information, the strength of cell towers, along with the knowledge of exactly where a cell tower is placed, can be used to triangulate your position down to a few meters in crowded areas with many cell towers. It's also how your phone establishes its position without GPS.
Besides that, you probably also have a handful or more apps that tracks your location within 100m constantly.
Your location is already known to your mobile operator, to your phone OS manufacturer, to various social media services, and more, including the government/law enforcement on request (maybe, or they have permanent access, who knows).
Any time you buy stuff with a debit/credit card, the details of that transaction is known to your bank, your card provider, tax authorities, including where you bought stuff, and by request, authorities
Money that goes into your bank account is also known by your bank (obviously), by tax authorities, and by request, authorities.
Your ISP knows who you talk to, and can easily log metadata about which sites you visit, even if you use a secure DNS, and in most countries, authorities can request (metadata) logging from your ISP, which you'll never even notice.
During COVID, health authorities started analyzing sewage to estimate how much the virus had spread in various communities, and some places they were down to street level accuracy. Obviously that gets a lot more diffuse on Manhattan than some rural city with 400 people in it, but you pretty much can't fart without anyone knowing it.
We are already under constant surveillance, whether we like it or not. I don't mind as much as long as it's used retroactively, but the ChatControl proposition would be proactive instead. It would scan your texts and report if it found something "suspicious", with the caveat that you as a user don't know what's suspicious today (or tomorrow). The list isn't public, and you wouldn't get notified that someone had called an adult, not until someone comes knocking on your door.
Their plan is/was to use AI, and we all know that ChatGPT never gets confused about anything, so that sounds like a great and ultra consistent plan. Most things require context. I might be angry because some kids gave me hard time, and write "fuck all children" to someone, but the anger isn't evident in the message, only the literal message, which I agree might be interpreted as something else (deliberately). This would then (probably) result in a notification for human review, a task that would fall to the operator of said service, so now Meta, Google or whomever has a legal justification for reading my messages looking for context, and I can't see any way that could go wrong. The other option was for law enforcement to read the messages, and while they're probably a bit more trustworthy in terms of privacy, I doubt we want to staff up our law enforcement offices by a factor 10 to read peoples messages.
The list could also be updated behind your back, so for totalitarian wannabe regimes, it could be used to pinpoint exactly who is organizing all those darned protests.
Mandate that every resident of the EU wear a certified, union-approved, scanning head-band that monitors the resident's brain for violent, racist, subversive or even "offensive" thoughts using state-of-the-art AI and supporting algorithms.
Authorities are notified immediately and are granted auto-approved warrants. Judges get notifications on auto-sentences that include mandatory re-education to heal such delinquents. Obviously, the system will include the vital and necessary exemptions - politicians and friends of the party, top campaign-donors, favored minorities and cartels, etc.
Every Resident will be made Safe and Happy! This will lead to the establishment of an utopian state - the ultimate paradise on Earth! "Privacy", today, is a nasty detriment that is holding back the Progress of Civilization.
There's a law that prohibits all video monitoring of public spaces, and a register where you must register your video cameras if you're a business owner. Video surveillance in Denmark has a maximum legal retention of 28 days, unless there's an ongoing investigation.
Considering that dash cams mostly monitor "public spaces" and are moving around, the legality of them have been questioned multiple times. They are however also becoming more and more common, so I'm guessing they will eventually be allowed with a relatively low retention, like 1-2 days, enough to get footage off of them in case of a crash.
- The data was collected in 2016, and was used in 2023 - a retention period of 7 years, way longer than the specified maximum of 2
- I'd argue that the basis of lawmaking is weighing the advantages versus the costs - supplying partial evidence in a case once a decade does not meet the requirements for introducing mass surveillance with infinite retention
The police work was sloppy, the facts as they stand are:
- The guy was on a list of 1400 or so of suspects, and was convicted of abducting a 13yo in 2023, a different crime. It bears mentioning that the town had a population of 5k and the municipiality 63k, halving that just to count the men doesn't give you a short list
- A white car was seen at the 2016 scene of the crime, suspected to be a Hyundai i30, but with a degree of uncertainty, just to illustrate how uncertain they were, the article mentions the police confiscated a white van
- The guy owned and sold his 2016 Hyundai around the time
- Thanks to Big Brother dragnet perma-retention surveillance (mobile cell info), it was established that the guy was in the area (a train station!) of the 2016 crime at the time (which is a large window considering the exact time of the disappearence of the first girl is not well known)
From this it's unclear to me whether the same guy was the perp in the 2016 and 2023 cases. If he was, I'd argue the dragnet-collected evidence is only circumstantial. I feel like it was possible that the police wanted to pin the crime on him as they had an expectation to catch the 2016 killer and he was obviously a pedo.
Even if he did it, I'd say the digital evidence was neither necessary nor that important in convicting him.
Normally, when there's an ongoing police investigation, the police can either request and retain a copy of the data, or request the holder of the data retain it until "further notice". I'm assuming that's what was going on here.
"If he was, I'd argue the dragnet-collected evidence is only circumstantial."
The phone logging was not conclusive evidence, only used to establish that he had been in the area. They found various artifacts in his house, like a roll of duct tape with the dead girls DNA on, that he explained he had found while walking around the lake, the same type of duct tape used to bind the girl. They also found various other items with the girls DNA on.
They used the logging data to establish his whereabouts for the night in question and compared it to his statement of where he'd been. They also used various financial transactions, like buying a cup of coffee with his credit card at a gas station, etc.
In Denmark, DNA cannot be used as a single evidence, only as supporting evidence, and the same goes for phone logging. But combined, if your location data says you've been there, and your DNA is found at the crime scene, even though it may not by itself be enough to get you convicted, it makes all other evidence much more believable.
Establishing that both the perp and victim was at the same train station some time during a longish window time doesn't mean jack.
As for DNA I'm not a criminology expert, but if courts don't accept it as conclusive evidence means there's something wrong with it - courts have a long history of accepting official sounding bunk ('expert' witnesses, polygraph etc) in order to manufacture evidence to their conclusions.
Anyways I don't want to detour from my main argument that even from the official PoV the phone evidence is very weak, I'd argue it's meaningless, and using this as justification as mass surveillance is a counterargument if anything.
Though I can imagine it's incredibly easy to deliberately misrepresent it as 'we used digital records to catch a pedo murderer' by dishonest supporters of the policy.
And cherry on the cake, countries like France decided to ignore the CJEU ruling using the joker card of 'national security'.
> UnHerd and our 5403 technology partners ask you to consent to the use of cookies to store/access and process personal data on your device.
Oh, okay.
That's the equation for Liberty In Extremis.
Real Liberty requires time dilation, eternal vigilance, adequate provigil, and plasma rifles.
Specifically, the charter: https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng
Article 8 point 2. They're missing the provisions of data retrieval. If available, that would immediately take down the whole monitoring system as a full message history request would have to be available since they don't know which data is private or personally identifying.
Additionally, this falls under GDPR legitimate concern category so must be possible to reject by the user. Otherwise it's an involuntary measure making the law contradictory.
With this in mind, it's toothless if corrected.
First, suppose two child pornographers get together and agree on a set of word substitutions that remove the key words and phrases deemed suspect. Now the authorites are scanning chats about flowers being planted, or birds being watched, etc. that are actually about targeting victims. Then the only detected uses of suspect words and phrases are accidental. If the authorites learn the new lingo the perpetrators will evolve it.
The only child pornographers that will be caught are the very stupid ones but they would have been caught by other less invasive means.
Meanwhile, the mass surveilance will destroy the free market. Imagine having to negotiate contracts when every business is a global corporation that knows what colour underwear you are wearing from scanning all of your chats. That means every business has a permanent information asymmetry in its favour, in every economic transaction you will ever make. Try to negotiate the purchase of a car, home, and so forth.
It would seem the end of freedom is nigh, listen for the sound of cheering and applause.
Isn't it obvious that mass surveilance only works on those who can be kept ignorant of it? If people know about surveilance then their behaviour is altered. How do entire nations and groups of nations fall for nonsensical plans like chat control.
The idea of chat control is to combat child vicimization by setting authorities on impossibly costly, technically insane strategies that can be thwarted by a high functioning chimpanzee.
What am I missing?
It hasn't been passed yet. We'll see.
Voluntary scanning (voluntary for the provider, not for the serfs^H^H^H^H^Husers) is already happening under some kind of temporary directive. So that's kind of codifying the status quo.
If they had just dropped the mandatory scanning, it might even be good to see it passed, in that it could eventually, slowly, drive all the users either to providers that don't scan... or better yet to P2P. There are probably some players who accepted the lack of mandatory scanning because they're betting they can find "noncoercive" ways to coerce all the major providers... but P2P is a lot harder to pressure that way. Even "mostly P2P" is harder to pressure, just because the infrastructure required is smaller. And it's not clear that all of the people doing the horsetrading understand that P2P is even possible.
They've been coming back with this Chat Control bullshit every year, in an obvious "keep demanding it until you get a yes" strategy. But once they've passed something, it'll be harder politically for them to change it to ban effectively encrypted P2P messaging. They could end up screwing themselves.
BUT the age verification ruins the whole thing, since it torpedoes privacy in general, and it probably, depending on how it's phrased and who it binds, effectively bans P2P messaging.
I wonder how many people involved intentionally took that into account, versus how many just saw AV as something vaguely authoritarian that could be put in to placate the forces of Control(TM).
Politicians and the rich will be exempt.
I’m not in full opposition but people should understand that there is a downside.
The pressure to comply I thought was less with smaller corps
> Von der Leyen was born and raised in Brussels, Belgium, to German parents. Her father, Ernst Albrecht, was one of the first European civil servants.
There are a great many people in this world who not only look to government for a sense of safety and direction, but seek to impose that paternalism on everyone else for “their own good”.
So people say no and they just bring it back again, or get activist judges to discover that it was legal all along. It's not like voters can kick them out.
Secondly: the death of EU cannot come soon enough. 10 years ago euroskeptics like me were wrongfully called "russophiles" (lmao), even though I'm from a country that is constantly threatened by Russia with drones, propaganda, etc. (RO for one's curiosity). Ironically enough, for those coming from ex-communists countries, EU sure looks increasingly like USSR, but with blue instead of red. It's infinitely better than communism, sure, but the optics and path of EU resemble those of USSR in it's "wellbeing of workers"(and other socio-cultural issues) propaganda phase(the irony is Russia here, obviously).
History never repeats, but it rhymes. And a calcified supranational institution delves into authoritarianism in the later stages of its existence. Reform never happens, and if it does, it’s at face value. It’s much “easier” (for the people in those institutions) to double-down on the status quo position rather than reform; and obviously it becomes increasingly harder for the vast majority of people to voice their opinions or concerns, especially those not aligned with the status quo. (* Key difference here is NATO which is US-led and EU which is still Western Europe-led; US is still a functional democracy unlike EU institutions)
Although it’s not really a very complex topic and the causal factors are relatively simple (at least to identify, solutions are much harder to propose [mainly due to the mentioned constant double-downing]), it would take a long time to explain/convince why the existence of the “current” EU is detrimental to Europeans (at least to the people not aligned with the status-quo). So-called benefits stopped at the common market treaty (EEC) iteration of the EU. Security is not and should not be in the EU’s purview, we have NATO for that. And the most obvious issues that the EU keeps worsening are socio-cultural positions that either (1) dilute the differences between different nations (2) [in case (1) was not a “problem” due to shared values] directly propose completely different values and/or positions. There’s no “objective morality” debate to be had here, democracy does not inherently mean choosing the most “scientific”/“moral”/(any other metric) position in policy: it simply means choosing what the majority of people want (If you want to change policy: change people’s minds). The double-downing of the “EU regime” is usually defended with the rhetoric that it does so in the name of “democracy”, “morality”, “tolerance”, “objective wellbeing of society”, etc. but there’s no mechanism for true democracy if the EU undermines/punishes the will of individual nations on the pretext that “it does not conform to EU-wide proposed policy”. This leads to “multi-step” issues and other regional conflicts between interests of nations (the winning bloc [usually the wealthier one] gets to basically impose policy on the smaller one).
I’m quite off-topic on the subject of privacy, but my key point is this: don’t expect things to get better; or at least not without a huge cost. Recent pullbacks from the EU regarding the DSA/AI Act/GDPR are done so out of necessity: the EU is losing ground massively (= money) in the tech space due to stupid policies made by dumb bureaucrats. Half-assed “reforms” like these will not make huge improvements (mainly due to the unchanged fiscal policies [which are going to get worse: upcoming euro stablecoin]) but will keep the EU afloat amongst those who can’t see the sinking ship. Oh, you like privacy? Well, expect it to get worse, as eID is surely coming for all citizens in the name of safety (which has been eroded due to “our” [i.e. regime’s] stupid policies).
Finally, as I foresee some will keep replying with “Russian <something>”, let me just say this: pray the downfall of the EU won’t be an opportunity for Russia to do anything. At this rate in the regional conflict, Russia doesn’t look good long-term, but if history has tried to teach us anything, it is that Russia’s unpredictable.
These are adequate reactions and preparations before war.
The West should be done with its rosy glasses. There’s still almost religious rejection of the possibility of war in their territory.
We are on the brink of a fierce war with Russia, China, North Korea, Iran, and a few traitors you are not aware of. They have more resources (oil, gas), production capabilities, as well as intelligence, and what’s more important, counter-intelligence.
This move improves counter-intelligence. Essentially, it’s an attempt to prevent the looming war. It’s not an evil act; it’s a cowardly measure compared to the direct acts of aggression of NATO.
If you think this time America will save the entire West like in movies, you are wrong. With recent drone capabilities without going nuclear, no place is safe.
Your apocalyptic vision is very, very far from certain, but also...
> This move improves counter-intelligence
Evading any kind of mass surveillance is basic tradecraft for spies. You're not going to get a lot of counterintelligence out of it. Especially because it's all structured to filter the information through mostly-non-spooky operators of communication services before your counterintelligence people get to see it.
What it does improve is good old fashioned non-counter intelligence for the other side. A lot of intelligence targets don't have the kind of OPSEC that spies have. And with adversaries at that level, you can't assume you control who has access to your back doors.
> If you think this time America will save the entire West like in movies
Ugh
> Essentially, it’s an attempt to prevent the looming war.
I don’t see how mass surveillance is going to be effective against Russian/Chinese/etc agents, let alone prevent war. Why do you assume that spies and saboteurs are going to use the surveilled systems? I think this is more about controlling citizens than it is about monitoring foreigners.
Much of Europe has been seeing near weekly grey scale warfare [0] that in most other cases can be treated as an act of war.
I had friends in Ukraine who acted the same until their family had to leave Donetsk due to shelling during the 14-16 period, and others who voted for Zelensky's olive tree which the Putin admin unceremoniously rejected in 2022 (at least Zelensky decided to stay in Kyiv and own up to his admin's mistaken policies in their beginning). Being well paid techies, they all paid bribes and left for Vietnam, the US, Germany, Czechia, and other countries while those who couldn't afford to leave were paying for those techies votes.
So will other HNers (and Redditors) who act high and mighty until the shoe is on the other foot - they would all leave the moment war started with nary a sense of loyalty nor the wherewithal to support policies that can act as a deterrent. The kind of people on HN will keep their heads in the sand until they are personally affected, because people who base their life on ideals and ideology don't understand how messy the world actually is.
Hell, most of them probably never heard of the 2010-12 purge China's MSS did against CIA informants - a number of whom were summarily executed in public in a government office courtyard [1]. Counterespionage is dirty work.
[0] - https://www.iiss.org/research-paper/2025/08/the-scale-of-rus...
[1] - https://www.nytimes.com/2017/05/20/world/asia/china-cia-spie...
Spending 2% of GDP on the military and locking people up for hurting feelings on with facebook posts, while buying Russian gas and trying to sell China EUV chip technology, and groveling to sell their yachts and football clubs and mansions to Russian and other oligarchs is not preparation for war.
Russia and China are threats, and the European ruling class are not taking those threats seriously. Quite the opposite actually they had been enabling and appeasing them and selling out their countries to help their friends and themselves get rich. While also peddling their lies about how those threats require these draconian domestic policies.
If there was real serious concern for such threats and real action taken, it would have been foremost to try to prevent real or perceived need for strong alliances between Russia and China. Instead, all actions of the past 5-10 years have been to drive those two countries closer together, making the threat much bigger. The common people do not need to be spied on and monitored and censored, it's not that there is exactly zero threat that could be mitigated or intelligence that could be gathered from doing such things, it is that it is such a minuscule non-issue compared to the gargantuan one next to it of treasonous politicians, intelligence agencies, bureaucrats, corporate bosses - "the ruling class" when it comes to dealings with adversaries.
Which most European states are doing and have been doing since 2014 (eg. Poland, Romania).
But counterespionage is equally critical.
> trying to sell China EUV chip technology
1. Said EUV technology is develoepd and manufactured by a US DoE JV which ASML only has nominal control over
2. It was recently alleged that ASML offered to sell EUV tech to China while trojaning offered tech to give western intel visibility [0]
> While also peddling their lies about how those threats require these draconian domestic policies.
A Kantian-esque rules based order only works when all players choose to operate under said rules. Weaponizing asylum seeking, exit visas, criminal networks, and wanton sabotage require a level of visibility that will be viewed as draconian.
And to be brutally honest, this "rules based" status quo is only came to fruition in the 2000s. Western European (and it's only soft Gen X and Millenial techie Western Europeans who are complaining) intelligence agencies were much more draconian until the late 2000s.
> would have been foremost to try to prevent real or perceived need for strong alliances between Russia and China. Instead, all actions of the past 5-10 years have been to drive those two countries closer together, making the threat much bigger
If forced to choose between the entirety of the EU (which is a loose confederation with individual nation states continuing to hold soverignity) or a nuclear armed neighbor with significant resources and technology exports, China would always choose the latter - even for the simple fact that it gives China a pressure point against Vietnam, North Korea, and India, all of whom try to leverage Russian ties against China to develop strategic autonomy.
> The common people do not need to be spied on and monitored and censored, it's not that there is exactly zero threat that could be mitigated or intelligence that could be gathered from doing such things, it is that it is such a minuscule non-issue compared to the gargantuan one next to it of treasonous politicians, intelligence agencies, bureaucrats, corporate bosses - "the ruling class" when it comes to dealings with adversaries.
Legally speaking in European countries, there is no difference between "common people" and "the ruling class". The only way to dragnet the "ruling class" is through such measures.
--------------
Frankly, this is a return to the pre-2010s norms around national security within most European states. And techies on HN and Reddit do not matter. Most of you Western Europeans would desert your home countries the moment s### got real, just like a significant portion of Ukrainian and Russian techies.
Techies who earn significantly more than most other citizens of their countries acting as if they are not part of the "capital class" is just class fetishization.
[0] - https://nltimes.nl/2025/11/20/asml-offered-spy-us-breaking-e...
No they haven't. It's just not what the build up to to war looks like. At all.
> But counterespionage is equally critical.
No, probably not equally critical once you have decided there is likely to be war. Important sure, but:
1. Broadly spying on your own citizens is not "counterespionage".
2. Spying on your own citizens without any real military or economic preparation for war is proof that the former was not motivated by threat of war.
Depends European state to state. For example in 2018 [0][1], most Eastern states were spending close enough to what was needed.
The biggest laggard remained Germany due to constitutional issues, but even they along with other Western European nations have gotten back on track following the 2022 escalation by Russia [2]
> Broadly spying on your own citizens is not "counterespionage"
Dragnets absolutely are. Every piece of intelligence matters.
> Spying on your own citizens without any real military or economic preparation for war is proof that the former was not motivated by threat of war
Yet the dramatic rise in defense expenditures across Europe after 2022 and my own personal experience working with people in this space has shown a mixture of both.
I am a major critic of Western Europe's failure of preparation, but the changes that have happened in the past 3 years are massive. And every major and regional power is in the midst of a massive rearmament.
A major conventional war will happen in the next 5 years, and everyone is in the midst of preparation for that.
[0] - https://www.iiss.org/online-analysis/military-balance/2019/0...
[1] - https://www.sipri.org/sites/default/files/2019-04/fs_1904_mi...
[2] - https://www.sipri.org/media/press-release/2025/unprecedented...
No it doesn't because the claim was that most of them have prepared for war. Most have not.
> Dragnets absolutely are. Every piece of intelligence matters.
This isn't, and it's not even marketed as such because that would be too patently ridiculous. It's sold on the lie of keeping children safe.
> Yet the dramatic rise in defense expenditures across Europe after 2022 and my own personal experience working with people in this space has shown a mixture of both.
There is no dramatic expenditure rise which indicates a build up for war across most of Europe. It's gone up a few points across the EU over many years and has just now barely breached the global average.
The claim was that this is justified because it is an adequate preparation for war, and preparations are being made for war, and therefore it is being done to prepare for war and is good.
None of those things are true. At best they're wild conjecture which are at odds with other facts. They are not an adequate preparation for war. Preparations for war are not being made. And they are not being done to prepare for a war.
> A major conventional war will happen in the next 5 years, and everyone is in the midst of preparation for that.
Almost no countries in Europe are preparing for invasion. If anything they are slightly upping deterrence factor, but they are not behaving though they fear being invaded, nor do they have any serious capability to participate in a major conventional war outside their borders, which is likely to involve China and be centered in the Pacific.
If private classified negotiations between state actors would be done away with, and past such "private" communications published, most wars would be impossible.
They did publish all secret diplomacy after the tsarist regime collapsed and that stopped WWI and probably prevented other wars (see for instance https://www.jstor.org/stable/2189254)
So we need the exact opposite of chat control.
We've always believed in things like postal secrecy.