Can you scan an encrypted chat without breaking encryption?

Your messenger promises that only you and the person you're talking to can read what you send. Now imagine the app itself takes a look first. Is that still end-to-end encryption?

On Monday we covered where the EU law stands: the voluntary 1.0 regime leaves encrypted chats alone, while the permanent law is still open on private messages. Today we get into how "scanning" would actually work, and why a few words of legal drafting carry so much weight.

#End-to-end encryption in one minute

With end-to-end encryption (E2EE), the keys that lock and unlock a message live only on the devices of the people in the chat. The service's servers pass along ciphertext, scrambled data they have no key for.

Different apps get there in different ways. Signal and WhatsApp use the Signal Protocol. Wire uses Messaging Layer Security (MLS), an IETF standard built for large groups. Both aim for two properties. Forward secrecy means a key stolen today can't unlock yesterday's messages. Post-compromise security works in the other direction: keys keep rotating, so an attacker who grabs one at some point gets locked out again once fresh keys replace it. For a gentler intro, see End-to-end encryption, explained like you're busy.

The upshot for this debate: if the server only ever holds ciphertext, it has nothing to scan.

#Two ways to "detect" content

Hash matching. A cryptographic hash such as SHA-256 changes completely if you alter a single pixel. That's useless for spotting a resized or recompressed copy of a known image. So scanners use perceptual hashes, fingerprints designed to stay similar when an image is lightly edited. The system compares the fingerprint with a database of material already confirmed as abuse. It's good at known material and blind to context. And the fuzziness cuts both ways. Testing Apple's NeuralHash, researchers at TU Darmstadt showed that small edits could either force two images to share a hash (a way to frame someone) or break a match (a way to hide material). A team at Imperial College London ran a large-scale test and got more than 99.9% of images past perceptual-hash scanners with edits that left the picture itself intact.

Machine-learning classifiers. Here a trained model makes a judgment call: does this never-before-seen photo, or this run of chat messages, look like abuse or grooming? Guessing is harder than matching, so the error rate goes up sharply.

Here's why error rates matter at scale. Take a purely illustrative case, with made-up round numbers: a service handling 10 billion messages a day and a classifier that wrongly flags just 0.1% of them. That works out to 10 million false alarms every day. Each flag needs a human check, so strangers end up viewing innocent photos and chats. When the thing you're hunting for is rare, even a very accurate filter produces mostly false hits.

Campaigner and former MEP Patrick Breyer cites German police figures he says show that three in four chats flagged under today's voluntary scanning aren't actionable. He also says more than half of the resulting investigations target minors themselves over consensual sexting. Those are his figures and his reading.

#Where scanning can happen

Server-side scanning only works where the provider can read the content. That's why the voluntary 1.0 regime covers unencrypted DMs and webmail. It's also why services such as Telegram can scan default chats, which aren't end-to-end encrypted. Once a chat is E2EE, only one place is left: the device. The phone checks your photo or text before it gets encrypted, or after it's decrypted on arrival. That's client-side scanning.

sender device → [scanner?] → encrypt → server (ciphertext only) → decrypt → [scanner?] → recipient device

Technically, the cryptography stays intact. Practically, a piece of software now reads the plaintext and can report on it, so "just you and the person you're texting" is no longer the whole story.

Security people also worry about what an attacker could do with it. Picture the scanner as a new door into the app, plus a delivery route that carries flagged material off the phone: break into either one and you've got a window into people's chats. Wire, which sells an encrypted messenger and so has a stake in the argument, makes this case with the Salt Typhoon campaign as its example. In November 2024 the FBI and CISA said hackers tied to China had broken into several US telecom companies and copied information connected to court-ordered law enforcement requests. Surveillance plumbing built for police turned out to be reachable by spies. Friday's post puts Salt Typhoon in full context.

Apple announced on-device detection for iCloud Photos in 2021, paused it after pushback, and confirmed in December 2022 that it had dropped the plan. Data protection watchdogs were skeptical too: the EDPB and EDPS joint opinion of July 2022 backed the law's goal but warned that it could lead to indiscriminate scanning and undermine encryption.

#Same building block, opposite trust model

So is an on-device model reading your messages always surveillance? WhatsApp's new Scam Alert suggests the answer depends on design. Per Meta's engineering write-up, it works like this:

• Optional and local. A model on your phone checks messages from people who aren't in your contacts. Message content isn't sent anywhere for classification.
• It warns you, it doesn't report you. A suspected scam triggers a warning that only you can see. You decide whether to block, report or keep chatting; nothing is reported automatically. Meta says no per-user record of a warning leaves your phone in readable form; only noisy totals do (more below). If you mark a chat as trusted, you can choose to share the last five messages to help improve accuracy.
• Telemetry stays fuzzy. The only built-in data flow is aggregate counts of warnings and user actions. These are processed inside confidential virtual machines and released only as differentially private statistics. Differential privacy means calibrated noise is added so the totals reveal nothing about any single person.
• No custom models for specific users. Every model version is logged in an append-only public log, run by an outside party, before release, with a signing key Meta says it doesn't hold. A model built to target one person would show up in a public log.
• Inspectable. Meta publishes the model weights for researchers and plans in-app transparency logs.

A scanner built for authorities works the same way mechanically. The difference is control: one serves the user; the other reports to a third party, with no user say and no way to check what it hunts for.

Caveats: this is Meta describing its own system. Scam Alert is in limited beta: MediaNama reported tests in India, and Mint reported it reaching some Android beta testers at the end of August. Apart from Meta's own bug bounty and its invitation to researchers, we found no published independent review yet, so treat the guarantees as claimed, not proven.

#The AI twist: enclaves aren't encryption

AI features push in the opposite direction, because large models often run in the cloud. The industry's answer is the trusted execution environment (TEE): a hardware-isolated zone in a processor, such as Intel SGX, Arm TrustZone or a confidential VM, that's meant to keep even the machine's owner out. Remote attestation lets your device check a cryptographic report of exactly which software is running inside before it sends anything.

Examples include Apple's Private Cloud Compute, Google's Private AI Compute and WhatsApp's Private Processing. The EFF's analysis draws the key line. Encryption's guarantees come from math, while a TEE's come from engineering, and engineering keeps getting broken. Side-channel attacks, which infer secrets from timing, power use or memory access patterns, have hit enclave designs again and again.

A rough analogy: a TEE is a locked box in someone else's data center that can prove which software runs inside, but the key sits in the same box. The EFF calls that privacy-preserving, not encrypted. Its rule of thumb is that an E2EE app should never send your conversations to a TEE automatically. Once it does, the "only the two of us" promise no longer holds. Fully homomorphic encryption, which computes on data without decrypting it, would be the mathematically clean option, but the EFF notes it's still far too slow for today's large models.

#Why the legal wording matters

This is where the technical and legal fights meet. The Council's four-column table of May 19, 2026 (WK 6982/2026, line 112a), which records the trilogue of May 11, carries this text in both the Council mandate and the draft agreement column as Article 1(4a). The newest table made public so far, WK 13816/2026 of September 11, keeps the same wording word for word:

"4a. This Regulation shall not prohibit, make impossible, weaken, circumvent or otherwise undermine cybersecurity measures, in particular encryption, including end-to-end encryption, implemented by the relevant information society services or by the users. This Regulation shall not create any obligation that would require a provider of hosting services or a provider of interpersonal communications services to decrypt data or create access to end-to-end encrypted data, or that would prevent providers from offering end-to-end encrypted services."

Three details matter, as Brussels Record's analysis also points out:

• It's an article, not a recital. Recitals explain a law. Articles bind.
• It replaced a softer version. Parliament's mandate (line 107a) read: "3a. Nothing in this Regulation shall be interpreted as prohibiting, weakening or undermining end-to-end encryption. Providers shall not in particular be prohibited to offer end-to-end encrypted services." The first sentence is a rule about how to read the law; the new article goes further and bars specific obligations, such as having to decrypt. The table marks it deleted, "Covered in line 112a." The new wording is labeled as Cypriot presidency drafting.
• It doesn't settle everything. It says nothing about what detection may demand of non-encrypted services, and other provisions remain marked on hold.

Either way, a four-column table is a negotiating snapshot, not final law. The interim Regulation 2026/1881 already goes further for today's voluntary regime. It excludes E2EE communications, and eucrim notes it doesn't authorize client-side scanning of them.

The question technologists will ask of any final text: would a legally required scanner on your phone "circumvent" E2EE? Plenty of security researchers think so. Bugs in Our Pockets, a 2021 paper by leading cryptographers and computer scientists, argues that client-side scanning reads messages in the clear and opens new routes for surveillance and abuse, cipher intact or not. The data protection watchdogs' 2022 opinion, above, raised a similar worry. The paper also sums up the other side: proponents pitch on-device scanning as a way to keep encryption and still catch crime. And some governments think the current safeguards already go too far. When member states approved the interim law in July, France put on record (in CM 3756/26) that it was strongly concerned about the encryption carve-out, calling its wording very broad. The final wording will decide who's right.

For US readers: no US law mandates client-side scanning. US providers that find abuse material must report it to NCMEC, but 18 U.S.C. § 2258A(f) says they aren't required to go looking.

#Takeaways

For users:

• A feature that warns you isn't the same as one that reports you. Look for which one you're getting.
• Check whether AI or cloud features in your messenger are on by default, and what they send off your phone.

For builders:

• Make features opt-in and keep inference on the device.
• Never auto-report.
• Publish your models and log every version in a transparency ledger.
• Don't route E2EE content to servers without explicit consent.

Coming Friday: Europe isn't alone. The UK has already pushed Apple into switching off its strongest iCloud encryption for British users. We'll map what the UK, the US and the EU can each demand.

Missed Monday? Start with the Chat Control status explainer. If you work on this stuff and spot a technical error, tell us: we update posts.