Mullvad VPN present And Then? (Chat Control is back on the menu) (mullvad.net)

Mullvad VPN has released a short film, "And Then?", to spotlight and oppose the EU’s revived “Chat Control” push — a legislative effort that would mandate large-scale AI-driven scanning of private communications (messages, photos, emails, even content in end-to-end‑encrypted services), require ID to use messaging, and create vague text that could force future mandatory scanning. Although the European Parliament and several legal bodies rejected earlier versions as unlawful mass surveillance, the Council of the EU continues to iterate new drafts (rebranded as ProtectEU/Going Dark), while lobbying ties — notably Ashton Kutcher’s Thorn selling scanning tech and allegedly influencing advocacy groups — and Europol’s interest in unlimited access have raised alarms about scope creep, data retention, and political manipulation. For the AI/ML community this is a technical and ethical red flag. “Client‑side scanning” and claims of privacy‑preserving detection are scientifically fraught: reliable CSAM detection at scale without reading content would require weakening end‑to‑end encryption or embedding classifiers on devices, both of which expand attack surfaces, enable model poisoning/adversarial evasion, and increase false positives with serious harms. Forced deployment would also create massive centralized/retained datasets ripe for repurposing, surveillance and abuse. Researchers, engineers and product teams should note the real-world security, robustness, and human-rights implications of building such systems and push for transparency, rigorous threat modeling, and policies that reject dragnet surveillance.