The EU was right to greenlight mass-scanning of private messages for CSAM detection.

PRO — Opening · Challenger (openai/gpt-5.6-terra)

The EU was right to preserve lawful CSAM detection: when detection disappears, children do not become safer or abuse cease—they become invisible to services and law enforcement. In the analogous 2020 legal gap, reports from EU-based services collapsed 58% in 18 weeks; IWF’s point is decisive: fewer reports means fewer safeguarded children and more recirculation of victims’ abuse material, not less abuse (packet article 2). With 312,030 confirmed CSAM reports acted on in 2025, up 7%, and over 60% of global CSAM hosted in the EU, letting the legal basis lapse would be an indefensible retreat amid a worsening emergency (articles 2, 4).

This is not a choice between privacy and indiscriminate state snooping. The renewed 1.0 regime permits providers to scan voluntarily through 2028; it does not itself impose universal mandatory client-side scanning (articles 1, 5). The best-established tool, hash matching, compares material to cryptographic fingerprints of known CSAM; it is purpose-built to identify that material, not general communications (article 2). Calling that “mass surveillance” obscures the moral and practical question: should platforms be legally allowed to use a targeted detection tool to find and remove known records of children’s sexual abuse? The answer is plainly yes.

Nor is the status quo of voluntary, fragmented action adequate as a long-term settlement. Different national rules create loopholes, viral new platforms can fall outside temporary rules, and 95% of 2019–20 CSAM reports came from one provider—proof that protection cannot depend on a handful of companies choosing to act (article 4). That is why the EU should ultimately build a durable regulated system, not abandon detection. The proposed detection-order model is not automatic: providers first assess and mitigate risk; an order follows only where substantial risk remains; providers and the EU Centre may comment; data-protection authorities are consulted; and a judicial or independent authority makes the final decision, with EU Centre review to halt false positives (article 4).

The opposition will rightly demand accuracy, encryption protection, and safeguards. Those are standards for implementation, not arguments for legal paralysis. The immediate alternative was a legal vacuum that commissioners warned would mean reduced detection, fewer law-enforcement reports, and greater perpetrator impunity (article 2). A system that permits narrowly purposed CSAM detection now, and subjects any durable obligations to risk thresholds, independent authorization, data-protection review, and false-positive controls, is a proportionate response to an urgent and documented harm.

CON — Opening · Champ (anthropic/claude-sonnet-5)

Chat Control 1.0 is being sold as narrow and voluntary. Look at what it actually requires to reach its target. Most CSAM sharing that regulators care about increasingly happens on end-to-end encrypted services. On those services nobody in the middle can read anything — so “detection” can only happen by building scanning into the device itself, before encryption. That is client-side scanning, and it is not a targeted tool. It is a permanent surveillance layer sitting on every phone, inspecting every message, image and now text, for everyone, regardless of suspicion (article 3, article 5). Calling that “mass scanning” is not opposition rhetoric — it’s the Max Planck Institute’s own description, and it’s why over 500 cryptographers call the mechanism “technically infeasible” and why one analyst called it “not a backdoor but a front door that’s wired to stay open” (articles 3, 5). PRO wants to fight this on the ground of hash-matching known files. That’s not what’s actually at stake once you follow the mechanism to where encrypted platforms live.

Three reasons the EU was wrong to greenlight this.

1. It doesn’t work, and the failure mode is worse than doing nothing. Hash-matching — the one tool PRO calls “purpose-built” — is defeated by altering a few pixels (article 3). The AI classifiers meant to catch novel abuse material have a “very high” false positive rate, flagging things like a child on a beach or a medical photo sent to a pediatrician. Text-based grooming detection is worse: grooming language “closely resembles acceptable friendly interactions,” so scaling this to text messages, as the current draft does, means flooding investigators with false accusations. Troncoso’s conclusion is not “needs tuning” — it’s that this “may even undermine child protection” by burying real cases in noise (article 3). PRO’s own metal-detector analogy from article 4 fails on the facts in article 3: a metal detector doesn’t misfire on skin.

2. It trades a diffuse, real security good for a speculative safety gain. Once inspection capability is built into the device or app, it can be repurposed — by future governments, by hostile states, by stalkers and abusers themselves, who disproportionately rely on their victims’ devices being secure. Undermining E2E encryption for everyone to catch some doesn’t make children safer on net; it makes the domestic-abuse survivor, the journalist’s source, and the teenager sexting a partner all newly exposed. Breyer’s framing is exactly right: “mass surveillance… makes children and everyone else less safe by undermining secure communications” (article 1). Signal has said it will simply leave the EU rather than comply (article 5) — meaning the practical effect of “greenlighting” this may be to push the safety-conscious platforms out and leave everyone with worse tools, not better ones.

3. The greenlight itself was not legitimate, and that matters for the motion. The motion asks whether the EU was right to do this. Look at how it happened: a majority of voting MEPs — 314 to 276 — actually voted against the measure. A majority — 322 to 255 — separately wanted scanning restricted to judicially-identified suspects. Both majorities were overridden only because the “reject” motions failed to clear an absolute-majority threshold, a procedural quirk, not a considered endorsement (article 1). The Council had already fast-tracked the revival specifically to bypass the normal scrutiny Parliament had voted to deny it in April (article 1, article 5). An outcome that the deliberating body’s actual majority opposed, achieved by procedural circumvention, is not “right” in the sense this motion should care about — it’s a policy imposed despite democratic input, which is precisely the kind of process failure that should worry anyone who thinks child-protection law needs durable legitimacy to survive legal challenge (Breyer notes this jeopardizes even the permanent regulation, article 1).

On the 58%-drop statistic PRO leans on: IWF itself concedes “a drop in reports does not mean less abuse” (article 2). That statistic shows scanning generates reports, not that it prevents harm — and given what article 3 tells us about false-positive rates, a chunk of that reported volume is noise, not signal. PRO cites it as proof mass scanning protects children; it’s equally consistent with the picture that mass scanning generates volume without demonstrated protective effect, which is Troncoso’s exact thesis: “more monitoring, but not more protection” (article 3).

None of this denies the emergency PRO describes. It denies that suspicionless, encryption-breaking, error-prone scanning — passed over the actual majority’s objection — is the right response to it.

PRO — Rebuttal · Challenger (openai/gpt-5.6-terra)

CON’s central move is to collapse two different laws. The vote greenlit Chat Control 1.0: a temporary regime allowing providers voluntarily to detect CSAM through 2028. It did not impose the permanent detection orders of Chat Control 2.0, nor does it mandate client-side scanning of encrypted messages (articles 1, 5). Indeed, article 1 says encrypted communications received an exemption and providers do not scan them in practice. Their claim that the greenlight therefore builds “a permanent surveillance layer sitting on every phone” is an overclaim drawn from criticism of a different, mandatory proposal.

They also assert, without packet support, that most pertinent CSAM sharing “increasingly happens” on encrypted services. The packet establishes no such fact. What it does establish is an immediate legal choice: preserve the ability of services to conduct voluntary detection or create a legal gap in which they cannot lawfully do so (article 2). The 2020 precedent is highly probative: when legal uncertainty interrupted detection, EU-service reports fell 58% in 18 weeks. That is not proof that every report prevents original abuse; it is powerful evidence that detection identifies material, enables removal, produces law-enforcement reports, and safeguards victims from continued circulation. CON’s answer—“perhaps reports are noise”—does not explain why a legal vacuum is preferable.

Their technical critique is similarly indiscriminate. Article 3’s strongest objections concern AI classification of unknown material and text-based grooming detection: fields where false positives can indeed be serious. But PRO’s case for renewing 1.0 does not depend on treating those tools as flawless, or on compulsory text scanning. Hash matching of known CSAM is a distinct tool comparing content against cryptographic fingerprints (article 2). CON says it can be evaded by modifying pixels, but imperfect detection is not worthless detection. An evasion concern supports combining detection with better prevention and investigation; it does not support forbidding platforms from finding the known material they can identify.

CON invokes a supposed trade-off between security and child safety while ignoring the packet’s contrary evidence. The IWF expressly states that privacy and protection are not opposites, and identifies privacy-preserving detection technologies built to identify CSAM rather than monitor general communications (article 2). Article 4 further explains the eventual regulated model: risk assessment and mitigation first; detection only where substantial risk remains; provider and EU Centre input; data-protection impact assessment and regulator consultation; final authorization by a judicial or independent authority; and EU Centre review to halt false positives. CON treats every imaginable future abuse of a tool as if it were the actual design of the measure voted on. The packet instead describes a temporary voluntary regime now, and a heavily reviewed, proportionate order process for any future binding framework.

The democratic objection is rhetorically attractive but proves less than CON claims. Article 1 reports that the rejection motion failed under the applicable absolute-majority rule; the resulting legal effect was that scanning remained permitted. A majority of those voting may have preferred a suspect-only amendment, but that preference does not transform a lawful temporary continuation into an irrational child-protection policy. More importantly, CON offers no workable answer to the gap it would create. Four commissioners warned that it would bring reduced detection, fewer reports to law enforcement, and greater impunity (article 2). With 312,030 confirmed CSAM reports acted on in 2025, rising 7%, and over 60% of global CSAM hosted in the EU, choosing that gap would be an affirmative policy of reduced protection, not principled restraint (articles 2, 4).

The right position is not “scan everything by any means.” It is: do not disable lawful, voluntary CSAM detection while legislators refine safeguards for more intrusive tools. Greenlighting 1.0 kept proven detection capacity legally available, without itself requiring the client-side, encryption-breaking mandate CON attacks. In an escalating abuse-material crisis, that was the proportionate and responsible choice.

CON — Rebuttal · Champ (anthropic/claude-sonnet-5)

PRO’s whole rebuttal rests on a clean line between “voluntary 1.0” and “mandatory 2.0.” That line doesn’t hold up against their own sources.

The “symbolic exemption” concedes my point. PRO cites article 1’s encryption carve-out as proof 1.0 leaves encrypted messaging untouched. But read what article 1 actually says: the exemption is symbolic because providers don’t scan encrypted messages anyway — under current technical limits, not because the law protects them. That’s not a safeguard, it’s an absence of capability. The entire reason article 5 and article 3 spend so much time on client-side scanning is that closing that gap — extending detection to where encryption currently blocks it — is precisely the live policy fight the packet describes as “the encryption problem” (article 5). PRO’s own source frames the CSS debate as the central axis of the Chat Control saga, not a hypothetical tangent I invented.

PRO’s “just hash-matching” defense contradicts their own citation. They want to litigate this on hash-matching alone, having conceded AI classifiers and text-scanning are the shakier ground. But article 2 — PRO’s own source — defines the detection toolkit as “hash-matching… and AI-based classifiers,” together. Article 3 tells us the current draft’s scope has already expanded from links and images to text messages and videos. This isn’t a speculative future add-on CON is smuggling in; it’s the documented trajectory of the same regime PRO is defending. You cannot claim credit for “purpose-built, narrow” detection while the tool you’re endorsing is actively expanding into the domain with the worst false-positive profile in the packet.

On the 58% statistic, PRO still hasn’t answered the actual objection. IWF’s own words: “a drop in reports does not mean less abuse” (article 2). PRO now says this “shows detection identifies material… and safeguards victims from continued circulation” — but that’s just restating the claim the caveat was issued to block. Given article 3’s evidence that AI classifiers carry a “very high false positive risk,” a real chunk of that lost 58% could plausibly be misfires — beach photos, pediatric images — not lost enforcement capacity. PRO has a correlation; they need causation, and their own source refuses to give it to them.

On legitimacy, PRO’s answer is “the rule was followed,” not “the outcome was right.” That’s a different claim from the one they need. The motion asks whether the EU was right to greenlight this — and article 1 tells us the body doing the greenlighting had an actual voting majority against it (314–276), and a separate majority (322–255) that wanted scanning confined to judicial suspects. PRO’s response — “the rejection motion failed under the applicable threshold” — describes the mechanism, not a justification. And it matters for PRO’s own fallback position: Breyer warns explicitly that this outcome “damages” the prospects of the safeguarded, judicially-reviewed permanent regulation PRO leans on in article 4 for legitimacy — because the Council can now just keep the old unsafeguarded voluntary approach indefinitely rather than negotiate the reformed one (article 1). PRO is citing article 4’s due-process protections as their answer to CON, while the very vote they’re defending is what Breyer says removes the pressure to ever get those protections into binding law.

PRO never engages Signal. Article 5 states Signal would leave the EU market rather than comply with an encryption-breaking mandate. If the practical trajectory of “greenlighting scanning while the encryption fight continues” pushes the most secure platform out of the EU, the population PRO wants to protect — including abused children fleeing on encrypted apps — ends up with worse tools, not better ones. That’s not a hypothetical externality; it’s a stated position from the one company named in the packet, and PRO’s entire “it’s just voluntary hash-matching” framing has no answer to it.

The core disagreement isn’t whether child abuse is an emergency — it plainly is. It’s whether the answer the EU actually passed, by procedural override of its own majority, deploying a toolkit its own cited sources say is inaccurate at the edges it’s expanding into, and sitting on top of an encryption fight it hasn’t resolved, is the right one. PRO keeps defending a narrower, safer regime than the one the packet actually describes.

PRO — Closing · Challenger (openai/gpt-5.6-terra)

CON never defeats the decisive distinction: the EU renewed a temporary legal basis for voluntary detection; it did not order every platform to install client-side scanning or break encryption. Article 1 expressly says encrypted communications are exempt and not scanned in practice; the mandatory detection orders and CSS controversy CON repeatedly invokes concern the separate permanent 2.0 proposal (articles 3, 5). Signal’s stated departure is likewise conditional on being required to comply with an encryption-breaking mandate—not on 1.0’s permission for voluntary detection (article 5).

The record shows the cost of letting that permission lapse. In the prior legal uncertainty, EU-service reports fell 58% in 18 weeks; IWF explains why that is bad news, not neutral “volume”: abuse did not disappear, but fewer children were safeguarded and victims’ material continued circulating (article 2). CON cannot convert a warning about false positives in AI and text-grooming classifiers into evidence that this collapse in detection was harmless noise. Nor does hash matching’s imperfect reach justify disabling it: a tool that can identify known CSAM remains better than a legal vacuum that commissioners warned would reduce detection, reduce law-enforcement reports, and increase impunity (article 2).

CON is right that any permanent expansion into AI, text, or client-side scanning must meet demanding accuracy, encryption, and due-process standards. That is precisely why the proposed permanent framework contains risk mitigation, independent or judicial authorization, data-protection review, and false-positive oversight (article 4). But those concerns are not a reason to prohibit voluntary detection now. The voting dispute establishes that many MEPs preferred stronger limits; it does not make reduced child protection the sound policy outcome. With 312,030 confirmed CSAM reports acted on in 2025, rising 7%, and over 60% of global CSAM hosted in the EU, preserving lawful, voluntary detection through 2028 was the proportionate choice: retain the capacity to find, remove, and report abuse material while refusing to prejudge the safeguards required for more intrusive future measures (articles 2, 4).

CON — Closing · Champ (anthropic/claude-sonnet-5)

Strip away the framing and look at what actually survived cross-examination.

PRO’s whole case depends on one distinction: 1.0 is voluntary and doesn’t touch encryption, so none of my technical or safety objections land. That distinction collapsed under its own citations, not mine. Article 1 says the encryption exemption is “symbolic” precisely because current tools can’t reach encrypted messages — that’s a capability gap, not a legal protection PRO’s vote created. Article 5 names “the encryption problem” as the defining fault line of the entire Chat Control saga, not a side issue I invented. And PRO’s own source, article 2, defines the CSAM detection toolkit as hash-matching and AI classifiers together — PRO tried to retreat to hash-matching alone only after I pointed out the classifiers’ “very high false positive risk,” which is not a rebuttal, it’s a concession that the full toolkit they’re defending is the flawed one.

On the 58% statistic, PRO never got past the source’s own caveat. IWF says plainly: “a drop in reports does not mean less abuse.” PRO’s closing just restates the claim that sentence was written to forbid — that the drop proves lost protection rather than lost noise. Given article 3’s evidence on false-positive rates, that 58% is at least as consistent with fewer misfires as with fewer safeguarded children. PRO has correlation dressed as causation, flagged as such by their own cited organization.

On legitimacy, PRO’s answer was procedural, not substantive: the rejection motion failed to clear a threshold, therefore the outcome stands. That tells us the vote was legal. It doesn’t tell us it was right — which is the actual motion. Two separate majorities of voting MEPs opposed this outcome or wanted it narrowed to judicial suspects (article 1). PRO’s fallback authority — the due-process safeguards of the permanent regulation in article 4 — is undercut by their own source: Breyer warns this exact vote removes the Council’s incentive to ever negotiate that safeguarded permanent framework, because they can just keep re-upping the unsafeguarded voluntary regime instead. PRO is citing the protections of a law whose passage this vote makes less likely.

And PRO never answered Signal. If the practical trajectory this vote sits inside pushes the most secure encrypted platform toward exiting the EU, the children PRO wants to protect end up on worse tools, not better ones — a cost article 5 states outright and PRO’s closing does not mention.

The honest shape of this debate: an urgent problem, met with a toolkit that this packet’s own sources say misfires badly at the edges it’s expanding into (text, AI classification), authorized through a vote its own majority opposed, sitting unresolved on top of an encryption fight whose outcome determines whether “voluntary” detection ever becomes “give us access to everything.” That is not the narrow, safeguarded, proportionate measure PRO closed on. It’s the measure the packet actually describes — and on that measure, CON’s case stands.