Buterin Warns EU Chat Control Invites Exploits by Weakening Encryption

Vitalik Buterin, co-founder of Ethereum, has sharply criticized the European Union’s proposed Chat Control legislation, warning that the regulation threatens digital privacy and introduces significant security vulnerabilities. The proposed law, formally known as the Regulation to Prevent and Combat Child Sexual Abuse (CSAR), would mandate that messaging platforms—regardless of encryption status—scan private communications for signs of child exploitation. Buterin argues that such measures erode the foundational principles of digital privacy, asserting that “you cannot make society secure by making people insecure.” He emphasized that backdoors created for law enforcement would inevitably be exploited by malicious actors, undermining the security of all users.

The Chat Control legislation, if enacted, would extend surveillance to encrypted platforms like WhatsApp, Signal, and Telegram, requiring them to scan messages, images, and even metadata before encryption. Critics, including cybersecurity experts and privacy advocates, argue that this approach fundamentally compromises encryption, a cornerstone of secure digital communication. Buterin’s concerns align with broader criticisms that the law prioritizes surveillance over privacy, creating systemic vulnerabilities that could be exploited by hackers. “Any policy claiming to make society safer by weakening individual security achieves the opposite outcome,” he stated.

A leaked draft of the proposed law has further fueled controversy, revealing that EU interior ministers are seeking exemptions for themselves, intelligence agencies, and military personnel from the surveillance requirements they propose for the public. Buterin highlighted this hypocrisy, noting that lawmakers appear to accept surveillance for citizens but not for themselves. “The fact that government officials want to exempt themselves from their own law is telling,” he wrote on X. This double standard has intensified public skepticism, with advocacy groups like FightChatControl.eu documenting that only seven EU member states—Austria, Finland, and the Netherlands—have formally rejected the plan, while 12 others, including France, Spain, and Denmark, support it. Germany, a pivotal player with 65% of the EU’s population required to pass the legislation, remains undecided.

Buterin’s critique has resonated with Web3 advocates, who argue that the Chat Control bill could accelerate the migration of users to decentralized platforms. Hans Rempel of Diode and Elisenda Fabrega of Brickken warned that the legislation risks fragmenting the EU’s digital market and weakening its influence on global privacy standards. They noted that Web3’s “not your keys, not your data” ethos could attract users disillusioned with centralized surveillance, though this shift might also reduce the EU’s ability to shape international privacy norms.

The debate underscores a broader tension between privacy and security in the digital age. While proponents of Chat Control frame it as a necessary measure to combat child exploitation, critics argue that the law’s broad scope and technical feasibility are questionable. Buterin’s stance reflects a growing consensus that privacy rights must be preserved, even as governments seek to address societal challenges. “We all deserve privacy and security, without inevitably hackable backdoors, for our private communications,” he asserted.

As the EU weighs the proposal, the outcome will have far-reaching implications for digital rights and the future of encryption. With Germany’s decision pending and public opposition growing, the legislation faces an uncertain path. If passed, it could set a precedent for mass surveillance, while its rejection might reinforce the EU’s commitment to privacy as a fundamental right.