Check everyoneto catch no one

Two measures being advanced in the EU and UK illustrate how governments promise to protect children by checking everyone's private communications or age. The cryptographers and security researchers at the forefront of digital security say the proposed systems will not catch the offenders they’re supposed to bring to justice and that everyone else bears the cost. This is their evidence, in their words.

What the laws say they do

The EU's Child Sexual Abuse Regulation, the proposal widely known as Chat Control, would require messaging services to scan the contents of private messages for illegal images. But there’s a catch.

A message protected by end-to-end encryption can only be read on the two devices at either end of the conversation, so the only place left to inspect it is your own phone, before message content is sealed and sent. That’s the proposed mechanism: software running on your device, reading your messages on behalf of the state, before you have sent them to anyone.

The UK's under-16 social media ban rules arrive at the same destination from a different direction. To keep younger teenagers off a platform, the platform first has to establish how old every user is. There’s no way to confirm that a 15-year-old is 15 without also making a 40-year-old prove they are 40. An age gate aimed at children is, in practice, an identity gate for everyone who uses the service.

Both measures are sold as a narrow, targeted tool, aimed squarely at predators, to protect children, with little cost to anyone else. That pitch rests on two promises. First, the tool actually catches the people it targets. Second, the price paid by everyone else is small.

The research that follows was produced by the cryptographers, security engineers, and social scientists who build and test exactly the encryption systems under threat. It takes the two promises in order. Neither stands up against the evidence.

It doesn’t catch them

Start with the scanning. In 2024, 14 of the world's most senior cryptographers published a peer-reviewed review of client-side scanning (CSS). Among the authors are Ronald Rivest and Whitfield Diffie, who invented the public-key cryptography that secures the modern internet, alongside Bruce Schneier and Susan Landau, whose work shapes how governments themselves reason about surveillance. These aren’t campaigners. They’re the people who would have to make the technology work. Having examined it closely, they concluded that, on its own terms, it fails.

“CSS neither guarantees efficacious crime prevention nor prevents surveillance. Indeed, the effect is the opposite.”

Abelson, Harold, et al. “Bugs in our pockets: the risks of client-side scanning”Journal of Cybersecurity 10.1 (2024): tyad020

Their reasoning is concrete, not rhetorical. A scanner that reads everyone's messages doesn’t reliably find criminal material because the detectors are simple to defeat. Altering a handful of pixels in an image is enough to push a known illegal file past the filter without changing anything a human eye would notice. So the people actually trafficking that material adapt and slip around the check, while the scanner keeps reading the private messages of the entire population, i.e. people that were never a threat.

The result is the surveillance of everyone, and almost none of the enforcement that was promised. Crucially, the report finds no design that escapes this outcome. The failure is structural, not a rough edge to be smoothed out in a future version.

The age checks fail for the same underlying reason, and the objection is not a fringe position. In September 2025, 807 named scientists and security researchers from 37 countries signed a joint statement to the European Parliament and Council. Their assessment of age verification was unambiguous.

“... age verification controls can be evaded with ease.”

Joint statement of scientists & researchers807 signatories · 37 countries · September 2025 · incl. Green, Landau, Troncoso, Preneel

They weren’t speaking hypothetically. They pointed directly to the UK's own experience under the Online Safety Act, where the arrival of age checks pushed users towards services that don't run them and VPNs that let a person appear to be somewhere the rules don’t apply. This cannot be argued away. It already happened, on a national scale. And a separate study shows us how large the movement actually was.

With checks activated, did people stop or move?

In 2023, more than 20 US states began forcing adult sites to verify visitors' ages. The two biggest sites differed in their response: the market leader blocked users in those states or pulled out entirely. Its main rival ignored the rules and stayed open.

Researchers measured what people did next, comparing searches in the affected states against what would have happened without the law. Three months in, demand hadn't dropped. It simply moved.

WHAT THE LAW WAS MEANT TO DO

Search for the site that complied (mostly by blocking the state)

-51%

WHERE USERS ACTUALLY WENT

Searches for the non-compliant rival (that ignored the law)

+48%

Searches for VPNs (to hide location and bypass the check)

+23%

The compliant site lost half its traffic. Almost all
of it reappeared somewhere the law couldn't reach.
The rules didn't stop the behaviour. They relocated it.

We all pay

If the target walks around the checkpoint,
it doesn’t stop operating.

It continues to invade the privacy of everyone who acted lawfully and passed through it. The second promise was that the cost to those people is small. Researchers have measured what actually happens to your data when you submit to an age check. At the 2026 IEEE Symposium on Security and Privacy, the leading venue in the field, a team from Georgia Tech and UC Irvine published the first large-scale study of how age verification is really deployed across the web. What they found contradicted the central assurance written into these laws.

Most sites covered by age-verification laws don't actually enforce them. The ones that do often outsource the job to a small number of third-party verification companies, one of which handles an estimated 60% of the market.

Depending on the method used, a single check can capture your face and browser fingerprinting, and pass identifying details to other firms, including credit-card processors and location services. The justification written into these laws is that verification companies are commercially motivated to protect what they collect. The study found the reverse: it becomes a record waiting for the day it leaks, held by a company you never chose to trust.

This isn’t the failure of one badly run vendor or one careless country. A 2026 study evaluated deployed age-verification systems across several European jurisdictions, testing whether they actually deliver on their claims.

“... the effectiveness of today's deployed systems is more often presumed than proven.”

Lavermicocca, Carminati & Longari — “X-rated Compliance Theater”Multi-country study, 2026 · effectiveness fragile, privacy cost real

Not one of the tested systems held up against a realistic attempt to fool it, and verified access could be captured and passed to others. Yet every innocent user still handed over real personal data to use the services. The trade, in plain terms, is real exposure for everyone in return for protection that, on inspection, isn’t actually there.

And the machinery doesn’t stay in the box it was sold in. The 807 scientists warn that inspecting a message before it’s encrypted renders the encryption useless, for every user, by design, because there is no way to build a reading capability that only ever reads the guilty. The IEEE team also found age verification running on sites reached from a US state with no law requiring it, demonstrating its spread beyond the jurisdictions that had initially implemented it. And perhaps most concerning, the same infrastructure built to check ages today can later be repurposed to exclude users based on other factors, such as political affiliation or any other arbitrary requirement set by a future government.

Ask the right question

The debate was framed by the agencies
that want the capability.

In 2022, the technical directors of GCHQ and the UK's National Cyber Security Centre published the state's case for scanning. Ross Anderson, professor of security engineering at Cambridge and Edinburgh, answered them directly, not with a plea for privacy over safety, but with an argument that we have been shown the problem from the wrong end.

“... we should view the child safety debate from the perspective of children at risk of violence, rather than from that of the security and intelligence agencies and the firms that sell surveillance software.”

Ross Anderson, “Chat Control or Child Protection?”Universities of Cambridge and Edinburgh, 2022 · a direct response to GCHQ and the NCSC

Most violence against children is family violence, committed at home by someone the child already knows. Abuse that begins online, with a stranger, is the minority of cases. A scanner reading everyone's messages is aimed at the smallest part of the problem.

Meanwhile, the people who actually protect children have been defunded. Child protection is done by teachers, GPs, social workers, and local police who know the family, and they have been starved of resources while the money is spent on flawed central technical systems. The proposal fails to help and crowds out what works. Meanwhile, the agencies promising to catch predators by inspecting everyone's messages have, as Anderson notes, historically faced no penalty when they fail to prevent harm.

Which is why the answer is not a better checkpoint. Every version of “check everyone” needs one thing to function: a chokepoint. Everyone is forced through a single gate, where the inspection booth can be bolted on. An identity layer that every request must clear can be routed around, tricked, or fall victim to data breaches. Remove the chokepoint, and there is nothing left to install the check on.

The answer isn’t a gentler checkpoint. It’s infrastructure with no chokepoint at all.

You don’t petition the booth to be kinder. If it can be made less strict, it can also be made tighter on demand. Instead, you build a road that was never designed to have a booth. That is the work: parallel systems with no central gate to inspect, no personal documents hoarded on servers vulnerable to breaches, and no single point to which a detection order can be pinned. Not a better version of being checked, but an internet where no central authority can require you to prove your innocence of a crime you were never suspected of.

What it takes

Privacy-preserving technology and institutions
that serve the communities they belong to.
Both strengthen one another.

Logos is building them both.

The Logos stack. Peer-to-peer communications, storage and a blockchain layer, decentralised and privacy-preserving by construction. No central point to hand data to, no gate where a booth could be installed, no operator who could be compelled to open one. Privacy here is not secrecy. It is a right made enforceable by cryptography rather than policy.

Logos Circles. Technology alone won't save us. Logos Circles are self-organised local groups that translate the tools and values of Logos into collective action. By tackling winnable issues that matter locally, from cleanups and community fundraising to advocacy against measures that threaten our freedoms, Circles build the trust, solidarity, and parallel civic capacity that a resilient, people-powered network requires.

Build the ParallelGet Started Join a CircleJoin the movement

The case file

Each quoted line above is reproduced verbatim from its source. The findings are paraphrased,
and the full argument behind each is in the sources below. They are worth reading in full.