October 14th was supposed to be the day the European Council voted to mandate scanning of all private communications, encrypted or not.
The vote was pulled at the last minute.
Germany withdrew support, creating a blocking minority that blocked the Danish Presidency's hope to get the text approved. Denmark still hopes to push this through by the end of its EU presidency in December. I personally would like to be optimistic and think that the tech community managed to raise enough concerns with EU policymakers.
Hundreds of European companies such as Proton, NordVPN, Tuta, Murena, Element, ProcessOne voiced their concerns about Chat Control. These companies are building the European alternatives we need for digital sovereignty. They offer what the EuroStack coalition is demanding: local infrastructure, values-driven technology, independence from US hyperscalers.
And EU policy trying to force them to break the very protocols that make sovereignty possible does not seem like the wisest strategic move.
What policymakers are missing is that encryption is a built-in foundation of most communication protocols. You cannot turn it on or off depending on what is considered right in a given place at a given moment. You either have secure end-to-end encryption or you don't. There is no "just this once" exception that doesn't become an exploitable technical or administrative vulnerability.
When Denmark's Justice Minister suggested that the "completely misguided perception" is that everyone has a right to secure communication, he revealed the fundamental gap: policymakers who don't understand that secure infrastructure is the core of today's Internet backbone, not just for the pure sake of democracy (I swear it hurts to have to explain this), but also for the existential security of European countries.
Today, European countries are prioritizing defense spending while missing that digital infrastructure is the battlefield. Networks allow us to control drones, spread misinformation, they are vectors of attacks on critical infrastructure.
It is time for Europe to develop a coherent tech strategy. Can we build digital sovereignty while simultaneously undermining the protocols that enable it? Can we demand independence from US tech giants while forcing European alternatives to adopt vulnerabilities that US companies will try to avoid through commercial pressure?
The October postponement is an opportunity. Two months for actual infrastructure builders and engineers to inform policy. Two months to bridge the gap between Brussels' political vision and the technical reality of how secure systems actually work.
This is exactly the gap I work to bridge: between policymakers who understand the geopolitical stakes and engineers who understand protocol layers. Europe's path to digital sovereignty requires both.
Denmark's December push will show us whether Europe is serious about learning from its own technical community, or whether we're condemned to keep making policy that contradicts our stated goals.
The European way should be: tech with purpose, built on sound engineering, serving democratic values. Not tech policy that undermines the very infrastructure we need to achieve independence.