"It endangers us all," the encrypted messaging platform said, summing up its response to the United Kingdom's plan to compel tech firms to scan devices for nude images of children.
Signal's warning: the surveillance trade‑off
Signal publicly rejected the UK government's proposal announced by UK Prime Minister Keir Starmer at London Tech Week, saying the plan "will not keep children safe" and calling the required mechanism "dangerous" and "dystopian." In a statement (PDF), the company argued that a mandatory device‑level scanning regime would break the private communications trust model the app has long marketed: even if content were not sent to a third party, client‑side scanning would mean Signal "could no longer say that message content stays between sender and receiver only."
Keir Starmer's three‑month ultimatum
The proposals are not law. Starmer used his London Tech Week address to set a three‑month deadline for tech companies to "make the changes the UK wants to see or the government will legislate." He said, "When it comes to the safety of our children, standing by is not an option. Nobody gets a free pass. That is why I'm making sure Britain is the first country in the world to make it impossible for children to take, share or view nude images." The government specifically demanded that Apple and Google "block nudity by default across their devices," a requirement described in the plan as covering cameras, third‑party apps, and messaging services, with an option for adults to remove the block by verifying their ages.
Client‑side scanning: hashes, AI, and the update problem
The UK proposal centers on client‑side scanning (CSS) — techniques that inspect content on a device before it is sent. Implementations described in the reporting fall into two broad categories: matching image hashes against a database of known abuse material, and scanning images with on‑device AI models. Signal highlighted how both approaches introduce new trust dependencies: databases or models must be updated and pushed to devices, widening the attack surface. The company warned that attackers could attempt to manipulate those updates, and that updated scanning mechanisms could be repurposed to block other content — Signal cited a hypothetical example where the same mechanism could be used to block "messages criticizing the government."
Supporters and campaigners back device blocks
Charities and campaigners rallied behind the government's announcement. Chris Sherwood, chief executive at the NSPCC, said the mandatory device‑level blocking of inappropriate material "marks a major step forward in our fight against online child sexual abuse." Roxy Longworth, author and founder of Behind Our Screens, said the measures made her hopeful children "won't be kids sat in their room feeling the same pressure and shame that consumed my teenage years." Proponents frame client‑side scanning as a compromise that keeps data on the device — contrasting it with approaches that would send user content to intermediaries for inspection.
What this means for Apple, Google, and encrypted messaging services
- Apple and Google: The government has singled out these vendors and demanded nudity‑blocking by default across devices, including system cameras and third‑party apps. The plan envisages an adult opt‑out through age verification.
- Encrypted messaging services (Signal and similar apps): Signal says the proposal would force it to change its privacy guarantees. The company has not threatened to leave the UK over the announcement, though it has previously "mulled exiting Sweden" over proposed laws and "more recently Canada" while that country debated a bill to compel platforms to gather users' metadata.
- Public and civil liberties: Signal urged public funds be redirected to "education, social services, and guardrails on AI technologies and platforms" rather than building what it called "invisible surveillance infrastructure, switched on by default."
Signal's critique frames the dispute as a choice between different forms of intervention: device‑level, automated inspection that the company says risks expansion and misuse, versus investment in non‑technical child protection measures. The UK government has used existing laws in the past — the Investigatory Powers Act and the Online Safety Act — to argue for legal tools to protect citizens, and critics have previously labelled those laws as enabling broader surveillance or censorship. For now, the immediate next step is political, not legal: tech firms have three months to respond to the prime minister's demand before the government signals it will turn the proposal into law.
