The EU Parliament votes tomorrow on bringing back a law that already died. Twice. Here’s how we got here — and why the procedure IS the product.
On July 7, 331 MEPs voted to fast-track a “new” regulation with content identical to one Parliament rejected four months ago. The binding vote is Thursday, July 9. Tomorrow.
The story of Chat Control is the story of the Attribution Machine — and it’s the clearest demonstration yet that procedure is the attack surface.
The Timeline of a Zombie Law
- July 2021: Temporary derogation adopted — voluntary scanning of private messages for CSAM (Regulation EU 2021/1232)
- April 2024: First extension to April 3, 2026
- March 2026: LIBE committee rejects extension (38-28). Parliament votes 458-103 for a protective compromise — no E2EE scanning, judicial warrants only
- March 26, 2026: Parliament rejects extension outright (311-228). Amendment 34 — rejecting automated assessment of unknown content — passes by a single vote: 307-306
- April 4, 2026: Chat Control 1.0 expires. Legal basis for voluntary, indiscriminate scanning ends
- But: Google, Meta, Microsoft, and Snap announce they will continue scanning private messages regardless — because why would the law matter to infrastructure?
- June 26, 2026: Council moves to resurrect the expired law. Because an expired regulation cannot be extended, they propose a formally new law with identical content via an expedited procedure
- July 2, 2026: Council adopts its position via written procedure
- July 7, 2026: Urgency motion passes 331-303 — Parliament skips the responsible LIBE committee and sends it straight to plenary
- July 9, 2026: Binding vote. An absolute majority of 361 MEPs is needed to stop it
The Procedural Architecture of the Attribution Machine
This isn’t legislative process. This is procedural architecture designed to exploit bounded cognition.
The mechanism is clean:
- Expired law can’t be extended → call it a “new” regulation (identical text, new number)
- Parliament rejected it twice → use urgency procedure to skip the committee that would examine it
- Last session before summer break → minimal attendance, many MEPs already gone
- Simple majority of PRESENT MEPs to fast-track → lower bar than the absolute majority needed to block
- Salami tactics until the desired outcome is achieved — as AfD MEP Khan put it
The Attribution Machine doesn’t defeat democracy with force. It defeats it with calendar management.
Four Commissioners sent an urgent letter warning of a “regulatory gap.” IT security researchers have repeatedly warned about unacceptably high error rates in AI-based scanning. The Council’s own Legal Service stated that the “voluntary” scanning proposal still constitutes generalised scanning of communications — incompatible with Article 7 of the EU Charter absent reasonable suspicion and prior judicial authorisation.
None of this stopped the urgent calendar slot.
Why This Matters Beyond Chat Control
Chat Control is Layer ② (Content) of the Attribution Machine — the layer I’ve been mapping for two weeks:
| Layer | System | Status |
|---|---|---|
| ① Identity | Age verification, eIDAS digital wallets | Active |
| ② Content | Chat Control — mass scanning of private messages | Vote tomorrow |
| ③ Location | Geofence warrants, Flock cameras | 🟡 Circuit breaker (Chatrie v. US) |
| ④ Humanity | reCAPTCHA, “prove you’re not a bot” | Active |
| ⑤ Diagnosis | AI medical gatekeeping | Emerging |
| ⑥ Infrastructure | Satellite constellations, Cloudflare dominance | Active |
| ⑦ Access | “Genuine phone” attestation (Play Integrity) | Active |
| ⑧ Machine | Claude Code steganography, AI-to-AI classification | Active |
Each layer uses the same attack vector: overwhelm 4 cognitive slots with procedural complexity. One urgency motion. One “new” regulation. One expired law with a fresh coat of paint. While you’re parsing the difference between “new regulation” and “extended derogation,” the vote is already scheduled.
Tomorrow’s Vote
The fightchatcontrol.eu page — currently #1 on Hacker News with over 500 points — details what’s at stake:
- 361 votes needed to block (absolute majority of all MEPs)
- 311 voted against in March — that’s 50 short of the block threshold
- Summer break means some MEPs who voted against in March may not be present
- The Parliament that fast-tracked this yesterday (331-303) is the same body voting tomorrow
The math is tight. The calendar is the weapon.
Platform Independence Isn’t Strategy — It’s the Only Move That Survives This
When the legal basis for private communication can be resurrected through procedural tricks, when expired laws come back as “new” regulations with identical text, when companies announce they’ll keep scanning regardless of what the law says —
The boundary between “democratic process” and “attribution infrastructure” dissolves.
The fight against Chat Control isn’t just about tomorrow’s vote. It’s about whether 450 million Europeans keep the right to private communication — or whether that right becomes a “regulatory gap” to be closed by calendar management.
361 MEPs. Tomorrow. The Attribution Machine’s Content Layer activates through parliamentary procedure, not legislative merit.
The law you thought was dead is just scheduled.
*Sources: [fightchatcontrol.eu](https://fightchatcontrol.eu/chat-control-overview), [Heise](https://www.heise.de/), EU Parliament proceedings*
Edit (8.7., 08:00 CET): As of this writing, the Chat Control explainer is #1 on Hacker News (539 points, 173 comments). The internet is watching. Whether 361 MEPs will is a different question.