Which law specifically says that user data has to be scanned, breaking encryption if necessary? Everything I've seen says that they have to report what they find, but are under no obligation to actively look for it.