The Hated One
patreon
Can you trust Telegram?
🕑 Added 2024-09-11 17:28:20 +0000 UTCTelegram is a messaging app with one billion users and currently the only platform whose CEO got arrested. This is Pavel Durov, the founder and chief executive officer of Telegram. He currently cannot leave France and has to report to a police station twice a week. His crime? Failing to respond to judicial requests to identify a suspect of an active investigation.
This is big. Arresting a tech exec is something that never happens, no matter the reason. [1]
The only other time I can recall is when Ross Ublricht got yanked into prison for literally running an illegal drug empire on the dark web. [0]
I mean Facebook algorithms got caught promoting a genocide in Myanmar and nothing ever happened to Zuckerberg or anyone else at the company. [2 – 4]
But I am not so sure about this. Durov is a Russian citizen and his Telegram has been used by dissidents around the world in pro-democracy protests. Telegram has always marketed itself as a pro-free speech and anti-censorship platform. It’s a self-proclaimed encrypted and secure messaging app.
But can we honestly trust these claims? Is Telegram a genuinely secure platform for anyone to communicate safely? Or is this just another billionaire oligarch venture playing the long game where monetizing the customer is the end goal?
I want to evaluate Telegram on seven merits that should determine whether we should or shouldn’t trust it. These seven points will assess Telegram on safety, the personality of Pavel Durov, its business model, collusion with government, who it’s used by, applied security and technology. Based on my investigation and analysis, I am going give Telegram a plus point for when I think a reason warrants trust, and negative point for when I think trust should be revoked. By the end, I’ll give you a total score that will judge whether you should trust and use Telegram or not.
On my Patreon podcast, I dive deeper into each of these aspects and in long-form episodes you can listen to for free.
BTW, if you want to me to do analyses like this in the future about some other app, let me know!
Let’s start with how safe the platform is for the end user – can you trust Telegram with your safety? The answer to this question lies in the indictment and charges against Pavel Durov. His arrest was sudden and unexpected. But it was a result of an undercover investigation that was going for months beforehand. [5] It started when the cybercrime unit of the Paris prosecutor wanted to identify a Telegram user who was luring underage girls into sending self-produced CSAM. [5]
Telegram was contacted by the French authorities with a request to identify the suspect. But for some reason Telegram never responded. So the French authorities decided to go for the nuclear option and got the warrants for Pavel Durov and his brother’s arrest. [6]
According to the authorities this lack of cooperation wasn’t anomalous but a pattern of near “total absence of a response by Telegram to judicial requests”. [7] An observation which was shared by investigators from other European countries. [8]
We also know this from Durov’s admission that he prefers hands-off approach to moderation in seeking free speech absolutism on his platform. And it appears that Telegram wasn’t taking down things they were notified of either. [0]
Durov’s charges aren’t evidence of guilt. Conviction will come after the trial, before which, many of the charges may be dropped. [8]
But they are a reflection of how Telegram handles genuine safety issues. Boasting hands-off approach and free speech absolutism is a terrible call. Government cooperation can be sketchy, we know that thanks to Snowden. But we are not talking about backdoor access to encrypted communication. Telegram refused to help an active investigation and refused to respond to judges. There is no reason this should be justified. And for that, Telegram receives a minus point on trust.
Over the years of my research into privacy, monopolization and corporate power, I’ve come realize the importance of personal leadership at companies that promise a privacy solution. And that is so much more important for the dubious Telegram.
Telegram was founded by brothers Pavel and Nikolai Durov after they made their billions off of Russia’s largest social network VK. VK had a rocky history with the Kremlin that demanded the company takes down online communities of Russian opposition activists. Later, the Russian government asked for personal data of VK users who participated in 2013 Ukraine uprising. Under pressure, Pavel Durov sold his stake in VK and left the country. [9]
This may have served as an ideological impetus to start Telegram as an anti-censorship, pro-free speech platform. Durov’s anti-censorship stances do seem to be ideologically rooted. He seems to personally believe that free speech should be absolute, and is willing to take it extremely far, even if it threatens the existence of the service. His willingness to resist all forms of government censorship and surveillance is commendable. For that, I’d give him a plus point.
But what strikes me odd is that this is when Durov began shopping for citizenship in multiple countries. [5]
After leaving Russia, Durov obtained a permanent residency in Dubai where he based Telegram’s operation. At this time, he paid $250,000 a year to acquire a citizenship of Saint Kitts and Nevis, a popular tax haven for the wealthy. He has never actually been to the Caribbean island nation. [10]
Meanwhile, Durov managed to meet with the crown prince of Dubai and joined an advisory council to one of the seven rulers of the United Arab Emirates’. Eventually he gained the UAE citizenship, a rarity for a nation that doesn't have a path to citizenship unless you get approved by one of the country’s top ruling figures. [10] In 2021, Durov also obtained French citizenship without apparently meeting the standard requirements. He then transliterated his name to Paul du Rove. [10]
This to me evokes a behavior of a person that plans to dodge accountability. That if things go rough, he’ll have a nice tropical place to retire in. I think Durov is doing this to immunize himself and Telegram of any accountability and for that, he gets a minus point.
Telegram has so far had no business model. The venture has been personally funded by the billionaire wealth of Durov. He now promises to introduce a ‘privacy-friendly’ monetization system based on contextual advertising. [11, 12]
These are ads based on the context of the channels you are viewing. That’s opposed to targeted ads, which are profiled to your specific interests, usage habits and traits and which require invasive surveillance. [13] DuckDuckGo is one example of a monetization via contextual ads and it seems to work for them. [14]
An even better model would be to run Telegram as a non-profit. This is how Signal and Proton are run. They removed the profit incentive so that the only thing they are concerned with is focusing on security and improving the platform for the user – not to make money for the shareholder.
Durov promises not sell his company. [15] And only time could prove him right. [16]
While not being the gold standard, this is still much less evil model than publicly traded corporate apps like iMessage, WhatsApp or Facebook Messenger. I do not trust the infinite growth model, but I can respect a private business. I’ll give Telegram a plus for not selling out and for promising to keep a sustainable model that respects users’ rights.
Telegram boasts they have never shared a byte of user data with anyone, including governments. That statement is impossible to prove and difficult to disprove without evidence. Signal publishes warrants and subpoenas for their user information and they are consistent with Signal’s privacy claims. I couldn’t find any such transparency reports from Telegram. [17]
But what we can find is the strange record of Durov buddying up with government officials and authoritarian rulers. At first, Kremlin seemed to have hated Telegram due to how popular it was with pro-democracy protesters in Russia and Ukraine. So they banned the app in the country.
That animosity has since subsided. The ban on Telegram in Russia was lifted in 2020. Now half of Russians use Telegram and even the Russian military coordinates actions over the app. [18] Which is a shift that makes me ask – how?
Even stranger was Kremlin’s response to Durov’s arrest, when Moscow stepped up to provide “all necessary assistance and support”. They called out France and the West for being hypocritical on free speech. That is a really strange behavior considering 10 years ago, Durov was forced to sell his stake in VK and chose to leave the country to avoid Russia’s repressions. [5]
Now Telegram is based in Dubai. Which is even weirder. Durov claims Dubai is “the best place for a neutral platform” like Telegram to be in. [6] A strange thing to say about a country that jails people for minimum 15 years for insulting the president and detains people for expressing their beliefs. [19, 20]
Telegram’s relationship with the UAE regime doesn’t just end there. Throughout his stay, Durov set up meetings with the most influential figures in the country, including the crown prince of Dubai. He joined an advisory council to one of the country’s seven rulers. While at that time, Abu Dhabi’s sovereign wealth fund invested $75 million into Telegram. [10]
Durov fired shots at Signal for starting with a $3 million US government grant. [21] Which is rich coming from a guy that took 25 times that amount from an Emirati wealth fund. [10] He also lied about Signal leaking messages due to faulty encryption, a claim evidence for which has never been found. [21]
If Signal is controlled by the US government, then Telegram is controlled by the United Arab Emirates.
I find that hard to believe that Durov’s kissing-up is so good that aristocratic rulers wouldn’t ask for anything else in return. Speculation on my part, I admit. But I am not gonna trust you if you go buddy-buddy with authoritarian rulers that impose arbitrary detentions. A minus point for Telegram.
Who uses the app can often tell you a lot about how much you can trust it. Especially if you look at the edge cases. This can go both ways so how is it with Telegram?
Telegram has been used by protesters against authoritarian regimes around the world – including Hong Kong, Iran, Russia of course, Ukraine and Belarus. For this reason, Telegram has been banned in many countries. Iran in fact, stepped up to praise France for arresting Durov, as the app is still widely popular in the Islamic country despite being officially banned. [7] And unlike big tech giants like Apple or Facebook, Telegram seems to be committed to protecting the identity of its users and availability of the service even when clashing with angered governments. [22] Telegram is also implementing censorship evasion tech, which is something that Signal and ProtonMail also do. For that, Telegram deserves a plus point.
However, Telegram is taking its anti-censorship stance too far. If you don’t agree, either I am a lunatic or you are. Telegram allowed violent extremist groups on its platform to roam free. When ISIS was rampantly using Telegram to recruit and spread propaganda, Durov said he shouldn’t feel guilty about it. He said this at the height of the groups campaigns and attacks. [23] It was only months later that several ISIS-related channels were blocked. [18] There have also been cases of extremist groups using Telegram to plan assaults, spread violent content and conduct attacks on schools. [18]
To me this is where free speech clearly crosses the line. Those that infringe on others’ personal liberty and life should be banished, not protected. Durov should recognize this and until he does, Telegram gets a minus point.
This is a very interesting assessment. And very unorthodox. How secure an app isn’t determined just by its security model but also by how practical it is to extract data from the service. In 2021, there was this secret FBI document that leaked. [25] It lists all the popular encrypted messaging apps, including Signal, WhatsApp, Threema and Telegram. The document describes how much information the Federal Bureau can legally request from respective apps. [25] Among all the apps, Telegram and Signal came on top. Signal provided the least useful information – only timestamps for registration and last date of connecting to Signal service. [25] For Telegram, the information included users phone number and IP address, but only for confirmed terrorist investigations. [25] By this standard, Signal and Telegram easily trump messaging behemoths like iMessage, WhatsApp and Viber.
This doesn’t mean Telegram is technologically more secure than these other apps. It’s more likely the case that Telegram’s legal structure, the fact that it’s offshore and law enforcement would have to go through multiple channels to get the warrants and subpoenas they need, means a regular lawful access doesn’t return the same level of data as it does for other apps. Telegram gets a plus point.
Telegram is aggressively marketed as a private and secure messaging app. But is that true?
Surprisingly, the answer to this question is a resounding no. The bare minimum a privacy app should meet, is deployment of end-to-end encryption by default. That is the content of every message should only be accessible to the sender and recipient but not the service provider. Telegram doesn’t use end-to-end encryption by default. [26] In fact, most of the features have no option for enabling end-to-end encryption at all. It is only possible for one-on-one chats in a feature called Secret Chat but the option is not even immediately available. [26] You’d have to start a new chat and go through at least four taps to turn it on. Even then, encrypted chat will only start until your recipient is online. [26]
This is a terrible design and it’s even worse that Durov vehemently defends his position – saying that Telegram doesn’t need end-to-end encryption because the messages are stored in multiple locations. But it still means your messages are always accessible to Telegram. [27] If Durov wanted, got compromised or blackmailed, everything could get out. If Telegram got hacked, the attackers would get access to your messages.
This wouldn’t be possible with Signal or WhatsApp, because these services encrypt your conversations by default with keys only users possess. This the standard in secure messaging. Telegram is thus bested by Signal, Matrix, WhatsApp and even Facebook Messenger. Literally Facebook is more secure than Telegram. [6] [28]
Durov says that Telegram is much more than just a secure messenger and that all of Signal is contained in Telegram’s secret chat feature. That is false. Yes, Telegram is more than just one-on-one chats. It has public channels and massive group chats so by that aspect, it’s more of a social network. [29] Signal doesn’t just encrypt one-on-one chats. They also encrypt group chats, group calls, profile metadata, offer sealed sender and an open proxy service.
This is a massive L for Telegram if you expect any provable privacy protections from the app.
So that was the last parameter and now we should have the final score. In total, I gave Telegram four plus points for personal stance, company promise of ethical advertising, enabling pro-democracy protests and applied security. I gave it five minus points for safety, weird passport shenanigans, buddying up with authoritarian rulers, allowing violent extremists and abusers roam free on its platform and for terrible stance on end-to-end encryption.
What does this mean? It means that you should know that your chats are not private with Telegram. But if you only intend to use Telegram for its public features and you understand you are not private, go ahead. In either case, you should still be aware that Telegram doesn’t banish actually harmful individuals from its app which is a major concern for the safety of children and vulnerable populations that might fall victim. Yes, there are bad people everywhere but Telegram is uniquely bad at keeping its users safe.
So that’s my evaluation. I am gonna use this template for other apps and services. So post your suggestions in the comments if you want more content like this. And join my Patreon because I have a podcast there and I am poor as fuck.
Sources
[0] https://www.nytimes.com/2024/08/20/technology/meta-section-230-lawsuit.html
[1] https://www.nytimes.com/2024/08/28/technology/durov-telegram-liability-platforms.html
[3] https://www.bbc.com/news/world-asia-59558090
[4] https://time.com/6217730/myanmar-meta-rohingya-facebook/
[5] https://www.politico.eu/article/exclusive-telegram-ceo-brother-nikolai-durov-wanted-france-authorities-pavel-durov/
[6] https://apnews.com/article/telegram-pavel-durov-arrest-2c8015c102cce23c23d55c6ca82641c5
[7] https://apnews.com/article/france-telegram-pavel-durov-arrest-6e213d227458f330ed16e7fe221a696c
[8] https://www.politico.eu/article/france-charges-telegram-ceo-pavel-durov-released-bail/
[10] https://apnews.com/article/telegram-pavel-durov-passports-ce3b260f1366fe0f4480313f1e1d2c0a
[13] https://foundation.mozilla.org/en/blog/fellow-research-toward-privacy-friendly-digital-ads/
[14] https://duckduckgo.com/duckduckgo-help-pages/company/ads-by-microsoft-on-duckduckgo-private-search/
[16] https://www.ft.com/content/8d6ceb0d-4cdb-4165-bdfa-4b95b3e07b2a?sharetype=gift
[17] https://t.me/transparency
[18] https://time.com/7015129/pavel-durov-arrest-france-telegram/
[19] https://www.hrw.org/world-report/2024/country-chapters/united-arab-emirates
[21] https://www.theregister.com/2024/05/14/telegram_ceo_calls_out_rival/
[25] https://propertyofthepeople.org/document-detail/?doc-id=21114562
[27] https://www.wired.com/story/telegram-encryption-end-to-end-features/
[28] https://apnews.com/article/meta-messenger-full-encryption-2ab384258750fd83cc3b5d9d8622f0f4
[29] https://www.wired.com/story/telegram-encryption-end-to-end-features/
Comments
The Hated One
Just realized I forgot to fill out the final score table. Will redo it and reupload.
