Telegram is a messaging app which brands itself as secure and uncensored. However, the arrest of Telegram’s CEO Pavel Durov has triggered sweeping changes for the app. Reporters Without Borders (RSF) investigates how these changes affect the safety of journalists using Telegram.
Telegram is a popular messaging app with over 900 million users. It works similar to Whatsapp, where users sign up using their phone numbers and enter into private or group chats. Telegram also has a feature called “channels,” where users subscribe to a news feed that acts much like a social media platform.
Telegram channels are encrypted and have little content moderation, making them attractive to journalists and activists looking to escape censorship. However, these same features also foster criminals, hackers, and extremists. Telegram has been blocked in some capacity in 19 countries either for its use in coordinating criminal activity, or for refusing to cooperate with authorities. In August 2024, Telegram founder Pavel Durov, was arrested in France for these very reasons, and the app has undergone drastic changes.
Original safety concerns
- Unclear moderation policies. Telegram contains a high volume of illegal content. Despite this, Durov claimed that Telegram has active content moderation and removes “millions of harmful posts and channels every day.”
- Lack of end-to-end encryption (E2EE). E2EE is only available for one-on-one private chats, and is not enabled by default. While all messages are encrypted and cannot be read by third parties, Telegram itself can decrypt them.
- Untested encryption protocol. Telegram uses MTProto, a relatively new, untested form of encryption. Security experts know little about it, and are unable to properly test it due to the code being privately owned and not open-source.
Additional safety concerns after the arrest
- Increased content moderation. Durov has claimed that Telegram will crack down on illegal content on the platform. It is currently unclear when or how this will be implemented.
- Increased government cooperation. Telegram has declared it will hand over IP addresses and phone numbers to authorities upon request. It is unclear whether the content of user messages could also be handed over.
- Changing response to authorities. Telegram’s policy now states that authorities can request information on any user who is a suspect in a criminal case. Though Telegram will only comply if the user is also violating their terms of service. The policy also claims that any instance of this will be made public.
Safety recommendations to journalists
- Be aware that identifying information may be revealed by Telegram. Metadata attached to communications, IP addresses and phone numbers, cannot be hidden even with E2EE. Journalists should be aware that Telegram may hand their data over to authorities, and that it could be used to identify them.
- Enable secret chats. E2EE is not a default setting for one-to-one conversations and should be systematically enabled whenever possible. This will hide the content of communications from Telegram itself.
- Move to a more secure platform. The rapidly changing situation and questionable encryption practices make Telegram a liability, particularly for journalists operating in authoritarian regimes. RSF recommends Signal or Whatsapp as an alternative for private messaging.
