The Telegram messaging application might be less secure than it has been portrayed, as its infrastructure is overseen by an individual whose companies have worked with Russian intelligence agencies, according to a recent investigation by the exiled media group IStories.
Pavel Durov, the Russian-born founder of the widely-used messaging platform, has marketed Telegram as a sanctuary for free expression and online privacy, especially in authoritarian regimes.
However, unlike its rivals WhatsApp and Signal, Telegram chats are not end-to-end encrypted by default. Users must specifically choose the app’s “secret chat” feature for enhanced security; otherwise, standard chats are decrypted and stored on servers.
IStories noted that this situation implies that anyone who manages the servers has access to the communications.
The infrastructure is overseen by Global Network Management (GNM), a relatively obscure company located in Antigua and Barbuda, which has supplied Telegram with more than 10,000 IP addresses, as revealed by IStories.
Vladimir Vedeneev, the owner of GNM and a citizen of Russia, confirmed in U.S. court that the company is responsible for installing and maintaining Telegram’s infrastructure and has personnel in Russia. IStories also found that Vedeneev holds the position of Telegram’s chief financial officer.
Many of GNM’s IP addresses were previously owned by Globalnet, a telecommunications company in St. Petersburg that has connections to both the Kremlin and Russian intelligence bodies, including the FSB, as reported by IStories.
Additionally, Telegram is said to have acquired 5,000 IP addresses from another St. Petersburg entity, Electrontelecom, which IStories identified as a contractor for the FSB. This company has supplied installation and maintenance for secure communication systems utilized in intelligence tasks.
In 2022, Globalnet implemented systems to monitor user traffic at the behest of Roskomnadzor, the Russian state communications regulator.
Oleg Matveychev, deputy chairman of the State Duma’s Information Policy Committee, stated at that time that Telegram and the FSB had come to an agreement where Telegram incorporated infrastructure to allow authorities to surveil users involved in criminal investigations, including those suspected of terrorism.
Moreover, in addition to decrypting users’ messages and storing them on servers, Telegram assigns a unique device identifier called “auth_key_id” to each message, cybersecurity specialist Michał Woźniak informed IStories.
This identifier enables the platform to identify the user’s device and utilize the appropriate decryption key. When combined with metadata like IP addresses and timestamps, Woźniak noted, this system could potentially trace a user’s physical location and their contacts.
“If someone is able to access Telegram traffic and collaborates with Russian intelligence, the device identifier presents a significant issue — it becomes a tool for extensive surveillance of messenger users, no matter where they are or which server they connect to,” Woźniak explained to IStories.
Later on Tuesday, Telegram issued a statement asserting that none of its contractors have access to user data or critical system components, and it has no employees or servers situated in Russia.
“All Telegram servers are owned by Telegram and are operated by Telegram staff. Unauthorized access is impossible. Telegram has no personnel or servers within Russia. Throughout its existence, Telegram has never shared personal messages with external parties, and its encryption has never been compromised,” said Telegram’s press office.
