On June 6, the human rights project Pervy Otdel (First Department) reported that the FSB is opening treason cases against Russians who wrote to bots and feedback accounts of Ukrainian Telegram channels. On June 10, Vazhnye Istorii (Important Stories) reported on links to security services of the people responsible for the app's server infrastructure. Meduza examined what experts think of these materials.
What the investigations established
According to Pervy Otdel, within the case opened by the FSB in spring 2022, security forces intercept user messages. Exactly how the content becomes available to the security service is unknown. Project head Dmitry Zair-Bek suggested: “This may point either to the use of undisclosed cyber-espionage tools or to Telegram's cooperation with the Russian authorities.”
Vazhnye Istorii found that a significant part of Telegram's server infrastructure is serviced by Global Network Management (GNM), a company from Antigua and Barbuda with a representative office in Russia; it owns a router in the server room. GNM's owner is Vladimir Vedeneyev, who at least in 2018 held the position of chief financial officer at Pavel Durov's company. The IP addresses of the servers now controlled by GNM until 2020 belonged to the St. Petersburg operator Globalnet; its co-owner alongside Vedeneyev is Roman Venediktov, a longtime business partner of Durov and a former military officer. In 2022 the company implemented a traffic control system using Deep Packet Inspection. Among Globalnet's clients was the enterprise GlavNIVTs, which the authors call an unofficial analytical center working in the interests of security agencies; Vedeneyev is also linked to the company Elektrontelecom, a contractor of the FSB.
The authors paid separate attention to the auth_key_id identifier: when an encrypted message is created, an unencrypted device identifier is added to its beginning — in both normal and secret chats. The expert who studied this, Michał Woźniak, explained that whoever carries the traffic can track device identifiers, and together with IP addresses and sending times this may possibly allow determining location and obtaining data on which devices are exchanging messages.
What Telegram and GNM said
The messenger's press service told the outlet Vot Tak that “all Telegram servers belong to Telegram and are serviced by Telegram employees” and “unauthorized access [to the servers] is impossible.” In a comment to the BBC Russian Service, the company added that it has contracts with dozens of suppliers worldwide, but none of them “has access to Telegram's data or confidential infrastructure.”
GNM told the Varlamov News project that its owner never held positions at Telegram, and the mention in documents as chief financial officer was “technical and formal in nature.” The company stated that it “has no access to Telegram's data, encryption keys or message content,” and that auth_key_id “does not contain a unique user identifier.” According to GNM, “no GNM equipment was used for analyzing, filtering or monitoring Telegram traffic,” and the company “does not cooperate with Russian state agencies.”
Experts' assessments
Investigative journalist Andrei Zakharov noted that through SORM the FSB sees who connects to Telegram, and by packet size can tell whether a person is calling or writing, but does not read messages. The open auth_key_id, he said, is also visible through SORM. Meduza's David Frenkel pointed out that these identifiers may be visible to someone with access to Telegram's servers, but it is impossible to determine who the message was intended for and what it contains. He also recalled alternative explanations for security forces having message histories: honeypots, vulnerabilities and the carelessness of the participants themselves.
Former Telegram manager Anton Rozenberg said that correspondence is stored in its own DBMS text-engine, disks and files are encrypted, but the keys are held by Telegram itself, and at the level of the working database messages are not encrypted.
Leonid Volkov, head of political projects at FBK, called Vazhnye Istorii's conclusions shaky: in his view, the materials do not imply that the company has access to messages, and the panic is unjustified. The Bell noted that directly for user security this means “nothing”: access to routing gives only the same data that a provider and security forces via SORM already have. Lawyer Sarkis Darbinyan pointed to the novelty — Vedeneyev's link to state contracts and the FSB — but acknowledged that there is no proof of Telegram's constant cooperation with security forces. Mikhail Klimarev, director of the Internet Protection Society, noted that no messages actually leaked from Telegram have been recorded so far.
1
