By default, Telegram does not use end-to-end encryption: it is built only into secret chats, which must be enabled separately. In ordinary chats, used by 98% of the audience, messages are decrypted and stored on Telegram's servers, Vazhnye Istorii notes. This means that whoever controls the server can gain access to the correspondence.
An unencrypted identifier
Digital security expert Michał "Rysiek" Woźniak explained that when an encrypted message is created, the app adds an unencrypted identifier (auth_key_id), by which the server identifies the device and selects the key for decryption. This applies to all chats, including secret ones. According to Woźniak, whoever carries the traffic can track device identifiers, IP addresses, sending times, location, and which devices are exchanging data. In Russia, he recalled, SORM is in force—a system obliging every provider to install surveillance equipment—so the security services have access to traffic.
The experiment: who is Vladimir Vedeneyev
Journalists asked users in Russia to exchange messages with a correspondent for the publication in Europe and record the traffic via Wireshark. In every case, device identifiers were transmitted over the network unencrypted. The IP addresses of the servers where the messages ended up, according to the European internet registry RIPE, belong to Global Network Management (GNM)—a little-known company from Antigua and Barbuda that has handed over more than 10,000 IP addresses to Telegram.
Having studied the materials of a 2018 court case, Vazhnye Istorii found that GNM had been in litigation with the owner of a data center in Miami, who turned out to be Tolyatti-born Vladimir Vedeneyev. In court, he said that GNM installs client equipment for the messenger and provides technical support, that half its employees are in Russia, that its office is in St. Petersburg, and that he is the only person with authorized access to Telegram's servers in Miami. According to the investigation, Vedeneyev held one of the key positions in the messenger's hierarchy, and his company owns a router in the server room. Woźniak stresses that GNM can see user identifiers and device-related data flows. Other sources familiar with Pavel Durov told the journalists they had never heard the surname Vedeneyev.
A company linked to the FSB
Until 2020, the Telegram IP addresses now controlled by GNM belonged to the St. Petersburg company GlobalNet, whose beneficiary was the same Vedeneyev. Hundreds of these addresses are still identified in Russia. In 2024, Vedeneyev transferred GlobalNet to relatives (96%), with another 4% belonging to Roman Venediktov—a longtime acquaintance of Durov, a graduate of the Mozhaisky Military Space Academy, who served in the Main Center for Testing and Control of Space Assets of the Ministry of Defense. Venediktov was also a co-owner of St. Petersburg-based Piring, which owned the DATAIX traffic exchange network, through which all of VKontakte's traffic flowed; in 2018, GlobalNet and DATAIX merged.
According to the journalists, GlobalNet provides communication services to Russian state enterprises, including in the defense sector, among them the Kurchatov Institute and the Main Research Computing Center of the Administrative Directorate of the President (GlavNIVTs). Until recently, Vedeneyev was the beneficiary of Electrontelecom, which handed over more than 5,000 IP addresses to Telegram. Internal financial documentation of Electrontelecom for 2024 shows that one of its most important state clients is the FSB: the company services "a complex for the transmission of special information from stationary facilities of the FSB Directorate for St. Petersburg and Leningrad Oblast, used for conducting operational-search activities in fulfillment of the state defense order."
Vazhnye Istorii stresses that the messenger's protocol allows security services to identify device identifiers wherever they have access to internet infrastructure—not only in Russia but also in the occupied territories of Ukraine. According to the journalists, the confidentiality of hundreds of millions of users in other countries may also be at risk, since Durov handed over the arrangement of Telegram's entire infrastructure to a company de facto located in Russia. The human rights project Pervy Otdel (First Department) has claimed that the FSB gained access to messages sent by Russians to bots of Ukrainian Telegram channels without physical access to devices and without hacking.
1
