An independent audit by Symbolic Software, a firm specializing in cybersecurity and technical audits for Zoom, Mozilla, Coinbase and other IT giants, has confirmed Important Stories' findings about a Telegram vulnerability. The report surfaced in the outlet's possession as part of a Swiss court case: it was submitted by Vladimir Vedeneyev, who sued the article's lead author and founder of Important Stories, Roman Anin. In his lawsuit, Vedeneyev does not dispute the investigation's claims but demands the removal of an interview in which he admits to cooperating with the FSB.
The audit states: "Our analysis confirms the key technical findings: Telegram transmits messages over unsecured TCP connections, causing the auth_key_id identifier to be sent in plaintext or in a form easily decrypted by any network intermediary." According to the experts, auth_key_id "effectively functions as a persistent device identifier: it does not change between sessions, when the IP address, internet network, or even the user's geographic location changes." This creates an opportunity to track devices by anyone with access to traffic, including internet providers, network administrators, and state surveillance systems.
What Exactly the Audit Found
The experts note that collecting auth_key_id does not require a complex man-in-the-middle attack, certificate compromise, or protocol interference—it is enough to passively observe traffic and perform minimal data processing. Because the identifier remains unchanged between sessions, across network changes, and over extended periods, any entity collecting such identifiers can build a database linking specific auth_key_ids to internet connection locations, activity times, and traffic patterns, and—when the user's identity is known—to specific individuals. This enables answering questions such as "Where has the device with auth_key_id X appeared over the past six months?" or "Which devices were at connection point Y during a certain time period Z?"
Symbolic Software emphasizes that the vulnerability did not arise from a technical oversight but from "Telegram's fundamental refusal of its duty to protect users' privacy using modern cryptographic mechanisms." The solution, according to the experts, is obvious: make transport encryption mandatory—a standard technology used today by virtually all major messengers. This is said to be technically simple to implement and has almost no impact on service speed, while significantly improving privacy protection.
Telegram's Position and the Context of the Dispute
A Telegram representative, Remi Kong (whether such a person actually exists is unknown: there are no photos or other mentions of him online), sent a response to the Important Stories editorial team rejecting the unpublished report's conclusions. According to him, auth_key_id "changes regularly and does not reveal information about users, message content, recipient data, or other private information." Kong also stated that any observer able to see this identifier would already have access to more reliable tracking methods beyond Telegram's control, and that the messenger's infrastructure is configured, managed, and controlled exclusively by Telegram's internal engineering teams.
In last year's Important Stories investigation, Vladimir Vedeneyev denied the described vulnerability and claimed he only passes his FSB handler information about internet users of Russian companies, not about Telegram. In the interview he also said: "Telega has no access to data centers in Singapore or Miami: they've never been there. Four data centers have already been built. You (the company GNM owned by Vedeneyev, which services Telegram's network infrastructure—Ed.) are already in four of them during tests. <...> At present, I provide all communication channels. Not someone else, but I! If I really want to, of course, I can intercept this traffic."
Symbolic Software experts also allow that attackers with access to traffic and device identifiers could decrypt messages if they have access to a specific user's key database. The report emphasizes: "Until such measures are implemented, Telegram bears responsibility for the privacy risks arising from persistent device identifiers remaining available to observers with access to network traffic."
1
