The iStories and OCCRP investigation published the day before claims that a key role in Telegram's technical infrastructure is played by Vladimir Vedeneyev, 45, described as "a key player in the Russian telecommunications market." His company Global Network Managements Inc. (GNM), according to iStories, services Telegram's network equipment and provides the messenger with thousands of IP addresses. US court documents cited by the investigation show that Vedeneyev had special access to Telegram's servers in a Miami data centre for technical assistance, was authorised to sign contracts on Telegram's behalf and was listed as its chief financial officer.
Many of GNM's IP addresses, it is reported, were previously used by the St Petersburg company Globalnet, which holds contracts with Russian state and intelligence structures. Among its clients, iStories names the Main Research Computing Centre of the Administrative Directorate of the President of the Russian Federation (GlavNIVTs). This centre officially provides technical support for high-level events, but according to the investigation's hypothesis, it is in reality "perhaps the most secretive and least studied intelligence service in Russia," which "helped plan the invasion of Ukraine, modernised a large botnet, developed a centralised video surveillance system and created tools for tracking and de-anonymising internet users."
In addition, Telegram received thousands of IP addresses from another St Petersburg company, Electrontelecom. iStories found that this company works with the FSB on secure communications systems for intelligence activities.
At the same time, iStories explicitly states that there is no evidence that GNM itself works with the Russian government or has transferred any data. However, according to the investigation, other companies closely linked to Vedeneyev have a documented history of cooperation with Russia's defence sector and the FSB.
Technical risks and the limits of what is proven
Telegram's architecture is based on centrally managed infrastructure. Although the platform offers end-to-end encryption in "secret chats," most correspondence goes through ordinary unencrypted chats. The content of such cloud chats is stored on Telegram's servers after being decrypted on the server side. This means that metadata — for example, users' IP addresses and connection times — may be accessible to those who control the network infrastructure.
Telegram uses its own MTProto protocol, which employs an auth_key_id — part of the user's main authorisation key. This identifier is not encrypted, so any structure capable of monitoring traffic to and from Telegram's servers (and Russia can do this thanks to the SORM system installed at all internet traffic exchange points) can observe these auth_key_ids. As the investigation concludes, it is technically possible to track when a specific user sends or receives messages and from which IP address, even if the content of the messages themselves remains encrypted.
In response to a BBC request, Telegram said that as a global structure it "has contracts with dozens of different service providers around the world," but stressed that none of them "has access to Telegram's data or confidential infrastructure." The statement claims: "All Telegram servers belong to Telegram and are serviced by Telegram employees," and the messenger "has never disclosed private messages to third parties, and its encryption has never been broken."
What remains unproven
Despite the seriousness of the conclusions, neither iStories nor OCCRP provided direct evidence that Telegram users' data were intercepted or that its infrastructure was deliberately compromised. The investigation shows a technical possibility: a company managing important parts of Telegram's network infrastructure has historical ties to Russian intelligence services. However, it does not demonstrate that this enabled actual surveillance. There are neither documents nor forensic data confirming this.
In addition to the technical analysis, the investigation cites evidence from the human rights group Pervy Otdel (First Department). They noted "a significant number of cases" in which the FSB inexplicably obtained their clients' Telegram correspondence. When hacking or user error is ruled out, suspicion falls on Telegram itself. However, such claims are almost impossible to verify, and there are simpler explanations: sophisticated honeypots, other vulnerabilities or user carelessness.
Ultimately, despite the lack of evidence, Telegram's own version of full opposition to the Russian state remains under suspicion. Pavel Durov continues to travel to Russia, and Telegram's transparency report, which has not been updated for more than six months, implausibly claims that there have been no requests for data from the Russian authorities. Although interaction between any large technology company and law enforcement is normal, the serious allegation that Telegram may disclose user data requires a higher standard of proof, which has not yet been presented.
1
