Almost a year ago, the publication Important Stories released an investigation into Telegram's ties to the FSB; an English-language version appeared on the OCCRP website. The authors claimed that the security service could build a network of connections between users of the messenger worldwide. Two arguments underpinned this: the presence of an unencrypted device identifier (auth_key_id) in traffic, and the ties of Vladimir Vedeneyev — owner of Global Network Management (GNM), which, according to the investigation, services a significant portion of Telegram's server infrastructure.
What the expert report showed
In 2025, Vedeneyev filed lawsuits against Roman Anin, editor-in-chief of Important Stories, in Switzerland and against OCCRP in the US. To support his position, he commissioned an expert report from Symbolic Software, carried out by its founder Nadim Kobeissi — a French-Lebanese applied cryptography researcher and public critic of Telegram's security model. Kobeissi reproduced the technical research of Polish expert Michał Woźniak, cited by Important Stories, and confirmed the main findings: auth_key_id is effectively a device identifier, visible in traffic, persists across app restarts and IP address changes, and the changing identifiers are easily correlated under continuous observation. According to Kobeissi, this allows tracking the movements of device owners even if they switch Wi-Fi or SIM cards.
However, as Meduza writes, the expert questioned other conclusions of the investigation. He pointed out that reconstructing a user's social graph — who corresponds with whom — is practically impossible due to Telegram's centralized architecture: the server decrypts a message with one key, encrypts it with another, and transmits it to the recipient along with other data, which impedes identifying the recipient. Any conclusion about connections based solely on traffic analysis will be probabilistic, Kobeissi asserts. The exception is offline meetings, where regular coincidence of place and time allows a connection to be established.
Criticism of methodology
Kobeissi also criticizes the investigation's methodology: the link between the infrastructure provider and Russian special services, in his view, is established by circumstantial evidence. He called this "guilt by association": the chain is built on the fact that Vedeneyev's company manages part of Telegram's infrastructure, that GlobalNet, which he founded, has government clients, and therefore the special services may have access to traffic. For comparison, the expert cited Signal, which uses Amazon infrastructure; Amazon has contracts with the CIA and NSA, but this does not imply special surveillance capabilities over Signal users.
At the same time, Kobeissi emphasized that criticism of the geopolitical presentation does not negate the reality of the vulnerability: "The technical vulnerability is real and affects all Telegram users regardless of which malefactors may exploit it. Infrastructure providers in any country — be it Russia, the US, China or other states — are potentially able to exploit this vulnerability if they have access to the network."
What the FSB can do and how to protect yourself
According to Meduza's assessment, theoretically the FSB can track users by identifier at least on Russian territory, but the scale of mass surveillance is hard to estimate. Targeted surveillance of individual devices is possible: under the "Yarovaya law," telecom operators are obliged to store traffic for six months and provide access to it to special services officers. A VPN substitutes the IP address but does not hide the auth_key_id during transmission between the VPN server and Telegram's server. If the special service does not have access to data from infrastructure providers, a VPN will help; if it does, as Important Stories suggests, it will not. Kobeissi asserts that only Telegram's developers can close the vulnerability.
Telegram's developers did not acknowledge the vulnerability. In a post published a couple of weeks before the article, they stated: "Any observer capable of seeing your auth_key_id also sees your IP address, the names of the servers you connect to, the nature of your traffic, DNS queries and much more. Hiding a frequently changing identifier is like closing one window in a building made almost entirely of glass."
1
