In the Important Stories investigation, it is said that Telegram founder Pavel Durov has repeatedly stated publicly that he has no ties to the security services, but an analysis of the messenger's infrastructure showed otherwise. According to the journalists, the servers are maintained by companies that have previously carried out orders for Russian security agencies.
The traffic experiment
To check what data is transmitted over the network, Important Stories asked users in Russia and abroad to send messages and recorded the traffic using Wireshark. It turned out that the device identifier (auth_key_id) is transmitted unencrypted. As digital security expert Mikhail "Rytek" Voznyak explained, this identifier allows the server side to identify the device and select a key to decrypt messages. According to him, other messengers use TLS to protect the connection, and Telegram has no reason not to do the same.
Voznyak also noted that Russia has SORM—a system that obliges providers to install surveillance equipment. According to him, the security services have access to traffic passing through providers and can track device identifiers, and together with IP addresses and the time messages are sent, this makes it possible to determine users' locations and connections.
Who maintains the servers
The journalists found that Telegram's infrastructure has been handed over to a single company that is de facto located in Russia. Former Telegram partnerships manager Elies Campo, in conversation with Important Stories, recalled that Durov spoke of leaving Russia but did not want to be in the country because of his experience with VKontakte. Campo also claimed that private conversations with Durov differed from his public statements.
Earlier, in 2017, former VKontakte employee Anton Rozenberg said that Telegram was developed by a St. Petersburg company called Telegraf, and that the messenger's team was based in its office. Telegram's management accused Rozenberg of disclosing trade secrets and demanded 100 million rubles in compensation, but later proposed a settlement agreement.
According to tax records, Telegram employed Durov's personal assistant and a top manager who calls herself co-director of Telegram.
Reaction and denials
Telegram itself did not know about Durov's trips to Russia. Former partnerships manager Elies Campo said: "I believed the narrative that the team had to flee the country and wander the world like nomads because of what they experienced in Russia. Our private conversations [with Durov] matched what he said in interviews and public speeches."
Durov himself had previously criticized competitors. In 2015 he stated: "WhatsApp is absolute crap… It's not confidential." In 2020 he predicted that a backdoor would be found in Signal, but this did not happen, and digital security experts continue to consider this messenger reliable.
Important Stories also found from an FSB border service database that Durov had traveled to Russia more than 50 times since leaving in 2014, especially often when he had financial problems. Telegram did not comment on this information.
1
