The Telegram messaging app may be less secure than previously thought, as its infrastructure is controlled by a man whose companies have collaborated with Russian intelligence services, according to a new investigation by the exiled outlet IStories.
The popular messaging app's founder, Russian-born Pavel Durov, has touted his platform as a haven for free speech and digital privacy, particularly in authoritarian countries.
In reality, Telegram chats are not end-to-end encrypted by default like competitors WhatsApp or Signal. Unless users opt in to the app’s "secret chat" feature, these chats are decrypted and stored on servers.
"This means that whoever controls the server can access the correspondence," IStories wrote.
This infrastructure is maintained by Global Network Management (GNM), a little-known company based in Antigua and Barbuda that has provided Telegram with over 10,000 IP addresses, IStories found.
GNM’s owner, Russian national Vladimir Vedeneev, testified in a U.S. court that the company installs and maintains Telegram’s infrastructure and has staff in Russia. According to court documents reviewed by IStories, Vedeneev also serves as Telegram’s chief financial officer.
Many of GNM’s IP addresses previously belonged to St. Petersburg-based telecommunications firm Globalnet, which has links to the Kremlin and Russian intelligence services, including the FSB, IStories reported.
Telegram also reportedly received 5,000 IP addresses from another St. Petersburg-based company, Electrontelecom, which IStories identified as an FSB contractor. The company provided installation and maintenance for secure communication systems used in intelligence operations.
In 2022, Globalnet implemented user traffic monitoring systems at the request of the Russian state communications watchdog Roskomnadzor.
Oleg Matveychev, deputy chairman of the State Duma’s Information Policy Committee, said at the time that Telegram and the FSB had reached a “compromise” in which Telegram installed infrastructure enabling authorities to monitor users involved in criminal investigations, such as suspected terrorists.
In addition to decrypting its users’ messages and storing them on servers, Telegram also attaches a unique device identifier known as “auth_key_id” to every message, cybersecurity expert Michał Woźniak told IStories.
This identifier allows the platform to determine the user’s device and apply the appropriate decryption key. In combination with metadata like IP addresses and timestamps, Woźniak said, this system could be used to determine a user’s physical location and contacts.
“If someone has access to Telegram traffic and cooperates with Russian intelligence services, this means that the device identifier becomes a really big problem — a tool for global surveillance of messenger users, regardless of where they are and what server they connect to,” Woźniak told IStories.
In a statement later Tuesday, Telegram said none of its contractors have access to user data or critical infrastructure and that it does not have any employees or servers inside Russia.
"All Telegram servers belong to Telegram and are maintained by Telegram employees. Unauthorized access is impossible. Telegram has no employees or servers in Russia. Throughout its history, Telegram has never transmitted personal messages to third parties, and its encryption has never been hacked,” Telegram’s press service said.
A Message from The Moscow Times:
Dear readers,
We are facing unprecedented challenges. Russia's Prosecutor General's Office has designated The Moscow Times as an "undesirable" organization, criminalizing our work and putting our staff at risk of prosecution. This follows our earlier unjust labeling as a "foreign agent."
These actions are direct attempts to silence independent journalism in Russia. The authorities claim our work "discredits the decisions of the Russian leadership." We see things differently: we strive to provide accurate, unbiased reporting on Russia.
We, the journalists of The Moscow Times, refuse to be silenced. But to continue our work, we need your help.
Your support, no matter how small, makes a world of difference. If you can, please support us monthly starting from just $2. It's quick to set up, and every contribution makes a significant impact.
By supporting The Moscow Times, you're defending open, independent journalism in the face of repression. Thank you for standing with us.
Remind me later.
