Telegram criticized again: between crime and promise

Contents

The Telegram app, which was founded in Russia and is officially operated from Dubai, has been highly controversial and surrounded by scandals for years. This week, the ARD format Ctrl+F published an episode on rapist and abuse groups on the platform, which is strongly reminiscent of the case of the French woman Giselle Pelicot, who was abused for years. The verdict was handed down on Thursday: 51 guilty verdicts against the perpetrators.

In the Pelicot case, it was not Telegram, but a seemingly harmless chat website called Coco, which eine played a central role and whose founder in Bulgaria was arrested.

The case of the Telegram groups found by the Ctrl+F reporters is just one in a long series of crimes in which the software plays a connecting role. The main reason for this is that many users and probably also perpetrators feel safe and anonymous there. For a long time, the operator almost never cooperated with the authorities as a matter of principle.

Telegram essentially consists of two largely separate functions: Direct messages between two recipients or groups, in which several participants can communicate, and the channel feature, in which a few can send to many. The provider also deliberately allows bots: easily created, automatable bots.

What mainly happened in the chat groups rarely led to consequences. The pressure to prosecute was extremely low. Telegram claims to have almost one billion users worldwide. A large proportion of them use the app as a short messaging app to chat with friends and family, send pictures or leave voice messages. But some users have other things in mind.

There is currently a Telegram in almost every problem

In September 2024, Telegram apologized in South Korea for not taking consistent action against deepfake porn material based on photos of minors on its servers. In November, Telegram handed over data to the Dutch authorities after massive allegations of use by people smugglers and drug dealers were made there. The operator also released data to the Federal Criminal Police Office, at least temporarily.

No matter where you look, from coke cabs, WireCard, crypto fraud, terrorism or other crimes: Telegram is apparently currently the tool of choice for criminals of all kinds. Instead of working laboriously via darknet forums and marketplaces, the simplicity of Telegram is apparently also tempting for them. This could prove to be a gift for investigators in the future: Because where perpetrators feel too safe, they make mistakes. And using Telegram is one of them in these cases.

In the iOS store, the Telegram app is still advertised as follows: "We take your privacy very seriously and will never allow third parties to access your data. You can delete every message you've ever sent or received, for both parties, at any time and without a trace." Google's Play Store even states: "Everything on Telegram, including chats, groups, media, etc. is encrypted." However, Telegram groups and channels are technically anything but secure: access to the device of a group participant or an invitation link is usually enough to access the content of groups and channels – and Telegram already provides extensive APIs for the bots anyway.

It is still unclear how secure the encryption put together by Telegram itself actually is. One thing is clear: it only works if the participants in a conversation actively switch it on for conversations – and even then it would work nur for conversations between two participants.

Nevertheless, many users believe that Telegram is an encrypted messenger service. Something like WhatsApp or even Threema, Wire or Signal. But this is only partly true, even beyond the encryption.

Half messenger service, half platform

In legal terms, Telegram is also a hybrid: as a messenger, i.e. a number-independent communication service, as it is called in German telecommunications law. And, because the service caches content for groups and channels on its server, for example, it is also a platform operator. In the EU, these are actually subject to the rules of the Digital Services Act (DSA). Among other things, the DSA stipulates that every provider is obliged to check whether potentially illegal content needs to be removed or blocked as soon as they become aware of it. Special obligations actually apply to the largest providers, which have more than 45 million users in the EU -- but Telegram announced in February 2024 that it only had 41 million monthly active users in the member states of the European Union.

The EU Commission doubts the operator's data and calculation methods, but the matter has not yet been conclusively clarified even after almost a year. However, if Telegram were to officially exceed the relevant threshold, it would have to do much more itself to mitigate the risks arising from the design of its service and would be under the direct supervision of the EU Commission.

As Telegram itself does not have a permanent establishment within the EU, it has appointed a legal representative for the DSA, as required by law. The company that Telegram has named as its legal contact under the General Data Protection Regulation is based at 71 Avenue Huart Hamoir in Brussels.

More activity since the temporary arrest of the founder

Since the beginning of December, Telegram has been working with the Internet Watch Foundation in England, the C3P and other organizations that operate large databases with hash values of already known depictions of child sexual abuse. It is unclear whether the significant increase in the number of blocks and deletions on Telegram in recent months is directly related to this. Telegram also claims to use its own AI-based detection methods.

The close temporal connection between increased cooperation with authorities and other organizations, changes to the terms of use at the end of September 2024 and the temporary arrest of Telegram founder Pawel Durow in Paris at the end of August and the suspension of the arrest warrant under conditions four days later, as well as the request from the ARD research team, is striking.

(vza)