Is the indictment of Telegram’s CEO an attack on freedom of expression?

On August 28, after 96 hours in police custody, Pavel Durov was indicted by the French justice system on numerous charges relating to crimes, trafficking and misdemeanors taking place on Telegram. The arrest of the 39-year-old Franco-Russian billionaire, who lives in Dubai, took the world by surprise. With his reputation as an “uncompromising guardian” of freedom of expression in the face of the Russian regime, he had no reason to expect anything like this would happen in the European Union.

Birth of a legend 

Saint Petersburg, May 2018. Hundreds of demonstrators march down Ligovsky Avenue towards the Field of Mars. Leading them, anti-Putin activist Pavel Tchouprounov brandishes an icon of Christ Pantocrator bearing a striking resemblance to Pavel Durov. It was Durov, renowned for his libertarian views, who called on the people to protest against the state agency Roskomnadzor, which was threatening to restrict access to his platform and messaging service throughout the country. The reason for this was Telegram’s repeated refusal to comply with requests from the courts and the Federal Security Service (FSB). 

While at the helm of VKontakte, the Russian Facebook-like platform he launched in 2006, Durov had already had a run-in with the Kremlin, and in 2014 he firmly refused the Kremlin’s requisition requests relating to the Maidan movement in Ukraine and the opposition figure Alexei Navalny in Russia. It was in the wake of these two clashes that the entrepreneur was forced to sell his shares and leave the country to found Telegram in the United Arab Emirates, with his cryptographer brother Nikolai Durov.

By 2017, the app had become a huge success in Russia, Ukraine, Iran, and India. Today it boasts over 900 million users and has a number of unique features. Firstly, a marketplace and broadcast channels, which have the potential to attract millions of subscribers. Secondly, a messaging system where you can create groups of over 200,000 people. These features have attracted a number of leading political figures, including Emmanuel Macron. 

Incomplete encryption 

This hybrid between messaging service, marketplace, and social media network is the key to Telegram’s success, and it also has a reputation for being extremely robust. After all, wasn’t it Telegram that thwarted the FSB? Yet Telegram is not, strictly speaking, an end-to-end encrypted messaging service. The platform has two major shortcomings in this area, which two cryptographers in particular drew attention to — Filipo Valsorda in 2021 and Alanna Titterington in 2023. 

These shortcomings primarily relate to user experience. There is no end-to-end encryption on Telegram by default. Enabling the “secret chat” mode involves some surprisingly complex settings, and its scope is somewhat limited. For example, you cannot enable encryption for groups. However, according to Alanna Titterington, “millions of people entrust important secrets to Telegram chats with the firm belief that they’re protected by default,” as indeed they would be on WhatsApp, Signal, Threema, or Olvid. 

Worse still, the source code for MTProto, the encryption protocol designed by Telegram, was surprisingly opaque in 2021. “The designers have gone out of their way to add unnecessary complexity to their protocol, for the sole purpose of making undetectable interception possible,” was Filipo Valsorda’s analysis. In other words, the protocol allows back doors, which is absurd for an encryption protocol that is supposed to guarantee that chats remain confidential.

Another renowned cryptographer, Matthew Green, lamented three years later that “instead of improving the usability of Telegram’s end-to-end encryption, the owners […] have more or less kept their encryption UX unchanged since 2016.” This hasn’t stopped Pavel Durov from continuing to “aggressively market Telegram as a secure messenger” and benefiting from the publicity of the ECHR, which recognized encryption as a fundamental right when it ruled in favor of a Telegram user against the Russian Federation. 

A legitimate investigation 

In a state governed by the rule of law, encrypted messaging services are obliged to respond to legitimate requests from the courts. In the case of end-to-end encrypted content (where the keys are generated only by the users’ devices), messaging services only have access to a set of metadata (IP addresses, telephone numbers, transactions, etc.), which they can nonetheless pass on to the courts.

Yet the vast majority of content exchanged on Telegram is not even end-to-end encrypted. This means that not only is it vulnerable to attack by cybercriminals or clandestine interception by state actors, but it can also be viewed by the Telegram teams. How, then, can we justify the platform’s very low level of moderation when it comes to drug trafficking and child pornography? 

The preliminary investigation into Telegram, opened back in March 2024 by the French Cybercrime Unit, was justified by Telegram’s “almost total failure to respond to requests from the courts,” particularly in response to repeated requests from the Child Welfare Office. This failure to cooperate was “noted by both French investigative services and Eurojust,” confirmed the Paris Public Prosecutor’s Office. This lack of responsiveness is even more puzzling given that Telegram seems to be accommodating when it wants to and now complies with requests from the courts in Russia, which Durov has visited more than 50 times since his “exile” in 2014. 

Marc-Antoine Ledieu, a lawyer specializing in digital law, explains that “the current problem is the ‘online platforms’ whose owners believe they are above the law. The war on child pornography, which is being waged via private platforms that are fundamentally uncontrolled, poses a huge problem that our legal systems are unable to solve. The French justice system has used all the criminal offenses available to it. The principle of ‘casting a wide net’ applies here.” 

Is the privacy of its users Telegram’s priority? 

Since Durov’s arrest, a wave of panic bordering on paranoia has gripped Russian users at a time of high tension with France following the invasion of Ukraine. This is all the more surprising because the Russian army, which has not managed to create its own encrypted messaging system, makes extensive use of Telegram, while the Kremlin has passed a law to introduce a system to control administrators of Telegram channels with more than 10,000 subscribers.

The arrest of the CEO of a platform with real guarantees of confidentiality should not pose such a threat to its users. Messaging services like Signal or business suites such as Proton Mail, supported by foundations and protected by genuine end-to-end encryption (open source and by default) offer both guarantees of transparency and impartiality. 

Their cooperation with the justice system shows that, to a certain extent, paedocriminals and drug traffickers are not necessarily illegal stowaways on the European freedom of expression bandwagon. This is, in any case, what Pavel Durov—clearly a genius in the world of communication—will have to prove before the French courts.