Telegram founder’s arrest is radical — if it’s a crime to build privacy tools, there will be no privacy

www.crikey.com.au

Telegram founder's arrest is radical — if it's a crime to build privacy tools, there will be no privacy

Pavel Durov's arrest suggests that the law enforcement dragnet is being widened from private financial transactions to private speech.

The arrest of the Telegram CEO Pavel Durov in France this week is extremely significant. It confirms that we are deep into the second crypto war, where governments are systematically seeking to prosecute developers of digital encryption tools because encryption frustrates state surveillance and control. While the first crypto war in the 1990s was led by the United States, this one is led jointly by the European Union — now its own regulatory superpower.

Durov, a former Russian, now French citizen, was arrested in Paris on Saturday, and has now been indicted. You can read the French accusations here. They include complicity in drug possession and sale, fraud, child pornography and money laundering. These are extremely serious crimes — but note that the charge is complicity, not participation. The meaning of that word “complicity” seems to be revealed by the last three charges: Telegram has been providing users a “cryptology tool” unauthorised by French regulators.

85 comments

Well, except Telegram isn't a good tool for privacy.
There is no E2EE. Simple encryption is only available for 1:1 chats and disabled by default. Telegram doesn't disclose their encryption methods, so there is no way to verify the (in)effectiveness. Telegram is able to block channels from their end, so there is no privacy from their end either.
- Well, except Telegram isn’t a good tool for privacy.
  That's not the point. The hunting down on tools and their creators (and on our right to privacy) is the issue here. At least, imho.
  
  It has nothing to do with privacy. Telegram is an old-school social network in that it doesn't even require that you register to view the content pages. It's also a social network taken to the extreme of free speech absolutism in that it doesn't mind people talking openly about every kind of crime and their use of its tools to make it easier to obtain the related services. All that with no encryption at all.
  
  I am going to quote myself here:
  The issue I see with Telegram is that they retain a certain control over the content on their platform, as they have blocked channels in the past. That's unlike for example Signal, which only acts as a carrier for the encrypted data.
  If they have control over what people are able to share via their platform, the relevant laws should apply, imho.
- Signal fans being edgy cool kids
  
  Signal has its own issues. At least it has proper encryption
  
  Yay, let's all hate on the one crypto messenger, that is independently verifiably secure.
- Well, except Telegram isn’t a good tool for privacy.
  If Telegram wasn't good for privacy, Western governments would not be trying to shut it down.
  E2EE is nice, but doesn't matter if the government can just sieze or hack your phone. Much better to use non-Western social media and messaging apps.
  
  If Telegram wasn't good for privacy, Western governments would not be trying to shut it down.
  They are not trying shutdown Telegram, they are trying to control it.
  E2EE is nice, but doesn't matter if the government can just sieze or hack your phone. Much better to use non-Western social media and messaging apps.
  What kind of argument is this supposed to be? Governments can size your phone anywhere ... oh wait ... lemmy.ml ... yeah, I see...
  
  If it would be a good tool for privacy, Russia would try to shut it down the same way they did with Signal.
Telegram’s “privacy” is fully based on people trusting them not to share their data - to which Telegram has full access - with anyone. Well, apart from the optional E2EE “secret chat” option with non-standard encryption methods that can only be used for one on one conversations. If it were an actual privacy app, like Signal, they could’ve cooperated with authorities without giving away chat contents and nobody would’ve been arrested. I’m a Telegram user myself and I from a usability standpoint I really like it, but let’s be realistic here: for data safety I would pick another option.
- Matrix does have this the same. Most of publicly accessible channels are non encrypted. It's all because of e2e performance issues for big channels. It comes with a cost which is not required for most people
The crime is not responding to authorities when obviously illegal content such as CSAM is posted. Don't let the right try to spin this as a free speech thing. It's not.
- Other encrypted platforms: we have no data so we can't turn over data
  Telegram: we collect it all. No you can't know who is posting child abuse content
  
  Wait, telegram has collected it, knows about and, ultimately condones it? Or is it more of a wilful ignorance and resistance to forced compliance?
  
  It's clearly wrong. Matrix does have non-encrypted channels and honestly most of publicly accessible channels are non-encrypted. Do you consider matrix also on the Dame "bucket" as telegram? In matrix you can created encrypted channels but they work very badly in terms of performance with huge number of people like 1000+
- This.
- We still don't have a legal definition of "hate speech". Yes it's defined it is what it is, you can't find any international legal definition and it's left to the interpretation of judges. Don't you consider it worrying?
  About crime, as far as I know, child abuse and sex content is taken down. Drugs not - there are many countries with very lax drugs policies.
  
  I didn't comment on hate speech. I commented on CSAM, which the sources I've read and listened to (podcasts) say Telegram pretty much never answered when contacted.
I thought telegrams encryption was more or less non-existent? Am I missing something?
- It isn't secure in the least. They just have been ignoring the police world wide
- that’s correct - the issue here is that he has full access to the information that investigators are requesting and is simply refusing to comply with requests
  this isn’t shit like a conversation you had with a friend about weed - this is CSAM and drug trafficking
It would be easy to dismiss the headline's claim because Telegram's design makes it arguably not a privacy tool in the first place.
However, it is possible that this arrest was chosen in part for that reason, with the knowledge that privacy and cryptography advocates wouldn't be so upset by the targeting of a tool that is already weak in those areas. This could be an early step in a plan to gradually normalize outlawing cryptographic tools, piece by piece. (Legislators and spy agencies have demonstrated that they want to do this, after all.) With such an approach, the people affected might not resist much until it's too late, like boiling the proverbial frog.
Watching from the sidelines, it's impossible to see the underlying motivations or where this is going. I just hope this doesn't become case law for eventual use in criminalizing solid cryptography.
- You're thinking too far. As someone who knows two people that worked for the Swiss government closely:
  Don't worry about it. The whole deepstate Idea is absolutely ridiculous.
  There is no big plan to weaken encryption or anything. There was probably a single prosecutor working on a case involving Telegram that saw his chance and took it.
  Seriously, you should be a lot more worried about google or meta, not western democracies.
  Unless you live in russia/china/iran/yourFavouriteDictatorship, then forget whatever I just said. But if you live there, what's happening in France isn't a Problem to you anymore since your government does it anyways lol
  But yeah, I'm getting a not tired of the deepstate conspiracies. He broke the law, that's why he gets arrested, not because of some deepstate conspiracy
  
  What are you on about?
  When legislation aiming to restrict people's rights fails to pass, it is very common for legislators/governments to try again shortly thereafter, and then again, and again, until some version of it eventually does pass. With each revision, some wording might be replaced, or weak assurances added, or the most obvious targets changed to placate the loudest critics. It might be broken up in to several parts, to be proposed separately over time. But the overall goal remains the same. This practice is (part of) why vigilance and voting are so important in democracies.
  There's nothing "deep state" about it. It's plainly visible, on the record, and easily verifiable.
  As someone who knows two people that worked for the Swiss government closely
  This is an appeal to authority (please look it up) and a laughably weak one at that.
  There is no big plan to weaken encryption or anything.
  You obviously have not been keeping up with events surrounding this topic over the past 30 years.
  
  There is no big plan to weaken encryption or anything.
  This may not be a symptom of such a plan, but there very much is such a plan.
  Exportation of PGP and similar "strong encryption" in the 90s was considered as exporting munitions by the DoD.
  it was not until almost two decades later that the US began to move some of the most common encryption technologies off the Munitions List. Without these changes, it would have been virtually impossible to secure commercial transactions online, stifling the then-nascent internet economy.
  More recently you can take your pick.
  Governments DO NOT like people having encryption that isn't backdoored. CSAM is literally the "but won't someone think of the children" justification they use, and while the goals may be admirable in this case, the potential harm of succeeding in their quest to ban consumer-accessible strong encryption seems pretty obvious to me.
  As a bonus - anyone remember Truecrypt?
  https://cointelegraph.com/news/rhodium-enterprises-bitcoin-usd-loan-bankruptcy
  https://www.csoonline.com/article/547356/microsoft-subnet-encryption-canary-or-insecure-app-truecrypt-warning-says-use-microsoft-s-bitlocker.html
The world is turning bad, Telegram is not really a private app, but they have one advantage is that they fuck off all the govs that try to get datas from its users! Soon govs will forbid the encryption to watch gently in our digital life. He's not complice with these crimes, he's just proposing a tool that make communication more secure and private, but sadly some bad actors use it as a way to do bad things...
- Why do they have the data in the first place?
  Your communications on telegram are not encrypted by default. You can have e2e encrypted 1on1-conversations, but group chats are blown for them to do everything.
  They had a hilarious argumentation where they claimed that the key to unlock your chats is stored on a different server than your chats are and therefore they cannot access it. A company that argues like they ("trust us") isn't trustworthy.
  Signal has been audited over and over again by internationally respected cryptographers. They cannot decrypt your chats by design. No need for "trust us bro".
  
  Yeah this is true and I don't recommended Telegram in any case, but it's sad that a guy who try to protect a bit our privacy be arrested
- All the governments?
  
  I remember them responding to a couple antipiracy lawsuits in... India I think? they also make an exception for ISIS-related channels. But mostly all, yes.
- More likely they will just dissolve as an organization. They are hated by all at this point
Chris Berg is a professor of economics at the RMIT Blockchain Innovation Hub.
- Thanks, here is more information about Crikey:
  Crikey is an independent Australian source for news, investigations, analysis and opinion focusing on politics, media, economics, health, international affairs, the climate, business, society and culture. We are guided by a deceptively simple, old idea: tell the truth and shame the devil.
  
  Chris Berg is a professor of economics at the RMIT Blockchain Innovation Hub.
  Worthless opinion piece is worthless.
Telegram is not a privacy tool.
I mean, if he's convicted for a privacy tool, while it's not a privacy tool, we have a bit of ambiguity.
Arguably advertising something which is not a privacy tool as one is fraud. Maybe even phishing, since TG the company has in plaintext all the chat history of its users.
And this
The meaning of that word “complicity” seems to be revealed by the last three charges: Telegram has been providing users a “cryptology tool” unauthorised by French regulators.
in non-libertarian language means something similar, that is, that something not confirmed to be a privacy tool is being provided as a privacy tool.
I am a libertarian, but in this case they are consistent, if I'm reading this correctly. They are not abusing power, they are doing exactly what they are claiming to be doing.
Also maybe I'm just tired of Telegram. It's engaging, and I have AuDHD, which means lots of energy spent, and I can't drop it completely because work, and also some small communities are available as TG channels. Would be wonderful were they to move at least to WhatsApp, but it is what it is.
Still, ability to easily create a blog (what a TG channel really is for its users) reachable without bullshit is a niche in huge demand. LJ filled that at some point, Facebook did at another, TG does now.
Something like this is desperately needed. I'd say the solution should be complementary to Signal - that is, DMs and small groups should not be its thing. Neither should be privacy of huge chats and channels - they'd be public anyway. However, anonymity with means to counter spam should, so should be metadata of user activity.
Honestly this could go to ways. I really hope people more to more secure platforms but it is possible they find something equally as problematic
Where my piracy groups going to go now?
I'll miss their 2gb upload cap
- Torrenting websites.... you mean forums?...ah fuck..
In all fairness Telegram has unencrypted user data and messages but didn't turn it over to the authorities. They also allow known criminal activity to thrive.
- They also allow known criminal activity to thrive.
  Most scammers I have seen are operating out of Facebook or Instagram.
  
  What is "most scammers?"
  That's not a useful metric. What is a "scammer?" Also it is probably better to look a scammers per capita
- It is very important to mention that you mean end-to-end encryption. The data is stored encrypted when using cloud chat. Nothing (besides phone number what I know) is stored in plain text on Telegram's servers.
  I am not defending Telegram. I am just stating facts.
  Negative votes incoming in 3... 2... 1...
  
  It is very important to mention that you mean end-to-end encryption. The data is stored encrypted when using cloud chat.
  In response, it is very important to mention that point-to-point encryption and encryption at rest are next to meaningless with respect to the chat participants' privacy. They might be relevant to the case against Durov, but they don't protect against leaks or compromised servers. Please don't rely on them for your safety.
  
  It isn't E2EE
Governments want to make it illegal to have privacy. Durov's arrest was one of the many steps they are taking in that direction.
- That might be true but in this case Telegram was hosting lots of CSAM and other illegal activity in public group chats.
  Imagine you are the victim of Sex abuse. Your nude images are on a public group chat and yet Telegram does nothing. There is no technical reason they couldn't remove the images. They just don't feel like it. What's worse is that there is a lot of images of children.

85 comments