Telegram is a cross-platform instant messaging system for text, voice and video messages, as well as photos and files in many formats. Beyond chats and groups, the messenger lets users store an unlimited number of files, run channels (microblogs), and create and use bots.
Telegram is considered one of the most popular messengers. However, no messenger can guarantee absolute security: a system can be attacked from the outside, through vulnerabilities in its code, or from the inside, by the messenger’s developers or by anyone with the appropriate access.
GENERAL INFORMATION ABOUT THE MESSENGER
Section 3.3.1 of Telegram’s Privacy Policy, on cloud chats, states that “Telegram is a cloud service. We store messages, photos, videos and documents from your cloud chats on our servers…” Data in the messenger is exchanged through servers: a text message is not sent directly but passes through a Telegram server. All correspondence and data stored on the servers may therefore be visible to the developers or to anyone with the appropriate access.
Building a fairly detailed profile of a Telegram user’s public activity is not difficult. A Telegram ID is enough.
The only relatively safe way to preserve privacy is voice calls or a secret chat. Even then, you need to verify the image and text generated from the secret chat’s encryption key by comparing them with those shown in your contact’s chat. Yet no one can guarantee that data encrypted with such a key is not decrypted or stored on the server.
Given today’s realities, another important question arises: how can an “encrypted” messenger operate in a country with total control over everything and everyone? Telegram’s developer, Pavel Durov, was born in Saint Petersburg, which makes him Russian. One of Durov’s products is the social network VKontakte, which today is fully controlled by Russian intelligence services (according to open official sources).
It is also worth noting that Telegram’s user base in Russia grew from 30 million in 2020 to almost 50 million today, overtaking WhatsApp as the most widely used messaging platform there.
Ukraine has already blocked the VKontakte social network, and its users moved to Telegram. But have we simply swapped one problem for another?
RISKS OF USE
Considering the messenger’s origin, technical characteristics and functionality, several risks arise when using it.
The first thing to consider is the security of data storage. We cannot trace which servers store Telegram users’ data and correspondence, nor rule out access to that data by Russian intelligence services. Telegram’s Privacy Policy says that only its employees have access to the servers and equipment, but those employees could be intelligence officers. Nor can we exclude the possibility that current employees have been recruited.
One of the most dangerous risks is a security hole: open access to the API (an API is a set of components that lets a computer program, such as a bot or a website, use another program). In Telegram’s case, this data includes text and metadata from any public group chat or channel, for example records of when users were last online. It is also possible to spoof locations in the Telegram API in order to locate any user within a 3 km radius, provided they have enabled the “People Nearby” feature. This makes it possible to determine other users’ whereabouts with an accuracy of about 550 meters. Especially now, during the war, when the safety of service members must come first, such a built-in feature could help the enemy learn where our soldiers are.
Group chats, which are open to all Telegram users, are another dangerous feature. Confidential information discussed or shared in such chats can, unfortunately, reach unwanted parties. Despite how convenient these chats are for exchanging data, they easily become a target for hostile intelligence services. That is why it is important to prevent any data leak, especially in government institutions, by prohibiting employees from using Telegram at work or for transmitting any data that matters for national security.
Among other risks is the spread of disinformation. Thanks to its built-in channel (microblog) feature, Telegram is used as a news feed and a resource for quickly sharing information. But because channel owners are anonymous and there are numerous bot farms, disinformation spreads fast.
Because moderation on the messenger is poor, bots (fake accounts posing as real users) can be used for psychological and disinformation attacks. They are often used to manufacture the appearance of mass opinion and reactions in comments of news groups and on the pages of public figures’ blogs. Such attacks can also be used to promote certain publications or, conversely, to harass people and damage the reputation and image of individuals or businesses.
The dangers posed by bots inside Telegram also include the use of DeepFake technology to create pornographic content for blackmailing platform users. Attackers save previously published photos or videos and later use a Telegram bot to edit them into compromising material. Despite numerous user complaints asking for such bots to be blocked, Telegram’s support service does not respond to these requests.
Telegram also has minimal content moderation, apart from its declared commitment to fight illegal pornography, intellectual property violations, fraud and calls for violence. It has become a modern “darknet” and a toolkit for carrying out cyber threats by hacker groups linked to Russian intelligence services and by cybercriminals from various countries. According to analysis, Telegram ranks third among platforms where criminals promote their phishing sites. Meanwhile, the number of Telegram users keeps growing.
Telegram has also repeatedly been used to distribute illegal drugs.
RECOMMENDATIONS FOR USE
Despite Telegram’s convenient and intuitive functionality, we cannot be 100% sure of the security of data storage or the confidentiality of communication in the messenger.
That is why it is important to follow the basic rules when using Telegram. Do not send important information or mention it in your conversations, in order to prevent any data leak, especially in government institutions. Do not use Telegram at work or to transmit any data (files, documents, etc.) that may matter for national security.
Periodically check your Telegram settings, in the “Devices” section, for third-party devices that have access to your account.
To avoid falling victim to disinformation, we recommend analyzing any information published in Telegram by anonymous groups and verifying it against the official resources of government bodies and public figures. Telegram channel authors are usually anonymous, so they bear no responsibility for the news they publish and present as truth.
Do not engage in arguments with “strange” accounts (bots) in Telegram group comments.
We also advise minimizing the amount of personal data in your Telegram profile.
Loss of personal data, disinformation, unreliable storage and the spread of harmful content all make Telegram an unreliable tool for communication.
Where possible, minimize the use of this messenger for military or official purposes, especially when exchanging secret or critical information.
