Many people who focus on information security, including myself, have
long considered
Telegram suspicious and untrustworthy.
Now, based on findings
published by the investigative journalism outlet ISt
Anyone who reads the article may be surprised to find that it contains literally no evidence to support the claim made in its clickbait headline. The author of the article comes to pretty different, much more limited conclusion:
Based on the analysis of packet captures above, I believe it is clear that anyone who has sufficient visibility into Telegram’s traffic would be able to identify and track traffic of specific user devices. Including when perfect forward secrecy protocol feature is in use.
This would also allow, through some additional analysis based on timing and packet sizes, to potentially identify who is communicating with whom using Telegram.
This is way more different thing than claiming and proving that Telegram is somehow FSB honeypot.
Furthermore, the author of the article does not even attempt to somehow prove a Telegram/FSB connection and takes this claim for granted based on the article published on websites of OCCRP and its Russian affiliate Istories. Let’s check this article and the evidence it presents:
Reporters obtained the company’s internal accounting documents for 2024 which show that one of its most important government clients is the FSB.
The documents show that Electrotelecom installs and manages equipment for a system that is being used by the FSB offices in St. Petersburg and the Leningrad region for surveillance.
Unlike the conclusions made in the rys.io article, which have a vast evidence base and can be verified, in this case we are simply asked to take the word of the so-called “investigative journalism outlet”.
And what do we know about OCCRP?
In 2024, it was reported that OCCRP receives nearly half its funding from USAID
This is way more different thing than claiming and proving that Telegram is somehow FSB honeypot.
I did not claim nor attempt to prove that “Telegram is somehow FSB honeypot”. I did claim and I believe I showed that it is indistinguishable from an FSB honeypot. If you’re nit-picking, at least nit-pick the correct claims, instead of some straw-man version of what I wrote that happens to be easier to attack. 😼
Yes, OCCRP received funding from USAID. They put that information very clearly on their own website. Here’s a crazy thought: investigative journalism needs to be funded somehow, and USAID was one of the ways this could be done. If you have a better idea of how to fund investigative journalism, there is a lot of media outlets that would love to hear from you!
The way OCCRP was/is funded does not say anything about the veracity of their reporting. Or that of IStories, which was done independently of OCCRP (that’s an important bit that most people miss).
What does speak to the veracity of reporting is the fact that over a decade and a half of reporting on stuff like this OCCRP has been sued by oligarchs multiple times in the most oligarch-friendly jurisdiction out there, UK (specifically, London), and have not lost a single time. Will Telegram sue OCCRP or IStories? Perhaps. Will they win? I seriously doubt it.
If they do sue, the discovery will be hilarious. IStories folks are going to get access to all sorts of great documents, I’m sure. Can’t wait for these to get published!
Speaking of documents, I like how you quote two random claims made in that OCCRP version of IStories article, and just decide to ignore the bit where Vedeneev claims, in actual court documents, that yes he has access to Telegram infrastructure. And how there are documents showing he owns GNM. And how there are documents showing he also signed documents on behalf of Telegram (hilariously, a document exists that he signed both on behalf of GNM and of Telegram). And how he co-owns or co-owned companies which are also co-owned by people directly connected to the FSB. And a bunch of other stuff.
But that doesn’t fit your “US shill” hot take, so why mention any of that right? 😄
On a personal note, it is so much joy to see all the hand-wavy pushback in this thread. Clearly the story hit a pain point somewhere. The funny thing is that if similar but much less substantiated claims were made about Signal here, there would be a frenzy of dunking on it as an “imperialist tool of surveillance”. 🤡
Anyone who reads the article may be surprised to find that it contains literally no evidence to support the claim made in its clickbait headline. The author of the article comes to pretty different, much more limited conclusion:
This is way more different thing than claiming and proving that Telegram is somehow FSB honeypot.
Furthermore, the author of the article does not even attempt to somehow prove a Telegram/FSB connection and takes this claim for granted based on the article published on websites of OCCRP and its Russian affiliate Istories. Let’s check this article and the evidence it presents:
Unlike the conclusions made in the rys.io article, which have a vast evidence base and can be verified, in this case we are simply asked to take the word of the so-called “investigative journalism outlet”.
And what do we know about OCCRP?
https://en.wikipedia.org/wiki/Organized_Crime_and_Corruption_Reporting_Project
I think that’s enough.
TLDR:
Telegram uses a suboptimal method of handling user IDs in its packets, which allows to track which user ID is sending messages to which user ID.
The Telegram/FSB link claim is based solely on unverifiable statements made by shills on USAID payroll.
I did not claim nor attempt to prove that “Telegram is somehow FSB honeypot”. I did claim and I believe I showed that it is indistinguishable from an FSB honeypot. If you’re nit-picking, at least nit-pick the correct claims, instead of some straw-man version of what I wrote that happens to be easier to attack. 😼
Yes, OCCRP received funding from USAID. They put that information very clearly on their own website. Here’s a crazy thought: investigative journalism needs to be funded somehow, and USAID was one of the ways this could be done. If you have a better idea of how to fund investigative journalism, there is a lot of media outlets that would love to hear from you!
The way OCCRP was/is funded does not say anything about the veracity of their reporting. Or that of IStories, which was done independently of OCCRP (that’s an important bit that most people miss).
What does speak to the veracity of reporting is the fact that over a decade and a half of reporting on stuff like this OCCRP has been sued by oligarchs multiple times in the most oligarch-friendly jurisdiction out there, UK (specifically, London), and have not lost a single time. Will Telegram sue OCCRP or IStories? Perhaps. Will they win? I seriously doubt it.
If they do sue, the discovery will be hilarious. IStories folks are going to get access to all sorts of great documents, I’m sure. Can’t wait for these to get published!
Speaking of documents, I like how you quote two random claims made in that OCCRP version of IStories article, and just decide to ignore the bit where Vedeneev claims, in actual court documents, that yes he has access to Telegram infrastructure. And how there are documents showing he owns GNM. And how there are documents showing he also signed documents on behalf of Telegram (hilariously, a document exists that he signed both on behalf of GNM and of Telegram). And how he co-owns or co-owned companies which are also co-owned by people directly connected to the FSB. And a bunch of other stuff.
But that doesn’t fit your “US shill” hot take, so why mention any of that right? 😄
You might also want to read the Russian version of IStories story, for hard documentary evidence of Durov’s connections to FSB:
https://www.istories.media/stories/2025/06/10/kak-telegram-svyazan-s-fsb/
On a personal note, it is so much joy to see all the hand-wavy pushback in this thread. Clearly the story hit a pain point somewhere. The funny thing is that if similar but much less substantiated claims were made about Signal here, there would be a frenzy of dunking on it as an “imperialist tool of surveillance”. 🤡